Privacy Policy

01Who is responsible for your data

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

We are not required to appoint a data protection officer. For any privacy-related question or request, contact us at the address above.

02Scope of this policy

This policy applies to the Prody Board macOS application, its backend services, and the website prodyboard.com. It describes the processing of personal data of our users. Where you use Prody Board to send emails to your own contacts, you are responsible for those recipients' data — see section 07.

03Account & sign-in data

You create an account by signing in with Google or Apple (Sign in with Apple). Authentication is handled through Supabase, hosted in the EU (Frankfurt). When you sign in, we receive and store:

• Your name (as provided by the sign-in provider)
• Your email address
• A provider-specific account identifier (OAuth ID)

We do not receive your Google or Apple password. Which data the provider shares with us depends on your settings with that provider — for example, Apple lets you hide your real email address.

04Subscriptions via Apple (StoreKit 2)

Prody Board subscriptions are purchased exclusively through the Apple App Store using StoreKit 2. Apple processes the payment. We never receive or store your payment details (card numbers, bank details, billing address).

From Apple we receive signed subscription information (App Store Server Notifications), which we verify and store to manage your access:

• Subscription status, plan, and period (e.g. active, renewed, expired, refunded)
• Pseudonymous transaction identifiers

Apple's own processing of your purchase data is governed by Apple's Privacy Policy.

05Mailbox integration via Nylas

The core of Prody Board is connecting your own email mailbox. This connection is provided through Nylas, operated for our users in the Nylas Europe data region (London), United Kingdom. The United Kingdom is covered by an adequacy decision of the European Commission under Art. 45 GDPR. When you connect a mailbox, you authorize Nylas via OAuth to access it on your behalf; we store the resulting access grant reference so the app can act for you.

What happens with your emails

• Emails and attachments are retrieved live from your mailbox through Nylas when you use the app.
• We do not permanently store the contents of your emails on our servers. Email bodies and attachments are processed transiently to display them in the app, let you download attachments, and send messages.
• Attachments you download are stored locally on your Mac, under your control.

You can disconnect your mailbox at any time in the app. On disconnection, subscription expiry, or account deletion, the Nylas access grant is revoked. Nylas' processing is governed by its own privacy documentation at nylas.com.

06Contacts & zero-knowledge encryption

Contacts you manage in Prody Board (such as names, email addresses, and related fields) are stored in our database in encrypted form.

Because we never hold the key, we cannot recover your contact data if you lose this password. This is a deliberate trade-off in favor of your privacy.

07Campaigns & email sending

You can create campaigns and send emails to up to several hundred contacts at once. Each email is sent individually per recipient from your own connected mailbox via Nylas — Prody Board does not operate its own bulk-mail infrastructure and recipients receive a normal email from your address.

To provide the service, we store campaign data associated with your account, such as campaign content, recipient assignment, and send history/status, until you delete the campaign or your account.

08Open & click tracking

Prody Board offers engagement tracking for campaigns. By agreeing to our Terms & Conditions, open and click tracking is enabled by default for campaigns; you can revoke or disable it at any time in the app.

• Open tracking (tracking pixel): enabled by default for campaigns; you can disable it at any time. When enabled, a tiny invisible image is embedded in outgoing emails.
• Link tracking: click statistics are collected only for links you explicitly insert as tracked links — while composing, the app shows you which links are tracked and which are not. When tracking is enabled, links are technically delivered via Nylas; clicks on non-tracked links are transmitted in the process but not stored.

When a tracked email is opened or a tracked link is clicked, we receive an event notification (webhook) from Nylas. For each event we store only:

Data such as IP address, user agent, and approximate location is technically transmitted during delivery, but we neither log nor store it.

These events are used solely to show you open and click statistics for your own campaigns.

09File storage

You can upload files (for example beats or press kits) to attach to your emails. Files are stored in Amazon S3 in the AWS Frankfurt region (eu-central-1) and are encrypted at rest using AWS server-side encryption.

• Access is strictly scoped: you can only access your own files.
• Files are loaded from storage when you attach them to outgoing emails.
• All of your files are permanently deleted when you delete your account.

10Service providers (recipients of data)

We use a deliberately small set of infrastructure providers, acting as processors on our behalf where applicable:

We use no advertising networks, no analytics or crash-reporting SDKs, and no AI providers. We do not sell personal data.

11International data transfers

Our core infrastructure runs in the European Union. Where a provider processes data outside the EU/EEA — in particular Apple and Google in the United States in connection with sign-in and subscriptions, and Vercel (website hosting) in the United States — the transfer is safeguarded by an adequacy decision of the European Commission (EU–US Data Privacy Framework) and/or Standard Contractual Clauses (Art. 46 GDPR).

Nylas processes mailbox data in the United Kingdom; this transfer is covered by an adequacy decision of the European Commission under Art. 45 GDPR.

12Retention & deletion

We keep your data for as long as your account exists and as needed to provide the service.

• Email contents: not permanently stored (see section 05).
• Contacts, campaigns, tracking events, files: stored until you delete them or your account.
• Account deletion: when you delete your account, all associated data — database records, uploaded files, and mailbox access grants — is permanently deleted immediately, at the latest within 72 hours. Nylas grants are revoked.

We may retain individual records longer only where a legal obligation requires it (e.g. records related to tax-relevant transactions under German commercial and tax law).

13Legal bases (Art. 6 GDPR)

14Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure ("right to be forgotten", Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interests (Art. 21)

To exercise any of these rights, email privacy@prodyboard.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence or place of work.

Note: due to the zero-knowledge encryption of contacts (section 06), access and portability requests for contact data can only be fulfilled through the app itself, where the data can be decrypted with your password.

15Minimum age

Prody Board is a professional tool. You must be at least 18 years old to create an account and use the service. We do not knowingly process data of minors.

16Website & cookies

The website prodyboard.com uses no cookies, no analytics, and no tracking. The website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit the site, Vercel processes technically necessary connection data (such as IP address and requested page) in server logs to deliver the site and ensure its security (Art. 6(1)(f) GDPR). These logs are automatically deleted after a short period. The transfer to the United States is safeguarded by the EU–US Data Privacy Framework and/or Standard Contractual Clauses (see section 11).

17Changes to this policy

We may update this policy when the product or legal requirements change. The current version is always available at prodyboard.com/privacy. For material changes we will inform you in the app or by email.

18Contact

Questions about privacy or this policy: privacy@prodyboard.com