HelderBoard privacy statement
Version of 25 October 2026.
HelderBoard (app.helderboard.tech) is an online whiteboard and mind map. You can export a board as a brief for an AI coding agent. This statement explains which data HelderBoard processes, why, for how long, and what your rights are.
Who is responsible
Pink Elephant Salon (sole proprietorship), Ganzenheuvel 33, 6511 WD Nijmegen, Chamber of Commerce 83005544 ("we"). Privacy questions: privacy@helderboard.tech.
Which data, why and for how long
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Your email address and the date your account was made | Your account; signing in; mail about your account | Performance of the contract | Until you delete your account |
| Your password, if you set one | Signing in | Performance of the contract | Only as a scrypt hash, never readable; until you change it or delete your account |
| Your boards: text, shapes, drawings, images, titles, intent and legend | The service itself | Performance of the contract | Until you delete them or your account. Images of deleted boards leave the server at once |
| The email addresses you share a board with, and their role (view or edit) | Sharing | Performance of the contract | Until you stop sharing, delete the board, or the recipient deletes their own account |
| Sessions: a random key in your browser; on our side only an irreversible hash, with the time of sign-in and last use | Staying signed in | Performance of the contract | Expires after 12 hours without activity and always after 30 days; erased within an hour after that |
| Sign-in mails: your email address, your IP address, hashes of the code and the link, time, number of attempts | Signing in with a code; preventing abuse and guessing | Performance of the contract; legitimate interest (security) | 24 hours, then erased within an hour |
| Failed sign-in attempts: IP address and email address, with the time | Preventing guessing of passwords and codes | Legitimate interest (security) | 15 minutes, then erased within the hour |
| After an account is deleted: a hash of the email address and the date the account was made | Making sure a restored backup does not bring a deleted account back | Legal obligation (your right to erasure) | 35 days, apart from the database |
| Technical error messages of the server (without email addresses) | Fixing faults | Legitimate interest | 7 days |
| Backups of all stored data above | Recovery after a fault | Legitimate interest | Daily, kept 21 days. Hostinger also keeps the two latest weekly backups of the whole server |
HelderBoard keeps no visitor log (no record of who opened which page), uses no analytics or advertising services, loads no scripts or fonts from other parties, and sells nothing on. Images you add are re-saved in your own browser, which removes data such as location and camera (EXIF) before they are uploaded.
Where your data is, and who processes it
- Hostinger (Hostinger International Ltd., Cyprus) hosts the server, in a data centre in Germany. Hostinger also handles the mail from
info@helderboard.tech. Hostinger is our processor for this, under its data processing agreement (hostinger.com/legal/dpa). - Sign in with Google or GitHub (only if you choose it): Google or GitHub then tells us your email address and a fixed number for your account with them. We get no access to your mail, files or code. Google's and GitHub's own privacy statements apply as well.
- AI services: HelderBoard sends nothing to AI services. Your own browser makes an export (HELDERBOARD.md or a ZIP). What you do with it next, for example giving it to Claude Code or Codex, falls under that service's terms.
The server and all backups are in the European Economic Area (EEA). Should Hostinger have data processed outside the EEA for administration or support, the European Commission's standard contractual clauses in its data processing agreement apply. If you choose to sign in with Google or GitHub, we exchange data with Google LLC or GitHub, Inc. in the United States. Both are certified under the EU-U.S. Data Privacy Framework.
Sharing
When you share a board, the recipient sees its content and your email address as its owner. An editor can change the content. We do not mail the recipient; you tell them yourself. Someone who shares a board with you sees your email address in the list of people with access.
Cookies and storage in your browser
HelderBoard only uses what the service needs to work; that is why we do not ask for consent.
| Name | Purpose | How long |
|---|---|---|
__Host-mb_session (cookie) | Staying signed in | Until you sign out, and at most 30 days |
__Host-mb_pending (cookie) | Tying the sign-in code to the window that asked for it | 15 minutes |
mb-lang, mb-prefs, mb-view:… (local storage) | Your language, your tool settings and where you were on a board | Stays in your browser until you clear it |
Security
Connections are encrypted (HTTPS). Passwords are stored only as scrypt hashes, sessions and sign-in codes only as SHA-256 hashes. HelderBoard runs shielded from other software on the server, with its own disk space and limits on requests, sign-in mails and attempts.
Your rights
- Access and portability: your account page shows your data and downloads everything as a ZIP (your boards as backups you can import again).
- Erasure: your account page deletes your account with all your boards and images. It leaves the backups within 21 days.
- Rectification: you edit your boards yourself. To change your email address, write to privacy@helderboard.tech.
- Objection and restriction: write to privacy@helderboard.tech. We answer within a month.
- Complaint: you can complain to the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or the authority in your own country.
Age
HelderBoard is meant for people aged 16 and over.
Changes
If we change this statement in a way that matters to you, we tell you beforehand in the app or by mail. The date at the top says which version applies.