Privacy Policy

Daily Standup (“the service”, “we”) is an invite-only standup board for teams, served at dailystandup.online. This policy explains what we collect, why, and the choices you have. Questions go to support@dailystandup.online.

• Account details: your email address, display name and, if you set one, a password (stored only as a salted hash). If you sign in with Google, we also keep the stable Google account ID that identifies you to us.
• What you write: standup updates, blockers, comments, reactions, mentions, notes, absences and holidays, plus the team and role you belong to.
• Integration settings your admin adds: Jira site and API token, chat webhook URLs, linked Google Sheets, a Sentry connection (with a cached copy of the issues it highlights) and a Reviewer Picker token (with a cached copy of its reviewer data). Tokens and webhook URLs are encrypted at rest. The one exception is the secret in a chat bot's inbound URL, which is stored as is because it is looked up on every incoming event.
• Account links: if you link GitHub, your GitHub login, and a mapping from your Jira account ID to your member profile, so mentions and reviews reach the right person.
• Network addresses: your IP address is part of the short-lived keys we use to rate-limit sign-in and invite lookups. Those keys are removed once their window (up to an hour) has passed.
• Session data: a cookie that keeps you signed in (we store only a hash of it) and when each session started and expires.
• Presence: when you last opened the board, shown to your teammates.

The service uses Google in two optional places:

• Sign in with Google requests the openid, email and profile scopes. We read your email address to match you to your existing account, and your name to fill in a display name for a new one. Nothing else is read from your Google account.
• Google Sheets export, which a team admin can connect, requests the drive.file scope. That grants access only to the spreadsheets this service creates, not to anything else in your Drive. We use it solely to create and update your team's standup spreadsheet. The refresh token is encrypted at rest, and disconnecting in Settings revokes it at Google and deletes it from our database.

Google user data is never sold, never used for advertising, never used to train AI or machine-learning models, and never shared with anyone except as needed to provide these features, to comply with the law, or to protect the service's security.

Daily Standup's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Only to run the service: showing your team's board, sending password-reset email, posting digests to the chat spaces your admin connected, looking up the Jira issues you reference, and exporting to the spreadsheet your admin chose. We do not run analytics, advertising or third-party tracking, and we do not sell data.

Your teammates see what you post to your team. Beyond that, data only reaches these processors, each for the purpose named:

• Cloudflare hosts the service, its database and outgoing email.
• Google, Atlassian (Jira), GitHub, Sentry, Reviewer Picker and chat providers receive what an integration sends them, and send back what it asks for, only when your team (or you, for GitHub) connects that integration.
• Fackbeed (fackbeed.online) is where “Send feedback” takes you. Daily hands it your account ID, name and email, the app version and the page you were on, so the form knows who is writing. What you send there is kept by Fackbeed, not by Daily.

We keep your data while your account or team exists. You can sign out your other devices from your profile, and a team admin can disconnect any integration at any time, which deletes its stored credentials.

You can delete your account yourself from your profile, which deletes everything you posted on every team, or leave a single team, which deletes what you posted on that team. A team admin can delete the whole team from Team settings, which deletes everything in it; members keep their accounts. For anything else, email support@dailystandup.online; we act on requests within 30 days.

Some data is removed automatically, every night:

• Expired sign-in sessions are deleted.
• Password-reset links are deleted 7 days after they expire or are used.
• Revoked, expired and used-up invites are deleted after 30 days.
• Notifications (including the short excerpts they quote) are deleted after 30 days.
• Ended live meetings are deleted after 7 days.

All traffic is served over HTTPS, passwords are hashed, integration secrets are encrypted at rest, and cross-site requests are rejected. No system is perfectly secure, but we will tell affected users promptly if a breach touches their data.

If this policy changes, we update the date above. Material changes are announced in the app before they take effect.