Privacy Policy
Last updated: October 5, 2026
Talvedo is an issue tracker for product development teams, available at talvedo.com. This policy explains what personal data Talvedo processes, why, who else handles it, how long it is kept and how you can exercise your rights.
Who we are
Talvedo is built and run by the same small independent team that makes makermap. We have not yet incorporated a company. The registered entity and governing law will be named here once one exists. Until then, you can reach us about anything in this policy at [email protected].
Our role
- For the accounts of people who use Talvedo (name, email, settings, sign-in sessions), we decide how the data is used and act as the controller.
- For the content a workspace keeps in Talvedo (projects, issues, comments, attachments and the people mentioned in them), and for the email addresses of people who subscribe to a workspace's public changelog, the organization that owns the workspace is the controller. We process that data on its behalf and on its instructions, as a processor. Requests about that data are best sent to the organization; if you write to us, we will pass them on.
What we collect
- Account data: your email address, the name you enter, and your preferences (language, time zone, time format, theme, notification settings).
- Sign-in data: one-time sign-in codes and links (we store only their hashes), and for each session the IP address, browser user agent and time of last activity, so you can see and end your sessions.
- Workspace content: everything you and your team put into Talvedo: workspaces, projects, issues, comments, attachments, sprints, releases, plans and time records.
- Integration data: if your workspace connects Jira, GitHub, Slack or a calendar, the data needed for that connection (for example access tokens, which we store encrypted, or a calendar feed link) and the information those services send to Talvedo.
- Changelog subscribers: if you subscribe to a workspace's public changelog, your email address and whether you confirmed or unsubscribed.
- Technical logs: our servers record requests (IP address, time, address requested, browser) for security and troubleshooting.
We do not use analytics or advertising trackers, and we do not buy data about you from others.
Why we use it and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account, signing you in and providing Talvedo to you and your team | Performance of a contract (Art. 6(1)(b)) |
| Sending the email described below in "Email we send" | Performance of a contract; for changelog subscriptions, the subscriber's consent, collected by the workspace with a confirmation email |
| Keeping the service secure, preventing abuse and fixing errors | Our legitimate interest in a safe, working service (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not sell personal data, we do not use it for advertising, and we do not use your content to train AI models.
Who else processes data
- Hosting: Talvedo and its database run on our own server rented from netcup GmbH in Germany (EU). Workspace content, accounts and files are stored there.
- Email delivery: Amazon Simple Email Service (Amazon Web Services EMEA SARL), EU - Frankfurt region (
eu-central-1). It receives only the recipient's address and the message itself, in order to deliver it. - Our mailboxes: email to addresses at talvedo.com (such as support and privacy requests) is kept on our own mail server in Germany (EU).
- Services you connect: when a workspace connects Jira, GitHub, Slack or a calendar, data moves between Talvedo and that service as the workspace has set it up. Those services are chosen by the workspace and their own terms apply.
AI-assisted features are off by default and can only be turned on by a workspace administrator. Today they run on rules inside Talvedo and send no content to an AI provider. If that changes, we will name the provider here before it is used.
We store and process data in the European Union. We do not transfer it outside the EU ourselves.
Email we send
We only send email that is needed to use Talvedo: sign-in codes and links you request, invitations from your team, notifications about activity in your workspace that you have not seen in the app (such as mentions, replies and assigned issues; you choose which of them reach you by email in your profile), a notice when a workspace data export you requested is ready, and occasional notices about the service itself, such as changes to our terms or this policy. If a workspace publishes a public changelog, people who subscribe to it get a confirmation email first and release notes from that workspace only after confirming; every release email has an unsubscribe link. We do not send newsletters or marketing email, and we never sell or share email addresses for that purpose.
Sign-in codes are sent only when someone requests one on the sign-in form; if you receive one you did not request, you can ignore it - nobody can sign in without it.
Email is delivered by Amazon Simple Email Service (Amazon Web Services EMEA SARL, EU - Frankfurt).
Questions about your data: [email protected]. To report abuse: [email protected].
Cookies and local storage
Talvedo sets only cookies that are strictly necessary for it to work:
| Name | Purpose | Lifetime |
|---|---|---|
tv_session | Keeps you signed in. Not readable by scripts on the page. | 30 days from your last activity, at most 90 days |
tv_csrf | Protects your requests from being forged by other websites. | Until you close the browser |
Your browser's local storage keeps a few preferences on your device only: theme, interface language, unsent comment drafts and the list you opened an issue from. This data is not sent to us. There are no analytics, advertising or third-party cookies.
How long we keep data
- Account data is kept while you have an account. When you ask us to delete your account, we remove your personal data from the account and your name in shared workspace content is replaced with "Deleted user".
- Workspace content is kept while the workspace exists. When its owner asks us to delete the workspace, its content is deleted.
- Sign-in codes expire after 10 minutes. Sessions end after 30 days without activity and after 90 days at most.
- Changelog subscriptions are kept until you unsubscribe or the workspace removes them.
- Technical logs are kept only as long as needed for security and troubleshooting.
- Backups may contain deleted data until they expire.
Your rights
Under the GDPR you can ask us to:
- give you access to your personal data and a copy of it;
- correct data that is wrong (you can change your name and preferences in your profile yourself);
- delete your data;
- restrict or object to how we use it;
- hand your data over in a portable format (workspace owners and administrators can also export the whole workspace from its settings).
To use any of these rights, write to [email protected] from the email address of your account. We will reply within one month. If the data belongs to a workspace's content, we may refer you to the organization that owns the workspace, as it decides about that data.
You also have the right to lodge a complaint with a data protection supervisory authority in the EU country where you live or work.
Security
Data travels only over encrypted connections (HTTPS). Workspaces are isolated from each other in the database, sign-in codes and access tokens are stored as hashes, and integration secrets are encrypted.
Children
Talvedo is a tool for work and is not intended for children under 16.
Changes to this policy
When we change this policy, we update the date at the top of the page. If a change materially affects how we use your data, we will tell account holders before it takes effect.
Contact
- Privacy and data requests: [email protected]
- Support: [email protected]
- Abuse and spam reports: [email protected]