Privacy Policy

Last updated: October 27, 2026

1. Introduction

East Agile ("Company", "we", "us", or "our"), a California corporation, operates East Agile Tracker at eastagiletracker.com ("Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

We are the data controller for the personal data we process through the Service. We are committed to protecting your privacy and handling your data in compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

2. Information We Collect

Account Information

When you create an account, we collect:

  • Name and display name
  • Email address
  • Password (stored in hashed form)
  • Organization or company name (if provided)

Usage Data

We automatically collect information about how you interact with the Service:

  • Pages viewed and features used
  • Actions performed (e.g., creating stories, updating projects)
  • Date and time of access
  • Browser type and version
  • Device type and operating system
  • IP address

Analytics Data

We use PostHog for product analytics. If you consent to analytics cookies, PostHog collects anonymized usage data to help us understand how the Service is used and how we can improve it. You can opt out of analytics at any time through your cookie preferences.

3. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

  • Contract performance: Processing necessary to provide the Service to you, including account management, project data storage, and customer support.
  • Legitimate interest: Processing necessary for our legitimate business interests, such as improving the Service, ensuring security, and preventing fraud, where these interests are not overridden by your rights.
  • Consent: Processing based on your explicit consent, such as analytics cookies and marketing communications. You may withdraw consent at any time.
  • Legal obligation: Processing necessary to comply with applicable laws and regulations.

4. How We Use Your Information

  • Provide, maintain, and improve the Service
  • Authenticate your identity and manage your account
  • Send transactional emails (account verification, password resets)
  • Respond to your support requests and inquiries
  • Analyze usage patterns to improve functionality and user experience
  • Detect, prevent, and address security issues and abuse
  • Comply with legal obligations

5. Third-Party Services

We share your information with the following third-party services, only to the extent necessary to provide the Service:

  • PostHog: Product analytics platform. With your consent, PostHog collects anonymized usage data. PostHog is configured to respect Do Not Track signals and cookie preferences.
  • Google Ads conversion measurement: Records that a visit led to a sign-up. Consent Mode keeps advertising storage denied until you accept non-essential cookies, and ad-click identifiers are redacted until then.
  • Google Analytics website measurement: Loaded by the same Google tag, not configured separately by us. It records the pages you view, your device type and language, and recognises a returning visitor for up to 400 days. Nothing is stored until you accept non-essential cookies.
  • Anthropic (Claude) AI assistant: Only when you connect Claude to your account. The results of the tools Claude calls (project and story data within your access) are sent to Anthropic and are governed by Anthropic's own privacy policy.
  • Honeybadger error monitoring: Receives reports of server errors: the error class, message and stack trace, the request path and method, and your member ID. It also receives reports of errors that happen in your browser while you use the app: the error message and stack trace, the page path (without the query string), the app release, your browser type, and your member ID if you are signed in. Request parameters, request bodies, form contents, session data and email addresses are not sent.

We do not sell your personal data to third parties. We share advertising and measurement data with Google Ads and Google Analytics only after you accept non-essential cookies.

Connected apps and AI assistants

You can connect a third-party app, such as Claude by Anthropic, to your account. A connected app acts as you across every project you belong to, with your own role permissions in each. Through a fixed set of tools it can read and write stories, comments, story owners, iterations, epics, project members and mentions. It can archive stories, but it cannot permanently delete anything.

Consent

Each connection requires your explicit approval on our consent page, which names the app and the account the access goes to. Your password, second factor or passkey is never shared with the app.

What we store

  • The one-time authorization code, stored as a SHA-256 hash. It expires after 5 minutes and can be used once.
  • The app's access token (an ea_mcp_ key), stored in hashed form. It expires after 30 minutes.
  • A refresh token, stored as a hash, that the app exchanges for new access tokens. It is replaced on each use and expires after 30 days.
  • The app's client identifier (the URL of its published metadata, whose name our consent page shows) and its redirect URI.
  • When the connection was created and when it was last used.
  • An entry in our security audit log when the connection is made, recording the app's client identifier.

Data sent to the connected app

When the app calls a tool, the result (project and story data within your access) is sent to that app and is then governed by the app provider's privacy policy. For Claude, see the Anthropic Privacy Policy. We receive only the tool name and the arguments of each call, not your conversation with the app.

Revoking access

You can see and revoke every connection under Account settings → Connected apps. Revoking a connection disables its access and refresh tokens, effective on the app's next request.

Retention

Used or expired authorization codes, expired refresh tokens and expired access tokens are deleted automatically by a cleanup job that runs every 5 minutes.

Logging

For each request a connected app makes, we log the request type, its outcome and the tool name, never the tool arguments or token values. If a tool call fails with a server error, we report the error, the tool name and your member ID to Honeybadger, our error monitoring provider.

6. Cookies

We use cookies and similar technologies to operate the Service. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

  • Account data is retained while your account is active, except as described below.
  • Project data (stories, comments, history) is retained while the associated project exists.
  • Usage and analytics data is retained for up to 24 months, then aggregated or deleted.

You may request deletion of your data at any time by contacting us at privacy@eastagile.com or by deleting your account through the Service settings.

Deleting your account takes effect at once. We delete your photo, password and other sign-in data, contact details and profile text. We remove your email address from your account and from sign-in, and the app never shows it again. Past project history records written while you were a member can still hold it; they stay with the organization's record. Your name stays on the records of the organizations and projects you worked in, with your past work (stories, comments, history), because those organizations need a record of who did what. They show you there as a former member, with no email address or photo. We keep phone verification records, to stop repeat sign-ups from the same phone number.

8. Your Rights Under GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights:

  • Right of access: Request a copy of the personal data we hold about you.
  • Right to rectification: Request correction of inaccurate or incomplete data.
  • Right to erasure: Request deletion of your personal data ("right to be forgotten"). Erasure covers your account and contact data; the work record that names you and the phone verification record are kept, as described in Section 7.
  • Right to data portability: Request your data in a structured, machine-readable format.
  • Right to object: Object to processing based on legitimate interest.
  • Right to restrict processing: Request that we limit how we use your data.
  • Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at privacy@eastagile.com. We will respond to your request within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. Your Rights Under CCPA

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

  • Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
  • Right to delete: Request deletion of your personal information, subject to certain exceptions. Deletion covers your account and contact data; the work record that names you and the phone verification record are kept, as described in Section 7.
  • Right to opt-out: Opt out of the "sale" of your personal information. Note: we do not sell personal information.
  • Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact us at privacy@eastagile.com. We will verify your identity before processing your request and respond within 45 days.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS) and at rest, access controls, regular security assessments, and employee training. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

11. International Data Transfers

Your data may be transferred to and processed in the United States. If you are located outside the United States, we ensure that appropriate safeguards are in place for international data transfers, including Standard Contractual Clauses approved by the European Commission where applicable.

12. Children's Privacy

The Service is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16. If we learn that we have collected personal data from a child under 16, we will take steps to delete that information promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and, where appropriate, by sending you an email notification. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:

East Agile
Email: privacy@eastagile.com
Website: eastagiletracker.com