Legal

Privacy Policy

Last updated: May 11, 2026

Roadmapper is a small product-roadmap tool. This page describes what data the service collects, where it lives, and how to control it. Plain-language summary up front; details below.

Summary

• We store your sign-in identity (email + name + avatar) and the roadmap data you create.
• If you connect a version-control provider, we store PR metadata. We don't read your source code.
• No analytics, no advertising, no tracking pixels.
• You can delete a workspace at any time from Settings → Workspaces. That deletion is permanent.

What we collect

Identity

When you sign in we receive, from your provider:

• Email address
• Display name (from your sign-in provider's profile)
• Avatar image URL
• Provider user ID (so we can recognize you on future sign-ins)

For version-control sign-ins, an OAuth access token is held only for the duration of your session and used to read repositories and pull-request data when you ask us to sync.

Workspace data

The records you create — themes, capabilities, tasks, sprints, comments, and revisions — are stored in our managed database. Workspaces are isolated per-account: nobody can read your workspace unless they own it or you have explicitly invited them.

Version-control integration

When you connect a repository — either via personal access token or by installing our integration app — we read and store metadata about pull requests:

• PR number, title, description, branch names, labels, status
• Author login and avatar
• Linked commits and check-run statuses
• The integration installation ID, when applicable

We do not read source code, repository contents, secrets, or organization membership beyond what's required to enumerate accessible repos.

Operational logs

Routine service and infrastructure logs (such as request URL, response status, and timing) are captured to operate the service. Workspace content is never included in operational logs.

What we don't collect

• No behavioral analytics (no third-party analytics, segmentation, or product-tracking tools)
• No advertising or attribution tracking
• No third-party fingerprinting or cookies beyond the auth session
• No source code, repository contents, or files

Where data lives

Application data is stored on managed infrastructure located in the United States and served from a global edge network. Sign-in handshakes transit your chosen identity provider per their respective policies. Our version-control integration, when used, receives webhook events from your provider on a per-PR basis.

How long we keep it

• Workspace data is kept as long as the workspace exists. Deleting a workspace from Settings permanently removes all themes, capabilities, tasks, sprints, and edit history attached to it.
• Identity is kept as long as your account exists. To delete your account entirely, delete all workspaces you own and contact us to remove your auth row.
• Logs are retained for a limited period (typically up to 30 days) per our infrastructure providers' defaults.

Sharing

We do not sell or share workspace data with third parties. We share data only with the infrastructure subprocessors needed to operate the service — for hosting, database, authentication, and diagnostics. We share data with your version-control provider only if you choose to connect a repository. A current list of subprocessors is available on request.

Your rights and controls

• Access — download your workspace as JSON from Settings → Data → Export.
• Correct or delete content — edit and delete records directly in the app.
• Delete a workspace — Settings → Workspaces → Delete (owner only).
• Disconnect version control — disconnect from your sync settings, and revoke the integration app from your provider's installed-apps settings.
• Account deletion — contact us (link below) and we'll remove your auth row and any remaining data on file.

Children

Roadmapper is not directed at children under 16. If you believe a minor has created an account, contact us and we'll delete it.

International users

Roadmapper is operated from the United States. By using it you understand that your data will be processed in the United States, which may have different data-protection laws than your country of residence.

Changes to this policy

We'll update the "Last updated" date above when this policy changes. For material changes, we'll surface a notice in the app.

Contact

Questions or requests: contact@roadmapperai.com.