Privacy notice
Last updated 9 November 2026
Arrivo is a feedback, roadmap and changelog product operated by Tenacrity Technologies Private Limited. This notice covers readers in the EU and UK (GDPR) and India (Digital Personal Data Protection Act, 2023). It describes what this deployment processes, and nothing that it does not.
1. What we process, and why
| What | Why | Kept for |
|---|---|---|
| Your email address, display name, and a password hash (scrypt) | To create your account and sign you in. We never store your password. | Until your access is removed |
| Your workspace membership and which boards you may open | To show you the right customer’s boards and nothing else | Until your access is removed |
| Feedback you submit: title, description, and the address or cookie that identifies you | So the team can read it and answer it | Until it is deleted by the workspace |
| Cards, their stage, and the audit trail of who moved them | To decide what gets built, and to be able to say who decided | While the board exists — this is the record |
| API key prefixes and last-used times | So an agent’s access can be identified and revoked | Until the key is deleted |
| Server logs (IP address, path, status) | Security and diagnosing faults | Rotated on the host’s log retention |
2. Cookies — all of them
There is no consent banner on this site because there is nothing optional to consent to. Every cookie below is strictly necessary for a feature you asked for, which is the one category GDPR exempts. There is no analytics, no advertising, no tag manager, no session recording, and no third-party font or script on any page.
| Name | What it holds | Lifetime |
|---|---|---|
arrivo_staff | A signed session: who you are, which workspace, which role. HttpOnly; not readable by scripts. | 8 hours, or until you sign out |
arrivo_voter | A signed, hashed version of the address you gave so your vote counts once. Set only when you vote. | 180 days |
arrivo_new_api_key | A newly created API key, so it can be shown to you once. | Under 2 minutes |
arrivo_new_invite | An invitation link that could not be emailed, shown to the person who created it. | 5 minutes |
arrivo_oauth_state, arrivo_oauth_tenant | Only if GitHub sign-in is enabled: the anti-forgery state for one sign-in attempt. | 10 minutes |
3. Who else is involved
| Processor | What it does | Where |
|---|---|---|
| Hetzner | Hosts the server and the databases | Germany (EU) |
| Cloudflare | DNS, and the TLS front door when enabled | Global edge |
| Resend | Delivers invitation and sign-in emails. Receives the address and the message only. | United States |
| GitHub | Only if GitHub sign-in is enabled, to confirm your identity | United States |
Nothing is sold, and nothing is used to train models. Where data leaves the EU — the email processor — it does so under standard contractual clauses, for the single purpose of delivering a message you or your administrator triggered.
4. How your data is kept apart
Each customer gets their own database. Access is decided per request from your membership, not from anything the browser sends, and a board you have no grant on is invisible rather than merely refused. An automated audit (check-isolation.mjs) asserts that separation after every deploy.
5. Your rights
Under the GDPR you may ask for access, correction, erasure, restriction, portability, and you may object to processing or withdraw consent where consent was the basis. Under India’s DPDP Act you may access, correct, complete or erase your data, nominate somebody to act for you, and complain to the Data Protection Board of India.
In practice: much of this is a workspace administrator’s job, because they own the board you appear on. Write to us and we will route it — including deleting your address from boards you no longer work with.
Contact. Tenacrity Technologies Private Limited · [email protected]. We answer within 30 days, as both regimes require. If you are in India, the same address is the grievance channel for the Data Protection Board.
6. Changes
When this notice changes, the date at the top changes with it. Anything that materially widens what we collect will be announced on the sign-in page of the workspace before it takes effect.