Privacy Policy
Your data is yours. santi exists to track your team's work, not to learn about you. This page says, in plain words, what this server keeps, why, for how long, who else touches it, and how to use your rights.
This text is written in plain language and is not legal advice; review by counsel is recommended.
The short version
- We never sell or rent your personal data, and we share it only with the providers that run the service (listed below).
- No ads, no tracking, no analytics and no third-party scripts. Pages load only files from this server.
- Cookies and browser storage are only the ones the app needs to work (listed below).
- You can download your data or delete your account at any time, from the account page.
Who is responsible
This instance of santi is run by Emerson Silva, the controller of the personal data it holds (the controlador under Brazil's LGPD). The person in charge of data protection (the encarregado) answers at ti.emerson.silva@gmail.com.
What we store, why, on what legal basis, and for how long
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Account: name, email, password hash (Argon2id; the password itself is never stored) | Sign you in; show teammates who did what | Contract (LGPD art. 7, V; GDPR art. 6(1)(b)) | Until you delete the account |
| Your work: projects, boards, sprints, issues, comments, labels and imported issues (the uploaded file is read and discarded) | The service itself | Contract | Until you or a project admin delete it; see account deletion below |
| Your home (“For you”): the issues and projects you star, the last time you opened each issue and visited each project in the browser, and the last time you worked on each issue (created, edited, moved or commented on it) | Show your recent and starred work first on your home page | Stars and work: contract. Opened issues and visited projects: legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)) | Until you leave the project (or are removed from it) or delete the account |
| Sessions and API tokens, stored only as SHA-256 hashes | Keep you signed in; let you revoke access | Contract; security (legitimate interest, LGPD art. 7, IX; GDPR art. 6(1)(f)) | Sessions: 30 days, then purged within an hour. Tokens: until revoked or the account is deleted |
| Invites to a project | Let teammates join | Contract | Until used or expired, plus 7 days |
| Acceptance record: which version of these terms and this policy you accepted, a fingerprint (hash) of the text, the date, and your 18+ declaration | Prove what you agreed to and when | Legal obligation and defence of rights (LGPD art. 7, II and VI; GDPR art. 6(1)(c) and (f)) | Kept after account deletion, tied only to the de-identified account, for 5 years (the limitation period of the Brazilian Consumer Defense Code, art. 27) |
| Access records: network address, date and time of requests, kept by the hosting platform | Required of application providers by the Marco Civil da Internet (art. 15); security | Legal obligation (LGPD art. 7, II) | 6 months |
| Abuse counters: recent attempts per network address and per email, in memory only | Stop password guessing and spam | Legitimate interest (security) | Never written to disk; forgotten within an hour or at the next restart |
| Database backups, when the operator turns them on | Recover from failures | Legitimate interest | Rolled over within 30 days |
Beyond the table above, we collect nothing: no device fingerprints, no location, no history of what you do outside santi, no marketing profile.
Cookies and browser storage
| Name | Kind | What it does | Lasts |
|---|---|---|---|
__Host-santi_session |
Cookie, essential |
Keeps you signed in. HttpOnly (scripts cannot read
it), Secure (HTTPS only), SameSite=Lax
|
30 days, or until you sign out |
sidebar_state |
Cookie, preference | Remembers whether the sidebar is open | 7 days |
santi:last-project |
Local storage, preference | Remembers the last project you opened | Until you clear site data |
santi.shortcuts.off |
Local storage, preference | Remembers that you turned keyboard shortcuts off | Until you clear site data |
None of them track you or are read by anyone else, so there is no cookie banner to click through.
Who else handles your data
- Railway (Railway Corp., United States) hosts the server, the database and its backups, as our processor (sub-processor), in the region EU West (Railway europe-west4, Amsterdam).
- No email, sign-in (OAuth), analytics or advertising provider is used today. Before adding one, we will list it here and say what it receives.
- Public authorities, only when a law or a court order requires it.
International transfer
The server runs in EU West (Railway europe-west4, Amsterdam), outside Brazil, with a provider based in the United States. The transfer relies on the safeguards that LGPD art. 33 and GDPR Chapter V allow, such as the provider's standard contractual clauses and its security commitments.
AI assistants (MCP and API tokens)
santi never sends your data to an AI provider by itself. If you connect
an AI assistant to santi, through
santi mcp or an API token, whatever the assistant reads is
sent to the AI provider you chose, under that provider's terms and
privacy policy. Revoke the token to stop it.
Your rights and how to use them
Under Brazil's LGPD (Lei 13.709/2018, art. 18) and, where it applies, the EU GDPR (arts. 15 to 22), you can:
- Confirm and access what we hold: Account → Your data → Export my data downloads it as JSON.
- Correct it: edit what you wrote in santi, or write to us about your account details.
- Delete it: Account → Your data → Delete my account, or write to us.
- Take it elsewhere (portability): the export is a plain JSON file any tool can read.
- Know who receives it: the section above lists everyone.
- Anonymisation, blocking or deletion of data that is unnecessary or handled against the law.
- Object to processing based on legitimate interest, and withdraw consent where we rely on it.
- Complain to the Brazilian data protection authority (ANPD, gov.br/anpd) or, in the EU, to your local supervisory authority.
Write to ti.emerson.silva@gmail.com from the email on your account. It is free, and we answer within 15 days (LGPD art. 19). If we cannot confirm the request is yours, we will ask for something only the account holder knows.
What happens when you delete your account
- Your name, email and password hash are erased at once; you are signed out everywhere and your API tokens stop working.
- Projects only you belong to are deleted, with their issues and comments.
- Where you are the last admin of a shared project, the member with the oldest account becomes admin.
- Issues and comments you wrote in shared projects stay for your teammates, shown as "Deleted user".
- The acceptance record stays, as described in the table above.
How we protect it
- HTTPS everywhere; the session cookie is never sent over plain HTTP.
- Passwords hashed with Argon2id; sessions and API tokens stored only as SHA-256 hashes.
- A strict Content Security Policy, protection against cross-site requests, and rate limits on sign-in, sign-up and other sensitive actions.
- The database is not reachable from the internet, and the code is open source, so anyone can check these claims.
Age
santi is for people 18 or older, and sign-up asks you to confirm it. If you believe a minor created an account, write to us and we will delete it.
Hosting santi yourself
santi is free software you can run on your own server. Then your data stays on your machines, you are its controller, and this policy covers only this hosted instance.
Changes
When this policy changes in a way that matters, the app shows the new version and asks you to accept it before you continue; the version and date at the top always identify the current text.