Privacy Policy

1. What data IPOM collects

Account data — collected when you register or sign in:

• Email address — required. Used for authentication, transactional emails (password reset, email confirmation), and to identify your account. Stored in Supabase Auth.
• Display name— optional. If provided, stored in IPOM's database as User.name.
• Theme preference (light / dark / system) — stored per account, not personal in the privacy sense, but included for completeness.
• Google OAuth tokens— if you choose to sign in with Google, Supabase Auth receives and stores your OAuth tokens on IPOM's behalf. IPOM itself does not read or store these tokens.

Project and infrastructure data — entered by you while using the product:

• Project metadata: names, slugs, descriptions, status, priority, and date ranges.
• Resources: names, notes, and typed field values you enter. Field types include text, URLs, numbers, dates, and dropdowns. These fields are designed to hold references to external tools and services (for example, a GitHub repository URL or a Vercel deployment URL) — not live credentials. IPOM does not connect to those external services on your behalf; it only stores the strings you type. Do not store passwords, secret API keys, or other sensitive credentials in IPOM resource fields — there is no encryption-at-rest beyond what the database provider applies by default, and these fields have no access controls beyond project membership.
• Domain names associated with projects (for example, example.com).
• Documentation links: titles and URLs pointing to external documents (Notion, Google Docs, API docs, etc.).
• Notes: free-form text you write against a project.
• Tasks (todos): title, description, status, priority, due date, and an optional free-text assignee label. The assignee field is a plain text string — it is not linked to a user account and IPOM does not validate or cross-reference it.
• Team membership: which users are members of which projects, and their roles (Owner, Admin, Member, Viewer).
• Tags: names and colors you create to label projects.

Session data — IPOM uses a strictly necessary authentication cookie to keep you signed in. See the Cookie Policy for details.

2. How data is used

• To authenticate you and maintain your session.
• To store and display your projects, resources, tasks, documentation, and team information.
• To compute project health scores — an automated score derived from resource coverage, open task counts, domain configuration, and documentation completeness. No personal data is used in this calculation.
• To power global search across your projects and resources.
• To detect duplicate resources or shared infrastructure across projects.
• To send transactional emails: account confirmation and password reset. IPOM sends no marketing emails.

IPOM does not sell, share, or rent your data to third parties. Data you enter is used only to deliver the service to you and the other members of your project teams.

3. Where data is stored

All application data (accounts, projects, resources, tasks, notes, etc.) is stored in a PostgreSQL database hosted by Supabase on AWS infrastructure. Authentication data — including your email address, hashed credentials, and session tokens — is also managed by Supabase Auth, hosted in the same infrastructure.

Hosting region note: the specific AWS region in which the Supabase project is hosted is not recorded in this document — confirm from the Supabase dashboard before relying on this policy for a jurisdiction-specific compliance requirement (e.g. EU data residency).

4. Third-party processors

Two third-party services process data on IPOM's behalf:

• Supabase(supabase.com) — database hosting and authentication provider. Supabase stores your email address, hashed password (if using email/password sign-in), session tokens, and Google OAuth tokens (if using Google sign-in). Supabase's own privacy policy governs their handling of this data.
• Resend(resend.com) — transactional email delivery, configured as the SMTP provider in IPOM's Supabase project. When Supabase sends you an email (password reset, account confirmation), it routes that email through Resend. Your email address and the email body are passed to Resend for delivery. IPOM does not use the Resend SDK directly — Resend is a Supabase-level integration.

No analytics, advertising, tracking, or other third-party services are loaded or integrated in the IPOM application.

5. Data retention and deletion

Data is retained for as long as your account exists. IPOM does not currently provide a self-service account deletion feature. To request deletion of your account and associated data, contact privacy@ipom.se.

On deletion, your user record, project memberships, and any custom resource types you created will be removed. Projects you own will be deleted in full — including all resources, tasks, domains, documentation, and notes — unless other members exist on those projects. Projects where you are a member (but not the sole owner) will be retained for remaining members; your membership record will be removed.

Deletion requests will also be forwarded to Supabase to remove your authentication record from Supabase Auth.

6. Your rights

Depending on your location, you may have rights regarding your personal data, including:

• Access — request a summary of the personal data IPOM holds about you (email address, display name, project memberships).
• Correction — update your display name or email address from your account settings. Other corrections can be requested by email.
• Deletion — request deletion of your account and associated data (see Section 5).
• Portability — request an export of the data IPOM holds about you. Contact the address below.

This policy does not constitute legal advice and is not jurisdiction-specific. If you have GDPR, CCPA, or other regulatory requirements, consult a qualified professional before relying on this document for compliance.

7. Contact

Privacy questions, data access requests, and deletion requests can be sent to privacy@ipom.se. (This address is a placeholder — confirm or replace before publishing this policy.)

8. Changes to this policy

If material changes are made to this policy, the "Last updated" date at the top will be revised. Continued use of IPOM after a change constitutes acceptance of the updated policy.