A retro only works when people write what they actually think, so the product is built to know as little as possible. This is the short version; the privacy policy and terms of service are the binding ones.
There is no ad pixel and no tracking cookie anywhere on rtro. This marketing site counts page views with cookieless, anonymous analytics and loads its fonts from Google; the app itself — where your boards live — makes no third-party requests at all.
No email, no name, no sign-up. Create a board, share the link, run the retro. A display name is optional, and currently nobody else even sees it.
An instant board is permanently deleted 24 hours after the last change to it. Deleted means deleted: the rows are removed from the database, not archived. Copy the outcome as Markdown before the board goes.
The server keeps authorship only so your own cards follow you. It never sends another participant’s name or authorship to anyone — not to teammates, not to the facilitator, in any phase.
Before the reveal, card text is never sent to anyone except its author. This is enforced in one place on the server and covered by a contract test.
Joining a board sets one cookie holding a random token so the board recognizes you. Team sign-in adds one session cookie. Both are first-party; neither follows you around the web.
Team accounts sign in by emailed link, so we store that address. Used and expired sign-in links are purged nightly. Instant boards involve no email at all.
The paid plan is billed through Stripe. Your card number never reaches our servers.
Email [email protected] to ask anything or to have your data deleted. We answer within 30 days, usually much faster.