1. Who this policy covers
This policy applies to the Fernboard application, its public pages, account services and support interactions. In this policy, “Fernboard”, “we”, “us” and “our” refer to the team operating Fernboard in Australia.
Questions, access requests, correction requests, deletion requests or privacy complaints can be sent to betternote.management@gmail.com.
2. Information stored on your device
Fernboard saves work locally first so the canvas can remain available offline. Local information can include:
- boards, notes, task lists, timelines, drawings, comments, images and references;
- board members, activity history, appearance and device preferences;
- sync revisions, pending changes, recovery diagnostics and deleted items held in trash; and
- backup files you choose to export and store.
Local browser data and exported backups are not separately encrypted by Fernboard. They inherit the protections of your device, browser profile and chosen storage location. Anyone with access to those places may be able to read them.
3. Information processed when you use an account
If you create an account or sign in, we process your email address, display name, authentication status and an optional profile image. We also process workspace membership and the cloud content you choose to synchronise, such as boards, elements, comments, private image files, activity metadata and revision information.
We use this information to authenticate you, provide your workspace, synchronise authorised content, support collaboration, recover accounts, deliver security messages, prevent abuse and operate the service.
4. Google user data
If you choose Continue with Google, Fernboard requests only the OpenID, email and profile scopes. We receive your Google account identifier, email address, name, email-verification status and profile image where available.
We use that information only to create or secure your Fernboard account, show your identity to you, and identify you to people in Fernboard workspaces you join. We do not request or receive access to Gmail, Google Drive, Google Contacts, calendars or Google file content.
Google user data is not sold, used for advertising, or used to train general-purpose AI models. We share it only with service providers needed to operate authentication and cloud storage, or with workspace members where the product clearly shows that identity. Fernboard’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can stop future Google sign-in access through your Google Account connections page. This does not automatically delete your Fernboard account or information already stored in Fernboard; contact us to request that deletion.
5. Providers and disclosures
We disclose the minimum information needed to providers acting on our behalf:
- Supabase provides authentication, PostgreSQL workspace storage and private file storage. The production project is hosted in Sydney, Australia.
- Cloudflare and OpenAI Sites deliver the web application and may process ordinary request information such as IP address, user agent, timestamps and security signals.
- Google provides optional sign-in and currently delivers authentication email through the Fernboard business Gmail account.
- Stripe provides subscription checkout, billing management and payment status. Fernboard does not receive or store full payment-card details.
- PostHog receives optional, content-free product events when you enable usage analytics. These events use a one-way identifier and fixed properties such as app version, environment and chosen plan interval; they never include board or note content, titles, searches or clipboard data.
- Sentry receives optional device crash diagnostics when you enable them, and may receive content-free server failure reports needed to operate signed-in services. Reports are limited to error type, safe error code, application code location, app version, environment and the affected operation; request bodies, breadcrumbs, identity details and user-created content are excluded.
- Resend delivers account and subscription messages such as welcome, Premium activation and cancellation confirmations. It receives the destination email address and the fixed Fernboard message, but no board or note content.
Workspace content and identity are visible to other members according to their workspace role. We may also disclose information when required by law, to protect users or the service, or during a genuine business transfer with appropriate safeguards.
Optional analytics and crash diagnostics are off by default and can be changed independently in Settings → Privacy. Transactional account email is operational rather than marketing email.
6. Retention and deletion
Deleted local board items are normally kept in recoverable trash for 30 days and are then removed when the board is loaded. You can permanently delete them sooner. Exported backups remain wherever you saved them until you delete them.
Account and synchronised workspace information is retained while needed to provide the service, keep shared workspaces consistent, meet security obligations or resolve disputes. To request cloud account deletion, email us from the account address. We will verify the request and remove or de-identify information that we control, subject to necessary security, backup, legal and shared-workspace retention.
Deleting a cloud account does not silently erase unrelated local data on your device. You remain responsible for deleting local browser data and exported backup files when you want them removed.
7. Security and international processing
We use access controls, encrypted transport, private file storage, strict workspace-level database rules, rate limits and credential separation. No online service can promise absolute security, so you should keep your device and account secure and export important work.
Although the primary production database is in Australia, providers may process support, authentication, security or delivery information in other countries under their own infrastructure and contractual safeguards.
8. Your choices and rights
You can use core local editing without an account, independently enable or disable optional analytics and crash diagnostics, export a board backup, restore eligible deleted items, choose whether to sign in with Google, sign out while retaining local access, and ask us to access, correct or delete personal information we control.
If you make a privacy complaint, describe the issue and the outcome you seek. We will investigate and respond. Where Australian privacy law applies, you may also be able to complain to the Office of the Australian Information Commissioner.
9. Changes to this policy
We may update this policy as Fernboard changes. We will revise the effective date and give additional notice where a change materially affects how personal information is handled.