Privacy Policy

Last updated: 14 July 2026

Short version: we collect only what's needed to run Galatadeck for your team. We use a single essential cookie to keep you signed in — no advertising, no tracking, and we don't sell your data. You can export or delete your data at any time.

Who we are

Galatadeck ("we," "us") provides a collaborative team workspace at galatadeck.com. This policy explains what personal data we process and why. For any privacy question, contact privacy@galatadeck.com.

What we collect

Data	Why
Your name and email address	To create your account, sign you in, and send account emails (verification, password reset).
Password (stored only as a salted scrypt hash — never in plain text)	To authenticate you securely.
Content you create (tasks, notes, board cards, chat messages, projects)	To provide the Service and share it with your team.
Basic technical data (e.g. IP address for rate-limiting, session token)	Security, abuse prevention, and keeping you signed in.
Language and notification preferences	To show the app in your language and send the digests you opt into.

Cookies

We use one strictly-necessary cookie — a session cookie that keeps you signed in. It is HttpOnly, SameSite=Lax, and Secure in production. We do not use advertising cookies, analytics cookies, or third-party trackers, so no consent banner is required for personalized tracking. We also use your browser's local storage to remember small preferences (like your chosen language and whether you dismissed the cookie notice).

How we use your data

To provide, maintain, and secure the Service.
To send transactional emails (email verification, password reset) and — only if you opt in — activity digests.
To prevent abuse (rate limiting) and troubleshoot problems.

We do not sell your personal data, and we don't use it for advertising.

Service providers

We share the minimum data needed with a few providers who help run the Service:

Hosting (e.g. our cloud host) — stores the application and database.
Email delivery (Resend) — delivers verification, reset, and digest emails.

These providers process data on our behalf and are not permitted to use it for their own purposes.

Data retention

We keep your data while your account is active. When you delete your account, your personal information (name, email, credentials) is erased. Content you contributed to a team may remain visible to that team, shown under an anonymized label ("Deleted user"), so the team's shared history stays intact.

Your rights

Access & portability — a team leader can export the workspace data to Excel from the app.
Correction — update your name and email in account settings.
Deletion — delete your account at any time from account settings.
Depending on where you live (e.g. the EU/UK under GDPR), you may have additional rights; contact us to exercise them.

Security

Passwords are hashed with scrypt, traffic is served over HTTPS with HSTS, sessions use secure HttpOnly cookies, and we apply a content security policy and rate limiting. No system is perfectly secure, but we take reasonable measures to protect your data.

Children

Galatadeck isn't directed to children under 16, and we don't knowingly collect their personal data.

Changes

We may update this policy. If we make material changes, we'll take reasonable steps to notify you and update the "Last updated" date above.

Contact

Questions or requests? Email privacy@galatadeck.com.