KanbanCord

Privacy Policy

Last updated 12 November 2026

This policy explains what personal data KanbanCord (the website at https://kanbancord.com and the KanbanCord Discord bot) collects, why, and what you can do about it. KanbanCord is a personal, non-commercial project run by Ryuji Ly, based in Belgium, who is responsible for your data (the "controller"). Questions or requests: [email protected].

What we collect

When you sign in with Discord

  • Your Discord account's id, username, display name and avatar (Discord's identify permission).
  • The list of Discord servers you are in, to show which of them you can manage (Discord's guildspermission). We keep the Discord access token needed for this, encrypted, and delete it and revoke it at Discord when you sign out of your last session.
  • Your sign-in sessions: when they started and were last used, and a short description of the browser and device (for example "Chrome on Windows"), so you can see and end them under Settings.

When a server adds the bot

To know who may do what on a server's boards, the bot copies the server's name and icon, its roles and their Discord permissions, and its text channels. Of its members, we keep only the people who use KanbanCord on that server, or whom someone picks for something there (assigns a task to, or names in a permission rule): their Discord id, username, display name, avatar, server nickname, roles and when they joined. Other members are not stored; they are looked up in Discord when needed, such as when someone searches for a person to assign. What we keep is kept up to date as the server changes.

What you create

  • Boards, columns, tasks, comments, labels, priorities, assignments, due dates and permission settings.
  • An audit log of changes: who changed what and when, with the values before and after. Server administrators can read it, and can have the bot post it in a Discord channel.
  • Your preferences (theme, accessibility, simple view) and notification settings.
  • Your time zone, such as Europe/Berlin: taken from your device when you use the website, or chosen with /notifications in Discord, so times you type in Discord are read in your own time.
  • Images and videos you upload to a task. These are stored on Imgur, not by us, and are viewable by anyone who has the link. We keep a record of each upload so it can be removed.
  • Reports and suggestions sent with /report: they reach the operator by Discord direct message, with your Discord username and id and the server you sent it from.

Technical data

Like any website, requests carry your IP address. We use it briefly, in memory, to limit how many requests one connection can make, and our network provider and web server may record it in short-lived logs to keep the service secure. We do not use analytics or advertising, and we do not track you across sites.

Why we use it

  • To provide KanbanCord to you and your servers: showing boards, checking permissions, syncing members and roles, and sending the notifications you and your server chose. This is necessary to provide the service you asked for (GDPR Article 6(1)(b)).
  • To keep it secure and working: sessions, rate limits, logs and the audit log. This is our legitimate interest in running a safe, reliable service (Article 6(1)(f)).
  • Server member data, for members someone picked who have not used KanbanCord themselves: so a server's assignments and permission rules work for them. This is the legitimate interest of the server that added the bot, and ours in providing it (Article 6(1)(f)). You can object: see "Your rights" below.
  • To understand and improve KanbanCord: the operator may look at how boards are used, including what they contain, to learn what people use KanbanCord for and to make it better for them. What is seen is never shared, published, sold or used for anything else. This is our legitimate interest in improving the service (Article 6(1)(f)).

We never sell your data, use it for advertising, or share it beyond what is described here.

Who else handles it

  • Discord, which you sign in with and where the bot runs. Their privacy policy applies to your use of Discord.
  • Imgur, which stores uploaded images and videos (privacy policy).
  • Cloudflare, which carries traffic to the website and forwards email to us (privacy policy).
  • Ko-fi and PayPal, only if you choose to donate. They handle the payment and share your name, any message you leave, and the amount with us; we never see your payment details, and we do not link donations to your Discord account (Ko-fi, PayPal). We keep donation records as long as tax rules require.
  • Oracle Cloud, where KanbanCord's servers and database run (privacy policy).

Some of these companies are based in, or process data in, the United States. Where data leaves the European Economic Area, they rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

  • Sessions end 30 days after they were last used, or when you sign out, and are deleted 30 days after that.
  • Your stored Discord access token is deleted when your last session ends.
  • A server member's entry is removed when they leave the server, and within two days once nothing on the server needs it: they never used KanbanCord there, and nothing is assigned to them or names them.
  • Your Discord id, name and avatar are deleted within two days once you are in no server with the bot and have no website session, unless something you made or appear in (a task, comment, upload or audit log entry) still shows them.
  • Boards, tasks, comments and the audit log are kept while the server uses KanbanCord, since they are the server's work. A server's administrators decide what is deleted.
  • Notifications waiting to be sent are deleted within a week.
  • Everything else is kept for as long as you use KanbanCord, or until you ask us to delete it.

Your rights

You can ask for a copy of the personal data we hold about you, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Email [email protected] from, or mentioning, your Discord account, and we will answer within a month. Deleting your data removes your account information and settings; content you created on a server's boards is part of that server's work, so we remove your name from it instead where deleting it would harm others.

You can also complain to the data protection authority in the country where you live or work, or to the Belgian Data Protection Authority (dataprotectionauthority.be).

Cookies and browser storage

We use one cookie, which keeps you signed in; it is strictly necessary and only sent to KanbanCord. The website also keeps your theme and the server you last opened in your browser's storage, so they are there next time. There are no tracking cookies, so there is nothing to consent to.

Children

KanbanCord is for people old enough to use Discord in their country, and at least 13. See the Terms of Service.

Changes

If this policy changes, the new version appears here with a new date. For significant changes we will also say so on the website.