Privacy Policy

Last updated: February 6, 2026

Background ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our project management application and website (collectively, the "Service").

1. Information We Collect

Information You Provide

• Account information: When you sign up, we collect your name, email address, username, and password.
• Profile information: You may optionally provide a phone number, job title, and profile photo.
• Organization data: Organization name, team member information, and workspace settings.
• Project data: Project details, time entries, invoices, contacts, comments, and files you upload to the Service.
• Payment information: If you subscribe to a paid plan, payment details are processed by our third-party payment processor. We do not store full credit card numbers.

Information Collected Automatically

• Usage data: Pages visited, features used, and interactions with the Service.
• Device information: Browser type, operating system, IP address, and device identifiers.
• Cookies: We use essential cookies for authentication and session management. See Section 6 for details.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Create and manage your account
• Process transactions and send related information
• Send transactional communications (password resets, verification emails and SMS, account notifications)
• Respond to your requests and support inquiries
• Monitor and analyze usage trends to improve user experience
• Detect, prevent, and address technical issues and security threats

3. How We Share Your Information

We do not sell your personal information. We may share information in the following circumstances:

• Within your organization: Other members of your organization can see your name, email, position, and profile photo as part of normal Service functionality.
• Service providers: We use third-party services to help operate the Service, including:
  • Cloud hosting and data storage
  • Email delivery (Resend)
  • SMS delivery (Twilio)
  • Payment processing
  These providers only access your data as needed to perform their services and are bound by contractual obligations to protect it.
• Legal requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS/SSL)
• Hashed passwords using bcrypt
• JWT-based authentication with token expiration
• Hashed verification codes for phone verification
• Organization-scoped data access to ensure multi-tenant isolation

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal or legitimate business purposes.

Project data, time entries, and other content you create within an organization are retained as part of the organization's data and are subject to the organization administrator's policies.

6. Cookies

We use the following types of cookies:

• Essential cookies: Required for authentication and core functionality. These cannot be disabled.
• Preference cookies: Remember your settings and preferences within the application.

We do not use third-party advertising or tracking cookies.

7. Your Rights

Depending on your location, you may have the right to:

• Access and receive a copy of your personal data
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to or restrict processing of your data
• Data portability (receive your data in a structured format)
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at the address below.

8. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected such information, we will promptly delete it.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Background
Email: privacy@onbackground.app