Privacy Policy

OpsBoard ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information when you use the OpsBoard platform.

This policy applies to Organizers (account holders), Team Leads, and Volunteers who interact with the Service.

Account information (Organizers):

• Name and email address (provided at signup)
• Password (hashed — we never store plaintext passwords)
• Payment information (processed by Stripe — we do not store card details)

Event information:

• Event name, description, dates, and location
• Roles, tasks, SOPs, and shift configurations you create
• AI-generated board content based on your event description
• Broadcasts sent during events

Volunteer information (collected on behalf of Organizers):

• Name and optionally email address
• Role and shift assignment
• Check-in and check-out timestamps
• Task completion status
• Hours logged

Usage information:

• IP address (used for rate limiting AI features)
• Browser and device type
• Pages visited and features used

We use the information we collect to:

• Provide, operate, and improve the Service
• Process payments and send receipts
• Generate AI-assisted event boards and volunteer responses
• Send transactional emails (magic links, thank-you emails after events)
• Rate limit AI features to prevent abuse
• Generate post-event analytics for Organizers
• Respond to support requests
• Comply with legal obligations

We do not sell your personal data. We do not use your data for advertising.

OpsBoard uses the following third-party services to operate. Each has its own privacy policy governing how they handle data.

The iPhone camera is used only when you choose to scan an event invitation. QR recognition takes place on your device; OpsBoard does not upload camera images.

We share data only in these circumstances:

• With third-party services listed above, solely to operate the Service
• With Organizers: volunteer data collected at their event is visible to that Organizer and their assigned Team Leads
• When required by law, court order, or government authority
• To protect the rights, property, or safety of OpsBoard or its users
• In connection with a merger, acquisition, or sale of assets (you will be notified)

We retain your data for as long as your account is active. Specific retention periods:

• Account data: retained until account deletion
• Events you own and their operational records are removed from the active database when you delete your account
• Volunteer data: retained for the duration of the event Organizer's account
• Stripe retains payment records according to its policies and applicable requirements
• Rate-limit identifiers are processed by Upstash; limits use request windows of up to 15 minutes

You can delete your account in Settings by typing DELETE and confirming. Guest crew members can contact nacariheron@gmail.com to request removal of their records. Provider backups and legally required records may follow separate retention schedules.

We implement security measures including:

• All data transmitted over HTTPS/TLS
• Passwords hashed using bcrypt via Supabase Auth
• Row-level security (RLS) policies enforcing per-user data access at the database level
• Service role keys never exposed to the client
• Stripe handles all payment card data — we never touch card numbers

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we take reasonable precautions to protect your data.

OpsBoard uses cookies and similar technologies for:

• Session management (Supabase Auth session cookie — required for login)
• No advertising or tracking cookies are used

Guest volunteers (who join without an account) use browser sessionStorage to temporarily store their event code, volunteer ID, and name. This data is cleared when the browser tab is closed. A signed, HttpOnly guest cookie also authorizes access to that crew session and expires after seven days.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to or restrict processing of your data
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time (where processing is based on consent)

To exercise these rights, contact us at nacariheron@gmail.com. We will respond within 30 days.

OpsBoard is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us immediately at nacariheron@gmail.com.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy with an updated effective date. Continued use of the Service after changes constitutes acceptance of the updated policy.

For questions, requests, or concerns about this Privacy Policy, contact: nacariheron@gmail.com