Privacy Notice

1. Scope and service provider

This Privacy Notice applies to the Zen Whiteboard website, web application, account services, collaboration features, and related support interactions (collectively, the “Service”). In this notice, “Zen Whiteboard,” “we,” “us,” and “our” refer to the operator of the Service.

This notice does not govern the independent practices of third-party services that a user chooses to connect or use, including Google, OpenAI, Anthropic, an app store, or a device operating-system provider. Their own terms and privacy notices apply to their processing.

2. Information we process

Board content may contain personal or sensitive information at the user's discretion. Users should only place information in the Service that they are authorized to process and share.

3. How information is used

We process information as reasonably necessary to:

• create and authenticate accounts and maintain signed-in sessions;
• store, synchronize, display, search, export, restore, and secure board content;
• operate projects, routines, calendars, reminders, notifications, collaboration, and Zen Messages;
• fulfill AI requests initiated by the user and return provider responses;
• prevent fraud, abuse, unauthorized access, and technical disruption;
• diagnose errors, maintain availability, and improve reliability;
• respond to support, privacy, legal, and security requests; and
• comply with applicable law and enforce service terms.

We do not use the contents of private boards to serve targeted advertising.

4. Disclosures and user-directed sharing

We disclose information only as needed for the purposes described in this notice:

• Collaborators. A board owner may grant another Zen Whiteboard account view or edit access. Authorized collaborators receive the content and permissions made available to them until access is revoked.
• Zen Messages. Board permission makes two users eligible to contact one another; it does not grant access to either user's other conversations, private contacts, or self-reminders. Message and attachment access is limited to the sender and recipient.
• Infrastructure and operations providers. Hosting, network, backup, email, security, and technical service providers may process information to operate and protect the Service under their applicable agreements.
• Authentication providers. If Google sign-in is selected, Google processes the authentication transaction and returns account identity information needed to sign in or create the Zen Whiteboard account.
• AI providers. When Zen Assistant is used, the chosen provider receives the prompt and supporting content needed to answer it, as described below.
• Legal and safety disclosures. Information may be preserved or disclosed when reasonably necessary to comply with lawful process, protect users or the public, investigate abuse, or establish and defend legal claims.
• Business transactions. Information may transfer as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable law and continued protection under an appropriate privacy notice.

No sale of personal information. Zen Whiteboard does not sell personal information for money. Zen Whiteboard also does not share personal information for cross-context behavioral advertising.

5. Zen Assistant and third-party AI

Zen Assistant is an optional, user-initiated feature. The user selects an AI provider and supplies a personal provider API key. When a request is submitted, Zen Whiteboard sends the prompt, recent conversation context, relevant board data, and any selected image to the chosen provider through the application service. Do not submit information to an AI provider unless you are authorized to do so.

AI requests are outside the client-side encryption boundary because requested content must be decrypted in the browser before it can be processed. OpenAI or Anthropic may process submitted information under the terms governing the user's API account. Provider behavior, retention, and model training policies are controlled by the selected provider, not Zen Whiteboard.

Saved AI credentials are stored with encrypted account data or on the native device, depending on the client. Credentials are not included in Zen Whiteboard account data exports. Users can remove saved credentials from the Privacy & Security Center.

6. Security and encryption

Zen Whiteboard applies administrative and technical safeguards designed to protect account and board information. Current controls include HTTPS, authenticated sessions, server-enforced owner/view/edit permissions, request validation, restricted private API caching, sign-in throttling, security headers, assistant rate limits, attachment type and size checks, and security-event logging that excludes card and message content and API keys. Zen Messages text and attachments are encrypted at rest and attachment access is limited to the sender and recipient.

Two-factor authentication

Two-factor authentication and content encryption address different risks. Two-factor authentication can reduce account-takeover risk; a separate encryption passphrase protects supported stored content. If a two-factor option is made available through the account's authentication system, users should consider enabling both controls.

No transmission or storage system is guaranteed to be completely secure. Users are responsible for protecting account credentials, encryption passphrases, API keys, devices, and recovery methods, and should report suspected unauthorized access promptly.

7. Retention and deletion

Account and board information is generally retained while the account remains active and as needed to provide the Service. Security records may be retained for a limited operational period to investigate abuse and protect the Service. Records may be retained longer where required for security, dispute resolution, legal compliance, or establishment of legal claims.

Deleting an eligible non-administrator account removes its board storage, routines, project templates, Zen Messages and attachments, sharing records, saved AI settings, and security activity from the live WordPress database. Copies may remain in encrypted or access-controlled infrastructure backups until those backups rotate under the hosting provider's retention process. Deletion does not remove information another user independently exported or lawfully retained.

8. Your rights and choices

Subject to location, applicable law, identity verification, and lawful exceptions, users may have rights to request access, correction, deletion, portability, restriction, objection, or information about processing. Zen Whiteboard provides direct product controls to:

• download account and board information;
• correct board content and account profile information;
• revoke all board-sharing permissions;
• remove saved OpenAI and Anthropic API credentials;
• sign out other active devices or sessions; and
• delete an eligible non-administrator account.

These controls are available from the Privacy & Security Center inside the signed-in application. A request may also be submitted using the contact information below. We may ask for information necessary to verify identity and authority before completing a request. We will not discriminate against a user for exercising an applicable privacy right.

If you believe a request was not handled appropriately, contact us so it can be reviewed. Depending on your jurisdiction, you may also have the right to complain to your local data-protection or consumer-protection authority.

9. Cookies, local storage, and notifications

The Service uses cookies and browser storage that are necessary to authenticate accounts, protect requests, preserve security and application settings, and retain encrypted data or keys on the user's device. Disabling required storage may prevent sign-in, synchronization, encryption, or other core features from working.

Zen Whiteboard requests browser or operating-system notification permission only when a notification-dependent feature is used. Permission can be denied or withdrawn in browser or device settings. The Service does not require advertising cookies to provide its board features.

10. International processing

Zen Whiteboard and its service providers may process information in countries other than the country where a user lives. Privacy laws and government-access rules may differ across jurisdictions. Where applicable law requires a transfer mechanism or additional safeguard, the responsible party will use an appropriate mechanism for the relevant transfer.

11. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from a child under 13 without legally sufficient authorization. If you believe a child has provided personal information improperly, contact us so the matter can be investigated and appropriate action taken. Users responsible for organizational or school deployments must obtain any permissions required by applicable law.

12. Changes to this notice

We may update this notice when the Service, vendors, or legal requirements change. The “Last updated” date and version identify the current notice. Material changes will be communicated through the Service or another appropriate channel when required. Previous conduct remains governed by the notice in effect when that conduct occurred, subject to applicable law.

13. Contact and privacy requests