Privacy Policy

Roadmark is operated by Ducat Digital Ltd, a company registered in England and Wales (company number 17336739, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom) — the data controller for the processing described here. You can reach us at support@yourroadmark.com.

To run the service we collect the following:

• Account info — your email and a password hash (Supabase Auth handles hashing; we never see the plaintext).
• Board content — the boards, branches, milestones and decision logs you write, plus any comment you post on a board and the display name shown beside it.
• Connected-tool credentials, only if you connect an external roadmap source (see Connected tools below). Depending on the tool, that's either an OAuth access and refresh token the provider hands us after you approve the connection, or a personal access token you create there and paste in yourself; where a tool is self-hosted or per-organisation we also store the instance URL you give us so we know which server to ask. Tokens are encrypted at rest with AES-256-GCM under a server-side key — never written in plaintext — and are used only to read the source you asked us to read.
• Imported roadmap content — when you import or sync from a connected tool, we store the items you selected as milestones: their titles, descriptions, target dates and a mapped status. Nothing else crosses over — no assignees, no comments, no attachments.
• Invitations — when you invite someone to a board, we store the email address you typed so the invite can be redeemed, together with who sent it. An unredeemed invite expires after 7 days.
• Milestone follow requests — if you ask to be told when a milestone on a public board ships or slips, we store the email address you give us and a record of the opt-in wording you agreed to. It's a double opt-in: the address is only used once you confirm it from the email we send, and every message carries a one-click unsubscribe.
• Board activity log — on Team boards we record who did what (the acting account's email address, the action, and the item affected) so an owner can audit changes to a shared roadmap.
• AI provider keys, only if you choose to use the AI milestone generator. Keys are encrypted at rest with AES-256-GCM using a server-side key; we use the key in memory to call the chosen provider, then discard it.
• Operational data — the URL you were on if you submit through the feedback widget, and IP-level metadata your browser sends with every HTTPS request.
• Satisfaction ratings — once you've been using Roadmark for a while we may ask, inside the app, how it's working out. We store the face you picked, anything you chose to write, and when we asked (so we don't ask again for months). Answering is optional and dismissing it costs you nothing. This is internal only: it's read by us to decide what to fix and build, and it is never published or shown to anyone else.
• Shared-board view analytics — when someone opens a public board link, we record a coarse, anonymous visit so the board's owner can see interest: a count, an approximate time-on-page, the referring website's domain, a device type (mobile/tablet/desktop), and a country (derived from your IP, which we do not store). To tell unique from returning visitors we keep a random, non-identifying id in your browser's local storage — it isn't a name, email, or anything tied to an account, and it's never shared with third parties. The board owner's own visits aren't counted. Set your browser's “Do Not Track” (or Global Privacy Control) and we record nothing.
• Error reports — when something throws server-side or client-side, the stack trace and the URL go to Sentry so we can fix it. No bodies, no form contents.
• Aggregate usage metrics — we use Vercel's cookieless Web Analytics to see coarse, anonymous traffic across the site (page views, referring domain, country, device type), and Vercel's cookieless Speed Insights to see how fast pages actually load for real visitors (Core Web Vitals timings, the route, device type, connection speed). Neither sets cookies, builds a cross-site profile, or is tied to your account.
• Billing data — if you buy a paid plan, the checkout runs entirely on our merchant of record, Lemon Squeezy. They collect your payment details, billing address, and tax location; we never see your card number. What we store is your plan, its renewal date, and an opaque subscription reference tied to your account.

• To provide the service — render your boards, sync edits, share public links.
• To send transactional emails — signup confirmation, password reset, "your email/password was changed" security notifications.
• To send the optional emails you choose to receive — the daily digest of comments on your boards, and a quarterly summary of what's new in Roadmark. Both are your choice (the quarterly one you can opt into when you sign up, or any time after), each is independent of the other, every one of them carries a one-click unsubscribe link, and you can turn either on or off whenever you like in your account settings.
• To debug and improve — error reports, feedback messages, satisfaction ratings.
• To let you know a plan you asked about has launched, if you put yourself on the notify-me list for it. That list is used for that one announcement and nothing else.

We do not sell your data and we don't use it to train any AI model.

We don't make any decision about you by automated means alone. Nothing on the service profiles you, scores you, or decides anything with a legal or similarly significant effect on you — the AI features generate content at your request, they don't make judgements about people.

Roadmark can build a board from a roadmap you already keep somewhere else. You can connect GitHub Projects, GitLab, Linear, Jira, Shortcut, YouTrack, Azure DevOps, Asana, Notion, or monday.com, or upload a CSV. Nothing is connected unless you connect it, and each connection is yours alone — it is never shared with other members of a board.

• It only ever reads. An import is one-way. We never write to, change, or delete anything in your source tool.
• We read only what we show you — the item titles, descriptions, target dates and statuses that become milestones. We don't collect assignees, comments, attachments, or anything about the people working in that tool.
• Sync is on your terms. A one-off import reads the source once. If you turn on Auto-sync, we re-read that same source once a day using your stored connection until you turn it off.
• You can disconnect at any time from the import dialog, which deletes the stored tokens. You can also revoke Roadmark's access from the provider's own settings, which stops it working immediately.
• Two ways to connect — neither of them is your password. Most providers use OAuth: we send you to their own sign-in page, you approve the access there, and they hand us a token. Shortcut, YouTrack, GitLab and Azure DevOps have no OAuth app for us to use, so instead you create a read-scoped personal access token inside that tool and paste it in. Either way we never see your password for that service, and that provider's own privacy policy governs what happens on its side.

Imported content is treated exactly like content you typed yourself: it belongs to your board, and it is deleted with the board or the account. If the roadmap you import happens to mention people by name, that text comes across as part of the item title or description, and you are responsible for having the right to bring it into Roadmark.

Most of what we hold you gave us yourself. Three things reach us another way, so to be explicit about them:

• If someone invited you to a board, we received your email address from the person who sent the invite, so we could deliver it. If you don't redeem it, the invite expires after 7 days.
• If your name appears in an imported roadmap, it reached us from the tool the board's owner connected, as part of an item's title or description. The owner of that board is the one who decided to import it.
• If someone mentioned you in a comment on a board you both belong to, that text came from them.

In each case, write to support@yourroadmark.com and we'll tell you what we hold and remove it if you ask.

The service runs on top of a few third parties. Each one only sees the data it needs:

• Supabase (Germany, EU) — database, authentication, file storage.
• Cloudflare R2 (EU, Western Europe) — encrypted off-site database backups.
• Vercel (US-headquartered, EU edge for European traffic) — hosting and CDN, plus Vercel Web Analytics: cookieless, aggregate page metrics (page views, referring domain, country, device type), and Vercel Speed Insights: cookieless, aggregate page-performance timings (Core Web Vitals, the route, device type, connection speed). No cookies, no cross-site tracking, nothing tied to your account.
• Resend (EU/US) — outbound transactional email.
• ImprovMX (Netherlands) — inbound email forwarding for support@yourroadmark.com.
• Sentry (Germany, EU) — error monitoring.
• Upstash Redis (Germany, EU) — short-lived rate-limit counters.
• Lemon Squeezy, LLC (US) — merchant of record for paid plans: checkout, payment processing, invoices, and sales tax/VAT. Sees your payment details and billing address; their own privacy policy applies to the transaction.
• Anthropic (US) — the AI provider behind Managed AI, the generation quota included with paid plans. When you use a managed AI feature, we send your prompt and the board context you're generating against to Anthropic on our own account to produce the result. Anthropic's privacy policy applies to that traffic, and under its commercial API terms your inputs are not used to train its models.
• Anthropic, OpenAI, or Google AI (bring-your-own-key) — additionally, if you connect your own API key, we forward your prompt and board context to whichever provider that key belongs to, under your account; that provider's own privacy policy applies to the traffic.

The connected tools above are deliberately not in this list: they aren't processing anything on our behalf. They're your own accounts, which you authorise us to read from — we send them nothing but the read request.

We use cookies only for things the service can't work without:

• Auth session — Supabase sets HttpOnly cookies that keep you signed in.
• PKCE verifier — short-lived, set during password reset / email change to prove the same browser started the flow that ended it.
• pending_email_change_from — short-lived HttpOnly cookie that remembers your previous email so we can send the security notification to the right address after a successful email change.

We also keep a few small first-party items in your browser's local storage on public board pages: a random, non-identifying visitor id (to tell unique from returning visitors for the board owner's view analytics, above), which milestones you reacted to or asked to follow, and your cookie-notice and opt-out choices. They all hold no personal data and are never sent to a third party. View tracking is suppressed entirely if your browser signals “Do Not Track” or Global Privacy Control, or if you choose Decline on the cookie notice shown on public board pages.

Beyond that we don't use advertising cookies, tracking pixels, or cross-site trackers; our only site-wide analytics is Vercel's cookieless Web Analytics and Speed Insights (no cookies, no cross-site profile — see above). For the itemised list of every cookie and storage key, see the Cookie Policy.

If you're in the UK, the EU/EEA, or another GDPR-aligned jurisdiction, the lawful bases under Article 6 we rely on are:

• Contract (Article 6(1)(b)) — for everything we need to do to provide the service to you: storing your account, serving your boards, sending transactional emails like password reset and security notifications.
• Legitimate interests (Article 6(1)(f)) — for limited operational uses: error monitoring, debugging via the feedback widget, understanding how satisfied users are with the product, abuse prevention via rate limits, the activity log that lets a board owner audit changes to shared work, and delivering an invitation to the address a user asked us to send it to. You can object at any time by writing to support; we'll weigh your objection against the legitimate interest.
• Consent (Article 6(1)(a)) — for anything optional you switch on yourself: the quarterly “what's new in Roadmark” email (off unless you turn it on), and asking to be notified about a milestone on a public board (confirmed by double opt-in). You can withdraw consent at any time — from the unsubscribe link in the email or your account settings — with no effect on prior processing.
• Legal obligation (Article 6(1)(c)) — if we're ever compelled to retain or disclose data by valid legal process.

Where you connect an external tool, you are instructing us to read a source you control, and you remain responsible for having the right to bring its contents into Roadmark.

Do you have to give us any of this? Only an email address, and only because the account can't exist without one — it's how you sign in, reset a password, and receive security notices. That's a requirement of our contract with you, not a statutory one, and without it we can't provide the service. Everything else on this page is either produced by using the service or entirely optional.

Some of our sub-processors are headquartered in the US (Vercel, Lemon Squeezy, Anthropic, OpenAI, Google) even though we've picked EU regions where available. When your data is transferred outside the EEA or the UK, we rely on Standard Contractual Clauses (SCCs) / the UK Addendum and the providers' own GDPR programmes. You can ask for copies of the relevant safeguards at support.

A tool you connect yourself is a separate matter: wherever that provider runs is a choice you already made when you opened an account with them, and reading from it on your instruction doesn't change where their copy lives.

• Account and content — kept as long as your account exists. When you delete your account (self-serve from Account → Delete account), it's removed from the live service immediately; residual copies in routine backups age out on the cycles below.
• Connected-tool tokens — until you disconnect that tool, or delete your account. Disconnecting deletes them straight away.
• Unredeemed invitations — 7 days, then the invite stops working. A board's owner can revoke one sooner.
• Milestone follow requests — until you unsubscribe (one click, in every message) or the board or milestone is deleted, whichever comes first.
• Board activity log and shared-link view counts — for the life of the board they belong to. Both are there to give a board's owner a history, so they aren't trimmed on a timer; deleting the board deletes them.
• Satisfaction ratings — kept for the life of the account and deleted with it; nothing trims them on a timer, because their whole value is seeing whether opinion moves over time. Alongside them we keep a note of when we last asked you, which is what stops the prompt reappearing.
• Consent records — which version of these documents you accepted, and when. Kept for the life of the account, since it's the record that we asked you properly.
• Error events in Sentry — 90 days (their default).
• Supabase backups — our current plan keeps no platform-level backup copies, so nothing is retained there. Any backup copy of your data is one we hold ourselves, off-site (below).
• Off-site backups (Cloudflare R2) — database snapshots we take ourselves, automatically deleted after 90 days.
• Rate-limit counters — minutes; they auto-expire.
• Billing records — invoices and transaction records are held by Lemon Squeezy as merchant of record for as long as tax and accounting law requires; our own copy of your plan state is deleted with your account.

Whether or not you live in the EU, you can ask us to:

• Show you what we have on you.
• Fix something that's wrong.
• Delete your account and everything tied to it — self-serve from Account → Delete account, effective immediately.
• Get a portable copy of your boards — use Account → Your data → Export my data to download everything as JSON, any time.
• Object to processing we base on legitimate interests, or ask us to restrict it while a dispute about it is sorted out.
• Opt out of any of the optional things above (e.g. stop sending feedback through the widget — just stop using it).

Account deletion and data export are both self-serve from your account settings — deletion is immediate and irreversible, and removes boards you solely own that have no other members. If you're the only owner of a board shared with others, we ask you to hand it off (promote another owner) or delete it first, so shared work isn't destroyed under its members. For corrections or any other request, write to support@yourroadmark.com and we'll get back to you within a few days.

If you're unhappy with how we've handled your data, you also have the right to lodge a complaint with a data-protection supervisory authority. We're established in the UK, so ours is the Information Commissioner's Office; if you're in the EU/EEA you can complain to your own national authority instead. We'd rather you write to us first so we can fix it directly, but the right is yours either way.

Roadmark isn't directed at children under 16. If you're under 16, please don't sign up. If you're a parent and find your child has an account, write to support and we'll remove it.

Cookies are HttpOnly + Secure in production. AI provider keys are encrypted at rest. Passwords are hashed by Supabase Auth (bcrypt). HTTPS is enforced everywhere by Vercel. Rate limits protect public endpoints from spam and brute force.

That said: we're a small, independent product, not a security-audited enterprise vendor. Don't put state secrets in your roadmap.

If we change something material — a new sub-processor, a different retention window — we'll bump the "Last updated" date at the top. This policy is one of the two documents you accept when you create an account, so a material change also means that the next time you use your account we'll show you a notice naming what changed and ask you to read and accept the updated version before you carry on. We record which versions you accepted, and when.

That in-app notice is how we tell you: we don't currently send a separate email announcing a policy change, so it's worth reading rather than clicking past. It appears once the new version is already in force, not in advance of it.