Effective 30 September 2026
rtro is built to know as little about you as possible. There is no advertising and no tracking across sites, and the only analytics is a cookieless, anonymous page-view counter on this marketing site — the app has none at all. This page lists everything the service collects, why, how long it is kept, and how to have it removed. A shorter plain-language summary exists too. The data controller is Specter Systems Corp, a California corporation, reachable at [email protected].
No account, no email, no name required. The service stores:
Which participant wrote which card is recorded so the board works — your own cards have to follow you — but it is never shown to anyone. The server never sends another participant's authorship to anybody, in any phase of the retro, including the facilitator.
Payments are handled by Stripe. Your card number never touches our servers; we store only Stripe's identifiers for the team's customer record and subscription.
Like nearly every web service, our servers write request logs that include IP addresses, and the API briefly holds IP addresses in memory to rate-limit board creation. Logs are used for security and debugging only, are not joined to board content, and are kept only as part of normal server operation, not indefinitely.
rtro sets only first-party cookies that make the product work. There are no analytics or advertising cookies, so there is no cookie banner.
| Cookie | Purpose | Lifetime |
|---|---|---|
rtro_p_<board> | Identifies you as a participant on one specific board, so your hidden cards and votes follow you. One per board you join. | 1 year |
rtro_s | Keeps you signed in to a team account. | 30 days, extended while you keep using it |
We do not sell personal data, share it with advertisers, or use it to train machine-learning models.
Where the GDPR or similar laws apply: we process board content, account and billing data because it is necessary to provide the service you asked for (contract). We process server logs and rate-limiting data in our legitimate interest of keeping the service secure and available, and anonymous marketing-site page views in our legitimate interest of understanding aggregate visits. We do not build profiles or process personal data for marketing.
Data is processed in the United States, and may be processed in other countries where our infrastructure providers operate. Where the GDPR applies to a transfer, we rely on the safeguards our providers offer, such as standard contractual clauses.
Depending on where you live, you may have rights to access, correct, export, or delete your personal data, to object to or restrict processing, and to complain to a supervisory authority. To exercise any of them, email [email protected] and we will respond within 30 days. Two honest caveats: instant boards are usually deleted on their own before any request could be processed, and data from an anonymous instant board generally cannot be linked to you afterwards, which means it can be gone but not retrieved.
rtro is not directed at children and must not be used by anyone under 16. We do not knowingly collect data from children; if you believe a child has used the service, email us and we will delete the data.
If this policy changes, the effective date above changes with it, and material changes will be announced to account holders by email. Continued use after a change means the new policy applies.
Specter Systems Corp · [email protected]. See also the terms of service.