This is a developer draft, not legal advice. It will be reviewed by counsel before the service is opened to the wider public. Email [email protected] with questions in the meantime.

AnnexVTT is built by a solo developer. We collect as little as possible and don’t sell or share your data with advertisers. This page explains what we store and why.

What we collect

Account details: email, display name, optional avatar image, optional cursor color preference.
Board content: the cards, photos, drawings, cabinet notes, journal entries, and calendar events you create.
Operational data: server logs (request paths, IPs, timestamps) retained for up to 30 days for debugging and abuse prevention.
Cookies: a single HTTP-only refresh cookie so you stay signed in, plus your theme preference (light/dark) inlocalStorage. No tracking or advertising cookies.

How we use it

Strictly to run the Service: showing you your boards, letting you collaborate with other users you’ve invited, sending you transactional emails (verify, password reset, contact replies). We don’t use your data for advertising and we don’t profile you across services.

Infrastructure providers we share with

We use the following services to operate AnnexVTT. Each of them sees only the data it needs to do its job:

Neon — managed Postgres database (stores accounts, boards, items, etc.).
Render — backend hosting.
Cloudflare Pages — frontend hosting and CDN. Cloudflare also provides privacy-preserving Web Analytics (aggregate counts only — no per-user tracking, no cookies).
Cloudflare R2 — storage for uploaded images.
Resend — transactional email delivery.

Analytics

We may enable Cloudflare Web Analytics, which records aggregate page-view counts. It uses no cookies, no fingerprinting, and doesn’t track you across sites. No third-party analytics (Google, Facebook, etc.) run on the site.

Your rights

See your data: Settings → Your data → Export downloads a ZIP of every board you belong to.
Update your data: change display name, color, avatar, email, or password in Settings.
Delete your data: Settings → Danger zone deletes your account and every board you solely own. Boards shared with other members are unaffected; you’re removed from them.

Retention

Your account and content are kept until you delete them. Server logs containing IP addresses are kept for up to 30 days. Deleted accounts are removed from active databases immediately; any residual trace in the database’s encrypted point-in-time backups (currently a window of about one day) ages out after that. If that recovery window changes, we’ll update this page.

Children

The Service is not directed at children under 13. Don’t create an account if you’re under 13.

Contact

For any privacy questions or requests, email [email protected] or use the Contact form.

Last updated: 14 May 2026.

Privacy Policy