Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account information. The email address you sign up with, and, if you set one, a password (stored in hashed form by our authentication provider, Supabase, so we never see or store your password in plain text).
• Workspace and content data. The issues, initiatives, roadmap items, board data, comments, and other content you or your teammates create in the Service, along with workspace membership and invite records (who invited whom, and to which workspace).
• Error and crash data. When something goes wrong in the Service, we use Sentry to capture technical details about the error, things like a stack trace, the page or action that triggered it, and browser/device information, so we can find and fix bugs. This is limited to error and crash diagnostics; it is not general behavioral tracking.

We do not use Google Analytics, Mixpanel, PostHog, advertising pixels, or any other third-party analytics or ad-tracking tool. We are not collecting a behavioral profile of how you use the Service beyond what Sentry captures when something breaks.

2. How We Use Your Information

• To create and secure your account, and to authenticate you when you sign in;
• To operate the Service: storing and displaying your workspace’s roadmap and board data, and syncing it across your team;
• To send transactional email, such as magic-link sign-in emails and team invite emails, through our email provider, Resend;
• To find, diagnose, and fix bugs and errors, using Sentry;
• To respond when you contact us for support; and
• To meet legal obligations, and to protect the security and integrity of the Service.

We do not sell your personal information, and we do not use it for third-party advertising.

3. Who We Share Information With

We share information only with the service providers (“sub-processors”) that host and run the Service on our behalf, and only to the extent needed for them to provide that infrastructure:

• Supabase: our database and authentication provider. Your account credentials and all workspace/content data described above are stored in Supabase’s Postgres database.
• Vercel: hosts the Lane Sherpa application itself.
• Resend: sends transactional email on our behalf (sign-in and invite emails), from hello@lanesherpa.com.
• Sentry: receives error and crash diagnostic data as described above.

We do not sell your data to anyone, and we do not share it with data brokers or advertisers. We may disclose information if required to by law, subpoena, or valid legal process, or to protect the rights, property, or safety of Barael LLC, our users, or the public. If Barael LLC is ever involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy or a successor policy you’re notified of.

4. Data Storage and Security

Your data is stored on infrastructure operated by Supabase (database and authentication) and Vercel (application hosting), both of which maintain their own security programs. We use reasonable technical and organizational measures to protect your information, including access controls that scope what a given account or workspace can see. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

If we become aware of a security incident that compromises your personal information, we will notify affected users without undue delay, consistent with applicable law.

5. Data Retention

We keep your account and workspace data for as long as your account or workspace is active, so the Service keeps working the way you’d expect.

If you delete your account, or a workspace owner deletes a workspace, we will delete the associated content data within 30 days of that request, other than in backups, which are purged on a rolling cycle and fully cleared within 90 days. We may retain limited information longer where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements.

Error and crash diagnostic data held by Sentry is retained according to Sentry’s own retention settings on our account, which is typically no more than 90 days.

6. Cookies and Local Storage

The Service uses cookies and browser local storage for one purpose: keeping you signed in. These are set by our authentication provider, Supabase, to maintain your session. We do not use cookies for advertising, cross-site tracking, or behavioral profiling, and we do not run any third-party ad or marketing pixels.

7. Your Privacy Choices and Rights

Regardless of where you’re located, you can ask us to:

• Access or get a copy of the personal information we hold about you;
• Correct inaccurate information;
• Delete your account and associated personal information, subject to the retention terms above; and
• Export your workspace’s content data.

To make any of these requests, email hello@barael.com. We will respond within a reasonable time, and in any event within the timeframe required by applicable law.

If you are a California resident, some of these rights track the California Consumer Privacy Act (CCPA). We are a very small company and may not meet the CCPA’s applicability thresholds, but we extend these access, correction, deletion, and portability rights to you as a matter of practice regardless. We do not sell or “share” (as CCPA defines that term) your personal information, so there is nothing to opt out of on that front.

If you are located in the European Economic Area or United Kingdom, you may also have rights under the GDPR, including rights to restrict or object to certain processing. Your data is processed in the United States by the providers listed in Who We Share Information With above; by using the Service you understand your information will be transferred to and processed in the U.S. Contact hello@barael.com with any GDPR request and we will do our best to honor it promptly.

8. Children's Privacy

The Service is a workplace tool and is not directed at, or intended for use by, anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at hello@barael.com and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email or through an in-app notice before the change takes effect. The “Last updated” date at the top of this page reflects the most recent version.

10. Contact

Questions about this Policy, or requests about your data, can be sent to hello@barael.com.

Barael LLC, 20289 Stevens Creek Blvd #1088, Cupertino, CA 95014.