Mewboard privacy policy

Operator: Wise Cat (wisecat.site) · Service: mewboard.com · Contact: allidevelop@gmail.com · Effective: 13 October 2026

What data we collect

Mewboard stores what people put into it and the minimum needed to run accounts:

• Account data: a display name, an email address, a role (administrator, member or viewer), a salted password hash (passwords are never stored in readable form) and, if you sign in with Google or Apple, the identifier of that sign-in.
• Content: projects, issues, milestones, comments, labels, due dates and uploaded files (images, documents, archives, media) that users or their connected applications create.
• Activity metadata: who created or changed a record and when; the last time an access token was used.
• Access tokens: personal and connector tokens are stored only as one-way hashes; the token itself is shown once to its owner.
• Technical logs: the web server keeps standard request logs (time, address, path, status) for operation and security.

When you connect Claude (or another application) through the connector, that application receives the tool results you ask for (for example the text of an issue and its attached files) and sends back the arguments of the actions it performs. Mewboard does not receive or store your conversations with Claude.

Sign in with Google or Apple

If you choose "Continue with Google" or "Continue with Apple", the provider tells Mewboard your email address, whether it is verified, your name (if you share it) and a stable identifier of your account at that provider. We use them only to find or create your Mewboard account and to link it to that sign-in, and store the identifier and email next to your account. We do not receive your provider password, and we do not read your contacts, calendar, files or other data at Google or Apple. Mewboard's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can stop using the sign-in at any time by using your password instead or by asking us to delete your account.

Workspaces and other people's data

Mewboard is multi-tenant: each organisation or person has a separate workspace, and its content is visible only to the people invited to it (and to the platform operator, who can see and, if needed for support or abuse handling, manage all workspaces). If you join a workspace that someone else created, that workspace's administrators decide who has access and what is kept; the data you put into it belongs to that workspace. Administrators are responsible for having the right to store the personal data of their team members and customers in the service. See the terms of service.

How we use and store it

• To provide the service: show your workspace, record changes under your name, authenticate you and show live updates to teammates.
• Where: the database runs on a virtual server hosted by Contabo (Germany). Uploaded files and database backups are stored in a private Cloudflare R2 bucket. All access is over HTTPS.
• We do not use your content for advertising or to train models.

Sharing with third parties

• Infrastructure providers that host the service (Contabo, Cloudflare) process the data on our behalf.
• An application you explicitly connect (for example Claude) can read and change the data your account can access, until you revoke it.
• We do not sell personal data and do not share it otherwise, except where required by law.

Retention and deletion

• Content stays until a user or administrator deletes it. Deleting an issue, comment or project also deletes its attached files.
• Daily database snapshots are kept for 60 days and continuous replication history for 14 days, after which they expire automatically.
• Connector connections expire after 60 days without use and can be revoked at any time under Account & tokens. Disabling or deleting an account removes its access immediately.
• To request access, correction or deletion of your personal data, write to allidevelop@gmail.com.

Security

Passwords are hashed with scrypt; sessions use signed, HttpOnly cookies; access tokens are hashed; uploaded files are served with restrictive headers; access is role-based. No system is perfectly secure; report problems to allidevelop@gmail.com.

Your rights

Workspace administrators can download a full export of their workspace and delete the whole workspace (with every person, project, task, comment and file in it) themselves under My account → Your data. For anything else, such as access to, correction or deletion of your personal data, or to withdraw consent, write to allidevelop@gmail.com. When an account or workspace is deleted, its content and files are erased from the live service immediately or within 14 days (trash period); copies in backups disappear when the backups expire (up to 60 days). You may also complain to your local data-protection authority.

Children

The service is not intended for people under 16, and we do not knowingly collect their data.

Changes

We will update this page when practices change and show the new effective date.