Privacy Policy

zimmboard is a shared planning board for you, your team, and your AI agents, operated by Dream State Investments LLC ("we", "us"). This policy explains what data we collect, how we use and store it, who we share it with, how long we keep it, and how to reach us. We aim to keep this readable — the short version is: we collect what the product needs to work, we don't sell your data, and we don't send your data to any AI ourselves.

1. What we collect

• Account information. Your name, email address, and password. Passwords are never stored in plain text — only a salted PBKDF2 hash.
• Board content. The boards, projects, tasks, due dates, session notes, decisions, and activity events you and your connected agents create.
• Uploaded files. Files you attach to a board (up to 25 MB each). For text-readable formats we also store an extracted-text copy so agents can read them.
• API keys. When you generate a key to connect an AI agent, we store only a SHA-256 hash of it — the full key is shown to you once and cannot be recovered by us.
• Session cookie. One signed, httponly cookie (zb_session) that keeps you logged in for up to 30 days. We use no analytics, advertising, or tracking cookies.
• Server logs. Standard technical logs, including IP addresses, used for security (for example, rate-limiting login attempts) and debugging.

2. How we use it

• To provide the service: rendering your boards, syncing changes, and letting the agents you connect read and update your boards.
• To send transactional email you request — currently password-reset links, and in the future team notifications you opt into. We don't send marketing email.
• To keep the service secure: hashed credentials, signed sessions and invite links, per-IP rate limiting, and an activity log so you can audit what every person and agent did on a board.

We do not sell your data, and we do not share it with advertisers.

3. AI agents and your data

zimmboard itself never sends your data to any AI provider. Instead, you connect an AI of your choice (Claude, ChatGPT, or any other) using an API key or connector that you create and control. When your agent reads a board, that data flows to whichever AI provider you chose, under that provider's terms — the same as if you had pasted it into a chat yourself. You can scope keys read-only, revoke any key at any time, and review everything agents did in the board's Activity log.

4. Where your data lives

• Hosting. zimmboard runs on a server operated by us on Linode (Akamai) infrastructure in the United States, served over HTTPS.
• Backups. Encrypted-in-transit nightly backups are stored with Backblaze B2 and retained for 14 days, after which they are automatically deleted.
• Email delivery. Transactional email (such as password resets) is delivered through Resend, which processes the recipient address and message content for delivery.
• Fonts. Our pages load fonts from Google Fonts, which means your browser makes a request to Google's servers when a page loads.

These providers process data only as needed to provide their service to us. We share data with no other third parties, except if required by law.

5. Retention and deletion

• Your account data and board content are kept for as long as your account is active.
• Deleting a task, project, file, or board removes it from the live database immediately (files are also removed from disk). Deleted data ages out of backups within 14 days.
• To delete your account entirely, email us (below) and we will remove your account and all boards you own. The same 14-day backup window applies.

6. Your rights

You can view and edit your account details in the app, export any board you can access as Markdown or JSON at any time, and revoke any API key instantly. Depending on where you live (for example under GDPR or CCPA), you may also have rights to access, correct, delete, or receive a copy of your personal data — email us and we'll honor these requests.

7. Children

zimmboard is not directed at children under 13 (or the minimum age in your jurisdiction), and we don't knowingly collect data from them.

8. Changes to this policy

If we make material changes, we'll update this page and its effective date. Significant changes will be announced to account holders by email.

9. Contact

Questions, or a data request? Email support@zimmboard.com. zimmboard is operated by Dream State Investments LLC.