Last updated: August 11, 2026
When you sign in with Google or GitHub, we receive your name, email address, and profile picture from those providers. During a session, we store the content you write (cards, action items, scratchpad notes) and your participation data (which room you joined, votes cast). Guest users do not share any personal information unless they choose to enter a display name. If you turn on product analytics, we also collect usage events (see section 4a).
Your information is used solely to provide and improve the RetroSync service: authenticating your identity, displaying your name to teammates, saving your retrospective history, and - with your consent - measuring how the product is used so we can decide what to build and fix. We never sell your data, never use it for advertising, and never share it with data brokers.
All data is stored on secure cloud infrastructure hosted in the United States. Retrospective content associated with a room is retained in your archive after the session ends. You can request deletion of your data at any time by contacting us.
RetroSync uses browser localStorage (not cookies) to remember your language preference, theme choice, session state, your consent decision, and an analytics device identifier. No advertising or cross-site tracking cookies are used, and we do not participate in any ad network.
Product analytics is optional and off unless you turn it on. It has its own checkbox at sign-in, separate from the Terms and this Policy, and RetroSync works exactly the same either way. When it is on, we record usage events through Cohorly (Velloa Labs), our analytics processor: actions such as a room being created, a phase advancing, a card being written, or a retrospective finishing, together with your user identifier, the room identifier, browser, operating system, page address, and approximate location derived from your IP address. We never send what you write - card text, action item titles, retrospective titles, participant names, and email addresses never leave our own infrastructure. The icebreaker check-in is recorded only as "a check-in happened", never with your score, so it stays anonymous to us as well as to your team. Legal basis: consent (Art. 7, I LGPD). You can turn it off at any time on the "My Account" page; nothing is sent after you do.
RetroSync uses cloud infrastructure providers for hosting, storage, and authentication: Google LLC (USA), Vercel Inc. (USA), and, for product analytics, Velloa Labs / Cohorly (USA). When you sign in with Google or GitHub, their respective privacy policies also apply. We do not share your data with any other third parties. International data transfers to the USA are carried out under standard contractual clauses per Art. 33, II LGPD. RetroSync maintains Data Processing Agreements (DPAs) with Google LLC (https://cloud.google.com/terms/data-processing-addendum) and Vercel Inc. (https://vercel.com/legal/dpa), as required by Art. 39 LGPD; the agreement with Velloa Labs is being formalized.
Under Lei 13.709/2018 (LGPD), you may request access to, correction of, deletion of, portability of, or revocation of consent for your personal data at any time. The supervising authority is the Brazilian National Data Protection Authority (ANPD). To exercise these rights, contact us using the email below. We will respond within 30 days. Deleting your account erases your data from RetroSync automatically; product usage events held by our analytics processor are erased by request to the Data Protection Officer, within the same 30-day window.
If you have any questions or requests regarding this Privacy Policy, please reach out to us at: hello@retrosync.app
We process your data under the following legal bases: Authentication (name, email, photo): performance of a contract - Art. 7, V LGPD; Session content (cards, votes, notes): performance of a contract - Art. 7, V LGPD; Preferences (language, theme): legitimate interest - Art. 7, IX LGPD; Product usage events: consent - Art. 7, I LGPD.
Personal data is retained while your account is active. After 12 months of inactivity, data may be anonymized or deleted. Product usage events are retained for up to 24 months and are deleted from the analytics processor on request. For data retention inquiries, please contact our Data Protection Officer at: dpo@retrosync.app
Our Data Protection Officer, pursuant to Art. 41 LGPD, can be reached at: dpo@retrosync.app
RetroSync is not directed to users under the age of 18. We do not knowingly collect personal data from minors. If we become aware that personal data from a minor has been inadvertently collected, it will be promptly deleted in accordance with Art. 14 LGPD.