Privacy

This site counts visits with Umami, an analytics tool we host ourselves. It sets no cookies, does not follow you across other sites, and the data is not sold or shared with anyone.

For each page view it records:

• the page path, for example / or /privacy — without the query string or the part after #, so search terms and sign-in parameters are not recorded. Pages inside the app are recorded as a route template such as /i/:key or /p/:project/list, under a fixed page name, never with your project names, issue keys or issue titles;
• the referrer (the page you came from);
• your browser, operating system and device type, screen size and language;
• your approximate location (country, and region or city where available), worked out from your IP address when the visit arrives.

It also counts a few product events, such as which way a new account chose to start, with no names, emails or project data.

Issue titles, descriptions, comments and files are not part of this. The tracker reports only from the site's own domain, and only when the operator of the instance has switched it on.

• Your account: e-mail address, name and username, and the time zone your daily digest is scheduled in (taken from your browser when you sign up; you can change it in Settings).
• What you create: projects, issues, comments and the files you upload.
• A session cookie that keeps you signed in. It is necessary for login, not used for tracking, and can be ended everywhere from Settings (Sign out everywhere).
• A cookie, sprintree_last_login, that remembers on this device which sign-in method you used last (email, Google, GitHub or GitLab), so the login page can mark it "Last used". It holds only the method name, lasts one year, is not used for tracking, and is cleared by Sign out everywhere and by deleting your account.

Sprintree sends you e-mail for sign-in and for the notifications you have turned on.

For security and debugging, the servers keep operational logs of the requests they receive: the time, the path (never the query string), the status, your IP address, your browser or app (the User-Agent) and a request id. Request bodies, cookies and tokens are not logged.

When a page fails, your browser may send us an error report: the error message, its technical trace, the page path (never the query string), your browser and, if you are signed in, your account id. It is kept in the server logs for a short time, and it holds no cookies and none of what you typed into forms.

The web server in front of Sprintree also keeps an access log, to trace and debug requests, including the ones it answers itself, such as redirects. It records only: the time, the method, the host and the path (never the query string, not even in a redirect address), the status, how long the request took, the size of the answer, your IP address, your browser or app (the User-Agent) and the request id Cloudflare gives it. It does not record cookies, credentials, the page you came from, or any other request or response header.

The web server's access log starts a new file every day (or at 10 MB), keeps three old files at most, and deletes them after 30 days, so an entry is kept for about 30 days at most. The logs of the application containers are limited by size only (up to three files of 10 MB per container), not by time, so with little traffic they can hold entries older than 30 days. None of the logs are shared or used for analytics.

The server keeps the method of your last sign-in (e-mail, Google, GitHub or GitLab) on your account, and anonymous daily counts of sign-ins per method (no names or addresses). Your data export includes it.

In Settings, under Danger zone, you can export your data (your profile, the sign-in accounts you connected (Google, GitHub, GitLab: provider, e-mail and dates), the projects you belong to, the issues you created, the comments you wrote and the list of files you uploaded, including those in projects you can no longer see, listed without the project or issue) as JSON or Markdown, and delete your account. Deleting asks for a code we e-mail you.

When you delete your account:

• your e-mail address, name and username are removed from your account; it stays only as an empty record called “Deleted user”, and you can sign up again with the same address to get a new, empty account;
• your sessions, access tokens, connected apps, notifications, settings and pending invitations are deleted;
• you leave every project; a project you owned passes to its longest-standing editor, or, if it has no editor, is archived (its data is kept, but nobody can open it);
• what you wrote stays in the projects you worked in: the issues, comments and files are still there, shown as written by “Deleted user”. The change history of those projects keeps what it recorded, which can include your name as it was then (for example in an assignment); the event log is removed after 30 days.

Ask a question or report a problem at support@sprintree.com, or see the Support page.