Mobile app privacy policy

Scope

This policy covers the Borago Board mobile app for Android and iOS. The app is a thin client for the hosted service at board.boragosoft.com: it stores no board database on your device and does not run AI agents. Most personal data is processed by the hosted service under the service's privacy policy, which is shown at sign-up and available in the app; this policy incorporates it. The website you are reading now has its own separate notice.

Data processed via the app

• Account data: the email and password you use to sign in (transmitted to the service; the password is handled only as a scrypt hash server-side). An authentication token is stored on your device to keep you signed in.
• Content data: projects, tasks (including text or output that may contain code snippets), comments you view or edit, and, on the Pro tier, attachment metadata and files, all synced through the hosted service.
• Technical and security data: IP address and request metadata, used by the service for authentication rate-limiting and abuse prevention.
• Device permissions (only if you use the feature): files/photos for attachments; notifications. The app does not collect location or contacts.

On-device storage and secrets

The app stores your session token and app preferences locally. It does not store your board data or secrets on the device. Secrets saved on your projects (AI API tokens, Git credentials, environment variables) are held by the cloud service as ciphertext only, under a key Borago Soft cannot unwrap, so they are viewable only in the desktop app. If you set a credential from the mobile app, the value is forwarded through the service to your own desktop app, which encrypts and stores it; the service does not keep it, though it does pass through the service in readable form for the moment the forwarding takes.

What the app does not do

The app does not run AI agents and does not send your data to any AI provider (Anthropic, OpenAI, xAI, Google); any AI activity you observe happens on your own desktop, under your own API key. The app contains no third-party advertising SDKs and, by default, no analytics or tracking. If analytics are ever added, this policy and the store listings will be updated first.

How data is used, shared and retained

Purposes, legal bases, sub-processors (hosting, storage, email, payments), sharing, retention, international transfers, and security measures are as described in the hosted service's privacy policy, shown at sign-up and available in the app.

Your rights and account deletion

You can delete your account from within the app (Profile section) or by signing in at board.boragosoft.com and deleting it from your Profile. Deletion removes your account and content per the service's privacy policy. You also have rights to access, correct, and export your data, to object to processing, and to complain to a supervisory authority. Requests: contact Borago Soft.

Children

The service is for adults. It is not directed to anyone under 18, account creation requires confirming you are 18 or older, and we do not knowingly collect data from anyone under 18.

Store disclosures and changes

We separately declare data handling in the Apple App Store "App Privacy" section and the Google Play "Data Safety" form, and keep those declarations consistent with this policy. Updates are posted with a new effective date; material changes are notified in-app or by email.

Contact

Borago Soft Limited, a New Zealand limited company (NZ company number 9428048, NZBN 9429053662910), 7a Garner Place, Glenfield, Auckland 0629, New Zealand. Contact form.