Privacy Policy
Slatedrop ("we", "us", "our") provides a collaborative whiteboard platform via the website slatedrop.com. This policy explains what personal information we collect, how we use it, who we share it with, and your rights as a user. We're based in New Zealand and handle personal information in line with the New Zealand Privacy Act 2020 and, where relevant, the Australian Privacy Principles under the Privacy Act 1988 (Cth).
Information we collect
Information you give us
- Account information — your email address and display name. If you sign in with Google, we also receive your name and avatar URL from Google.
- Workspace and content data — workspaces you create, names you choose, drawings and notes you place on boards, files you upload (images), and which other users you invite or join.
- Communications — if you email us or submit a support form, we keep what you send so we can respond.
- Payment details — if you subscribe, your payment information is collected by Stripe and never reaches our servers. We receive a customer ID, subscription status, and billing period information from Stripe.
Information collected automatically
- Usage and connection data — IP address, approximate location (country level), browser, device type, timestamps, and pages visited. This is generated by Cloudflare and our application as a normal part of operating a web service.
- Local storage and cookies — we use browser local storage for sign-in sessions, sidebar preferences, and a few similar settings. We do not use third-party advertising or tracking cookies.
Anonymous (guest) users
When someone joins a public board via a share link without signing in, we create a temporary anonymous account and store only the display name they enter. They aren't asked for an email or any other identifying information.
How we use your information
- To provide the Slatedrop service and keep your boards in sync.
- To authenticate you and protect your account.
- To process payments and manage your subscription.
- To communicate with you about the service (changes, security issues, billing, support replies).
- To investigate abuse, debug problems, and improve the product.
- To comply with legal obligations.
We don't sell your personal information. We don't use your board content to train AI models or build advertising profiles.
Who we share information with
We use a small number of carefully chosen service providers ("processors") to operate Slatedrop. They process your information only to deliver services to us and are bound by confidentiality and data protection obligations.
| Processor | Purpose | Where they process data |
|---|---|---|
| Supabase | Database, authentication, file metadata | Sydney, Australia |
| Cloudflare | Web hosting, real-time board sync (Durable Objects), file storage (R2), DDoS protection | Globally distributed (edge servers) |
| Stripe | Payment processing and subscription management | Globally (primary: United States, Ireland) |
| Google (optional) | OAuth sign-in, if you choose to sign in with Google | Globally |
We may also share information when required by law (e.g. responding to a valid legal request), to protect the rights or safety of users or others, or as part of a corporate transaction (e.g. if Slatedrop is acquired). We will give you notice of significant changes where reasonable.
Where your data is stored
Your account information, workspaces, and board metadata are stored in our Supabase project hosted in Sydney, Australia. Your live board content (drawings, real-time sync state) and uploaded images sit in Cloudflare's globally distributed network, which means data may be cached on edge servers around the world for performance. Stripe processes payment data globally according to its own terms.
By using Slatedrop, you agree to your information being transferred to and processed in the locations described above, including outside New Zealand.
How long we keep your data
- Account data — for as long as your account is active. If you delete your account, we delete personal information promptly (typically within 30 days), except where we're legally required to retain certain records (e.g. tax records for invoiced payments).
- Board content — until you or another workspace owner deletes it.
- Backups — encrypted backups may persist for up to 30 days after deletion before being overwritten.
- Logs and operational metadata — typically up to 90 days.
Your rights
Under the New Zealand Privacy Act 2020 (and similar laws in Australia and elsewhere), you have rights over your personal information, including:
- Access — request a copy of the personal information we hold about you.
- Correction — ask us to fix inaccurate or incomplete information.
- Deletion — delete your account at any time from the Account menu in your dashboard. You can also email us and we'll do it for you.
- Withdraw consent — for processing where we rely on consent.
- Complain — if you have concerns about our handling of your information, please contact us first. You can also complain to the Office of the Privacy Commissioner of New Zealand (privacy.org.nz) or the Office of the Australian Information Commissioner (oaic.gov.au).
Security
We use industry-standard security practices: HTTPS for all traffic, encrypted data at rest, hashed/secured authentication credentials, and access controls inside our team. No system is perfectly secure though — please use a strong, unique password, and let us know immediately if you think your account has been compromised.
Children
Slatedrop is not directed at children under 13, and you must be at least 13 to create an account. If you believe a child under 13 has provided us with personal information, please contact us and we'll delete the account. Where local law sets a higher age (for example 16 in some EU countries), users must meet that age requirement.
Changes to this policy
We may update this policy from time to time. If we make material changes, we'll notify you via email or via a prominent notice on the service before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.
Contact
For privacy questions, requests, or complaints, email [email protected]. We aim to respond within 10 business days.