Last updated: October 27, 2026
This Privacy Policy explains how RetroRail (“the Service”), operated by Matt Black, collects, uses, and protects personal data. RetroRail is currently in private beta and available by invitation only.
The data controller for the Service is Matt Black. For any data protection inquiry, contact hello@retro-rail.com. You can also exercise your access, portability, and erasure rights yourself, without contacting anyone — see section 8.
Directly from you:
- Email address, and name where your sign-in provider supplies one. Depending on how you sign in, this comes from Google, or from a demo account we issued you.
- Display name you enter when joining a board or session.
- Content you create: retro cards, group labels, action items, story estimates, and session configuration.
- Authentication cookies that keep you signed in.
Automatically, when you visit a page: an anonymous page-view count (the page, with session ids and query strings removed, the referring site, and your country, browser, operating system and device type), through Vercel Web Analytics. See section 4.
Connecting Jira is optional and off by default. If you connect it, RetroRail reads boards, sprints, and issues that your own Atlassian account can already see, and displays them to you inside the Service. That data can include personal data about your colleagues — issue assignee names and avatars in particular — who are not themselves RetroRail users.
Issue data is fetched live from Atlassian each time it is displayed and is not copied into our database. The exceptions are deliberate links you create: the issue key of a story you import into planning poker, or of an issue you create from an action item. Those keys are stored so the link keeps working.
For this Jira-sourced data, your organisation is the data controller and RetroRail acts as a processor on your instruction. We process it only to render the features you asked for, never to build profiles, train models, or share with anyone. You can sever this at any time from Settings → Integrations; disconnecting revokes our access at Atlassian and deletes the stored credentials.
Your Atlassian access and refresh tokens are encrypted at rest, are never sent to your browser, and are never included in a data export.
- Authentication and account management — performance of a contract.
- Providing the collaboration features, including showing your display name to other participants in sessions you join — performance of a contract.
- Fetching and displaying your Jira data — performance of a contract, on your instruction, and only while you keep the integration connected.
- Keeping the Service secure, including rate limiting and server error logs — legitimate interest.
- Counting page views, to see how many people use the Service — legitimate interest. Vercel Web Analytics records the page (with session ids and query strings removed before they leave your browser), the referring site, and your country, browser, operating system and device type. It sets no cookies and stores no IP address; it tells repeat visits apart within one day by a hash of the request that it discards after that day. Each page view is also added to a daily total kept by mattblack.space (our developer’s site), together with, when you arrive from another site, the kind of place you came from (for example a search engine or LinkedIn), worked out from that site’s name, which is then forgotten. Those totals hold no page, cookie, IP address or identifier.
We do not process personal data for advertising or profiling.
Application data is stored in Supabase (hosted on AWS) in the US-East-1 region. The application is hosted on Vercel. If you are in the UK or EEA, this means your data is transferred to the United States; both providers offer data processing agreements incorporating the applicable safeguards.
- Supabase — database, authentication, and realtime messaging.
- Vercel — application hosting, edge network, and page-view counting (Web Analytics).
- Google — sign-in, for users who authenticate with a Google account.
- Atlassian — only where you have connected Jira, and only to serve your own requests.
We do not use advertising, session-recording, or error-tracking third parties, or any analytics beyond the page-view counting above.
Strictly necessary cookies only, for keeping you signed in. No tracking, analytics, or advertising cookies are set — which is why the Service does not ask you for cookie consent. Your theme preference is kept in your browser’s local storage and never reaches our servers. See the Cookie Policy for the full list.
Under the UK GDPR and EU GDPR you have the right to access, rectify, erase, restrict processing of, and port your personal data, to object to processing, and to lodge a complaint with a supervisory authority.
Three of these are built into the Service and need no request: Settings → Account & data exports a machine-readable copy of your data (access and portability), and deletes your account and everything it owns (erasure). You can correct your display name wherever it appears.
For anything else, contact hello@retro-rail.com. We aim to respond within 30 days.
We keep your data for as long as your account exists. Boards, sessions, and their content persist until you or their creator deletes them, or until the account that created them is deleted. There is no automatic expiry: nothing is removed on a schedule, so if you want something gone, delete it.
Deleting your account is immediate and irreversible. Because a board belongs to whoever created it, deleting your account also deletes boards you created, including contributions other participants made to them.
Server logs, which may contain IP addresses and error details, are retained by our hosting providers under their own retention schedules.
Page-view counts are kept by Vercel Web Analytics for its plan’s reporting window (currently one month) and are not linked to your account. The daily totals on mattblack.space are kept indefinitely; nothing in them identifies you.
Encryption in transit (TLS), row-level security on every database table so users can only reach their own sessions, encryption at rest for retro content and Atlassian credentials, and a Content Security Policy plus related hardening headers. No system is perfectly secure, and RetroRail is a beta product — please weigh that before entrusting it with sensitive material.
We may update this policy. Material changes will be reflected in the “Last updated” date above.
For questions about this Privacy Policy or to exercise your rights: hello@retro-rail.com.