Privacy policy

This policy explains what information The Target Board (“we”) collects when you use this website, why, and the choices you have. It describes how the website is actually built.

Operator and contact details: To confirm: legal business name, address and privacy contact email

What we store

Your account

• Email address and a password. Passwords are handled by our authentication provider (Supabase Auth) and stored only as a secure hash; we never see or store your password in our own tables.
• Optional display name and your time zone (used to schedule reminders).
• Whether your account has physical-kit features and, for staff, an administrator role.

Your digital board

• The tasks you write (title, optional note), the marker colour you wrote them in, whether they’re complete, their order, and when they were created or changed.
• If you try the board without an account, your tasks are stored only in your browser’s local storage on that device. We never receive them unless you choose to move them into your account.

Your board photo

• The most recent photo you saved of your physical board, stored in a private storage bucket, plus its size, type and dimensions.
• Before upload your browser re-encodes the image, which removes embedded metadata such as GPS location.
• Photos are never given a public link. When you view your photo, the site creates a link that expires after a few minutes and works only for your signed-in account.

Reminders and notifications

• Your reminder settings: time, days, time zone, destination, and whether each reminder is on.
• For each device where you turn on notifications, the push subscription your browser gives us (an endpoint address at your browser’s push service and encryption keys) and an optional device label.
• A delivery log for each scheduled reminder (when it was due, whether it was sent, and a short error code if it failed). Notifications themselves contain only generic text and a link to your dashboard — never your tasks or photo.

Orders

• When checkout is available: the product, price, quantity, totals, order and fulfilment status, the email you used, and your shipping name and address.
• Card details are entered on Stripe’s checkout page and are never sent to or stored by us.
• If you check out as a guest, the order is linked to a website account only when someone signs in with a verified email address that matches the one used at checkout.

Messages and the waitlist

• If you use the contact form: your name, email, topic and message.
• If you join the waitlist: your email address, used only to tell you when the kit is available.

Security and abuse prevention

• To limit abuse, we count requests per sender for a short time window. The identifier (such as your IP address) is one-way hashed before it is stored and these records are removed after about a day.

Cookies and analytics

We use cookies only to keep you signed in. If privacy-friendly analytics are enabled, we use Plausible Analytics, which does not use cookies or collect personal data, to count page views and a few product events (for example, “checkout started”). We do not use advertising trackers and we don’t use the contents of your board, tasks or photos for analytics.

Who processes your data

• Supabase — accounts, database and private photo storage.
• Stripe — payment processing for kit orders.
• Our hosting provider To confirm: e.g. Vercel — serves the website and runs scheduled reminders.
• Your browser’s push service (for example Google, Mozilla or Apple) — delivers notifications to your device.
• Plausible Analytics — only if enabled, as described above.

Data location and international transfers: To confirm: Supabase region, hosting region and transfer safeguards

How long we keep it

• Account, tasks, photo, reminders and push subscriptions: until you delete them or delete your account.
• Reminder delivery logs: To confirm: retention period
• Contact messages and waitlist entries: To confirm: retention period
• Order records: as long as required for accounting, tax and consumer-law purposes To confirm: period by jurisdiction

Your choices and rights

• Notifications: turn them off for a device in Reminders, or block them in your browser settings at any time.
• Photos: replace or delete your board photo at any time from the photo page.
• Account deletion: delete your account from Account settings. This permanently removes your profile, tasks, board photo, reminders, delivery logs and push subscriptions. Order records are kept where the law requires it, but are unlinked from your deleted account.
• Access or correction: contact us via the contact form using the Privacy topic.

Jurisdiction-specific rights (for example GDPR, UK GDPR or US state privacy laws): To confirm: which laws apply and how requests are verified

Children

The website is not directed at children under To confirm: minimum age, e.g. 13 or 16, and we do not knowingly collect their data.

Changes

We’ll update this page when our practices change and revise the date at the top.