Privacy and data details

Ordinary boards and local backups

The ordinary board library is stored in browser IndexedDB and is not automatically uploaded to our servers. If IndexedDB is unavailable, the app falls back to a smaller browser-local compatibility store.

Browser data can be lost when site data is cleared, private browsing ends, device policy intervenes, or storage is reclaimed. Export a full-library backup for important work. The app warns when durable storage is unavailable or estimated usage approaches the browser quota.

Fixed snapshot links

Fixed sharing puts a compressed read-only board copy in the URL fragment. A fragment is not sent with ordinary HTTP requests, but anyone holding the complete link can read its snapshot.

A snapshot does not synchronize later changes. Content enters a recipient's local library only after that person explicitly saves a copy.

Temporary anonymous collaboration

A temporary room retains only its latest validated board state, revision, access and expiry metadata, plus hashed host and editor capabilities. Host authority and bounded unacknowledged mutations stay only in the creating tab session for safe reload recovery.

The viewer link has no editing capability. The editor capability appears only in the complete editor link fragment. Anyone holding or forwarding that link can edit while the host permits it, so share it only with intended participants.

Presence and cursors are relayed transiently and are not stored. The room clears its latest state and capability hashes when the host stops it or after 24 hours without an accepted content change. It keeps no permanent version history.

Anonymous product measurement and feedback

Cloudflare receives anonymous page measurements and allowlisted feature events. Feature events contain language, bounded categories, and a random browser UUID, but no account identity, room identity, participant data, board content, or board names.

The UUID identifies a browser profile rather than a person, account, room, or participant. Clear site data to reset it. Anonymous feedback sends its selected type, text, language, page category, and app version only when you submit it.

Link and browser security boundary

The site uses a no-referrer policy, so ordinary navigation and subresource requests do not carry the current page URL as a Referrer. Snapshot and editor capabilities remain in fragments and are excluded from canonical metadata, the sitemap, and application analytics.

Do not expose complete sharing links in untrusted chats, tickets, recordings, or screenshots. Deleting a local board does not revoke a fixed snapshot already sent. A temporary room must be stopped by its host or allowed to expire.