Privacy Policy

1.1 Information You Provide Directly

• Feedback: When you submit feedback through our in-app feedback form, we collect the content of your submission (up to 5,000 characters) and your associated email address.

1.2 Information Collected Through Linear OAuth

When you authenticate with the Service using your Linear account, we receive and store:

• Identity Information: Your full name, email address, and Linear user ID.
• Authentication Credentials: OAuth 2.0 access tokens and refresh tokens issued by Linear, which allow the Service to access your Linear data on your behalf.

1.3 Information Collected From the Linear API

Through authorized API calls, we access and cache:

• Issue Data: Titles, identifiers, descriptions, due dates, priority levels, workflow states, team assignments, assignee information, labels, and sub-issue relationships for issues assigned to you.
• Workspace Metadata: Available workflow states and labels for your Linear teams.

We only access data that is visible to you within Linear based on your existing permissions.

1.4 Information You Create Within the Service

• Issue Schedules: When you schedule a Linear issue on your calendar, we store the scheduled start and end times, any title overrides, personal notes or annotations, completion status, and actual duration.
• User Preferences: Your chosen settings, including notification preferences (desktop and sound), timezone, calendar display density, and whether issue editing is enabled.

1.5 Information Collected Automatically

• Usage Analytics: We use PostHog to collect anonymized analytics data, including page views, feature interactions, and application errors.
• Activity State: We track whether your browser tab is active or inactive to manage notification delivery.
• Session Data: We maintain session cookies to keep you authenticated.
• Server Logs: Our servers may automatically record information such as your IP address, browser type, operating system, referring URLs, and timestamps of requests.

3.1 Linear

We exchange data with Linear's API as necessary to provide the Service. All communication with Linear's API occurs over encrypted HTTPS connections.

3.2 PostHog (Analytics)

We use PostHog for product analytics. PostHog receives anonymized usage data such as page views, feature interactions, and error events. Learn more at posthog.com/privacy.

3.3 Infrastructure Providers

Your data is stored on secure hosting infrastructure. These providers process data on our behalf under data processing agreements and are contractually obligated to protect your data.

3.4 Legal and Safety Disclosures

We may disclose your information if we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, or enforceable governmental request.
• Enforce our Terms of Service, including investigation of potential violations.
• Detect, prevent, or address fraud, security issues, or technical problems.
• Protect the rights, property, or safety of our users, ourselves, or the public.

3.5 Business Transfers

In the event of a merger, acquisition, reorganization, or bankruptcy, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership.

4.1 Essential Cookies

We use session cookies that are strictly necessary for the Service to function. These cookies cannot be disabled while using the Service.

4.2 Analytics

PostHog may use cookies or similar technologies to collect anonymized usage analytics.

4.3 No Third-Party Advertising Cookies

We do not use any advertising cookies, tracking pixels, or third-party ad networks.

4.4 Browser Permissions

The Service may request the following browser permissions:

• Notifications: To deliver desktop notifications about issue activity.
• Audio: To play sound notifications.

We do not request access to your camera, microphone, geolocation, or payment information.

5.1 Where Your Data Is Stored

Your data is stored in a PostgreSQL database hosted on secure infrastructure. OAuth tokens, user preferences, issue schedules, and cached Linear data are all stored in this database.

5.2 Security Measures

We implement multiple layers of security to protect your data:

• All data in transit is encrypted using HTTPS/TLS.
• HTTP Strict Transport Security (HSTS) is enforced in production.
• Content Security Policy (CSP) headers mitigate cross-site scripting (XSS) attacks.
• Cross-Site Request Forgery (CSRF) protection through origin and referer validation.
• Rate limiting on API endpoints to prevent abuse and brute-force attacks.
• Input validation using Zod schemas on all API endpoints.
• OAuth 2.0 tokens are stored server-side and never exposed to the client.

5.3 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users and relevant authorities as required by applicable law, without undue delay.

6.1 Active Accounts

We retain your data for as long as your account is active and as needed to provide the Service.

6.2 Account Deletion

When you delete your account through the Settings page, all user data is permanently deleted from our database immediately, including:

• Account and identity information
• OAuth access and refresh tokens
• Issue schedules and annotations
• User preferences and settings
• Cached Linear data
• Sync status and activity records

Your Linear OAuth token is also revoked and any pending background synchronization jobs are cancelled.

6.3 Server Logs

Server logs are retained for a limited period necessary for security monitoring and debugging, after which they are automatically purged.

6.4 Analytics Data

Anonymized analytics data collected by PostHog is retained according to PostHog's data retention policies and is not linked back to your identity after collection.

7.1 All Users

Regardless of your location, you have the right to:

• Access: View the personal data we hold about you.
• Correction: Update inaccurate personal information through your account settings.
• Deletion: Delete your account and all associated data at any time via the Settings page.
• Revocation: Revoke the Service's access to your Linear account at any time.
• Notification Control: Enable or disable desktop and sound notifications at any time.

7.2 EEA and United Kingdom Residents

If you are located in the EEA or UK, you have additional rights under GDPR and UK GDPR:

• Right to Data Portability
• Right to Restrict Processing
• Right to Object
• Right to Withdraw Consent
• Right to Lodge a Complaint with your local Data Protection Authority

7.3 California Residents

If you are a California resident, you have the following rights under CCPA/CPRA:

• Right to Know what personal information we have collected.
• Right to Delete your personal information.
• Right to Opt-Out of Sale — we do not sell your personal information.
• Right to Non-Discrimination for exercising your privacy rights.

Categories of Personal Information Collected (CCPA):

7.4 Exercising Your Rights

Use the Settings page to manage preferences or delete your account. For other requests, contact us at the address in Section 12. We will respond to verified requests within 30 days.