Privacy

Who is responsible

monoban is run by one person, Thiago M. Dolabella, who decides how your data is used (the “controller”, in the terms of Brazil’s LGPD). For anything about your data, write to hello@monoban.dev.

What we keep, and why

Your account

Your email address, a hash of your password if you set one, and the language you chose. If you use Google: your name, picture and Google ID as Google shares them. This signs you in and lets us email you about your account.Until you delete your account

Your work

Projects, columns, tasks, comments, notes, tags, links, a task’s history, linked repository names, and the records of agent runs. This is the product.Until you delete it or your account

CLI sessions and tokens

Hashes of the tokens (never the tokens), the device name, the last IP address and approximate location, and when they were used. You can see and end them in Settings.While they work, then 30 days after they end

Sign-in history

When you signed in or out, and changed or asked to reset your password, with the IP address. CLI sign-ins also keep the approximate location (city and country) and device. This protects your account, and it’s how we can email you about a new CLI sign-in.90 days

Abuse limits

Counters by IP address or account, so nobody can flood the service.Replaced each time the limit’s short window restarts

The waitlist

Your email address, the language of the page you joined from (your account and its first email use it), when you joined, and when you were let in.Until you ask us to remove it, or delete your account

Logs

What each request did: its route, status and timing, with your user ID but not your email. Also pages viewed, errors, and how sign-ins went. Never your tasks, passwords or tokens.7 days

Errors

What broke and where, in Sentry, with nothing that identifies you added on purpose.30 days

Page views

Which pages get visited, counted without cookies, through Vercel Analytics.As Vercel keeps them

We use this data for three reasons allowed by the LGPD: to provide the service you signed up for, to keep it secure and working (a legitimate interest), and to meet legal obligations. We don’t sell your data, we don’t show ads, and we don’t use your tasks to train anything.

In your browser

Signing in sets cookies that keep you signed in. They’re needed for the app to work, and we don’t use advertising or tracking cookies. Cloudflare’s bot check may set its own, for the same purpose. Two more remember your language and your time zone, so pages show in them. Your browser also keeps your preferences, and, so the app works offline, the boards you open and changes not yet sent. A board you haven’t opened for 7 days is dropped the next time the app opens here, and all of it goes when you sign out. Settings › This browser lists them and removes them.

Who else handles it

These services run parts of monoban, and each only gets what its job needs:

Supabase

The database and sign-in: your account, your work, sign-in records and the waitlist. Its servers are in the United States.

Vercel

Runs the website and the API, so it handles every request, including your IP address. Also page views.

Resend

Sends our emails, so it gets your address and the email’s content.

Cloudflare

The bot check on the sign-in forms (Turnstile). It sees your IP address and browser details.

Google

Only if you choose “continue with Google”.

Sentry

Error reports.

moblog

Logs.

If you run an agent on a task, it runs on your own computer with your own accounts (Claude, Codex or another). What you send it goes under that tool’s terms, not through us.

We’d also share data if the law requires it. We tell you unless the law forbids that.

Data outside your country

Your data is stored in the United States, and some of these services may handle it elsewhere. If you’re in Brazil, using monoban means your data goes abroad to make the service work, and the LGPD still protects it.

Your rights

You can ask us to confirm what we hold about you, give you a copy, correct it, delete it, and tell you who it’s shared with. You can also withdraw any consent you gave. If you’re in Brazil you can complain to the ANPD, the national data protection authority. Some US states give similar rights.

To use any of these, write to hello@monoban.dev from your account’s address.

To delete your account, use Settings › Delete account. Your account and everything in it are removed right away, and we send one last email to confirm it. Logs and error reports age out on the schedule above. What another browser keeps for offline use is deleted the next time it opens monoban online. We can’t reach it before that, so one that never does keeps it until you clear its data.

Security

Every read and write runs as you under the database’s row-level security, so your projects are yours alone. CLI sessions and personal access tokens are stored as hashes, and connections are encrypted. If a breach puts you at risk, we’ll tell you and the authorities the law requires.

Age

monoban is for people aged 16 or over. If you learn that someone younger has an account, write to us and we’ll delete it.

Changes

If this page changes in a way that matters, we’ll email you before it takes effect. The date at the top says when it last changed.