What this instance records, who else ever sees it, and what deleting your account actually removes.
Last updated 29 September 2026.
This is a single installation of Team Retrospective, run by the team that uses it. There is no plan, no trial and no billing, so there is nothing here that exists to profile you, price you or sell you on. Nothing on this page is a promise about any other installation of the same software.
Your name, your email address, your avatar, your display language and time zone, and the sign-in methods that open your account. A password is stored only as a hash, and a passkey never leaves your device - what we hold is a public key that can check a signature and produce nothing.
Your email address is also how the application reaches you: an invitation, a reminder before a retrospective, a confirmation when you change something that opens your account.
Cards, comments, actions and agreements are kept as you wrote them, next to the name you had when you wrote them. That name is a snapshot rather than a link, so it stays faithful through a rename or a departure - deleting your account is the one thing that rewrites it.
Who else reads it is decided by the team, not by us. A private team is readable by its members alone; a public one is readable by anybody signed in to this instance; a published summary is readable by anybody holding its link, which is why that link is treated as a secret throughout.
Three services, each doing one thing, none of them receiving anything you wrote.
Page views are counted by Pirsch Analytics, which is cookieless: it sets no cookie, writes nothing to your browser, and stores no identifier for you. A visitor is a hash salted per day and per site, so you cannot be followed from one day to the next or from this site to another. That is why this page carries no consent banner - there is nothing to consent to.
What it receives is the page address, where you arrived from and your screen size. It never reads the page, and it never learns who is signed in.
Seven pages load no analytics at all, because their address is itself a credential: a published summary, an account activation, a password reset, an email confirmation, and the OAuth consent screen. A test walks every route in the application and fails if a new one of that kind is ever added without being excluded.
When something breaks, the error is reported to Sentry so that somebody finds out before you have to say so. Request bodies are never sent, so no card, comment or invited address reaches it; the client address, the signed-in identity, headers and cookies are all switched off; and the single-use token in a reset or activation address is stripped before the report leaves.
Messages the application sends you are handed to an email delivery provider, which receives your address and the message itself and nothing else.
Everything else stays on this instance own server. Backups are encrypted before they are written to storage, so the storage provider holds ciphertext it cannot read.
One session cookie, which is what keeps you signed in, and one optional cookie if you ask to be remembered on a browser. Both are strictly necessary to the thing you asked for. There is no tracking cookie on this instance, from us or from anybody else.
Changes of access - a sign-in method linked, a token issued, a member removed, an administrator granted - are written to an audit log with the actor name, account identifier and address. It exists so that those changes can be answered for, which means it is the one record you cannot ask us to erase: a record its subject can delete is not a record.
What makes that proportionate is that it expires. Every entry is deleted twelve months after the fact it records, uniformly, by age, for everybody, without anybody having to ask.
Deleting your account removes what the account holds - your name, your address, your avatar, every sign-in method - and leaves what you wrote, with your name rewritten to one that points at nobody. A card keeps its text and loses its author.
That is deliberate rather than a limitation. Erasing a retrospective card would erase a conversation your teammates took part in, and what they wrote is theirs. Audit entries are the other exception, and they expire on the twelve-month clock above.
You can read and correct everything your account holds from your account settings, and delete the account from the same place. The same page gets you a copy of your account and of everything you wrote, to keep or to take elsewhere: a link to it is emailed to you and works for seven days. For a report of everything else this instance holds about you, such as the Audit log entries that name you, or for anything those pages do not cover, write to the operator of this instance.