Privacy Policy

Who operates Typity and what this policy covers

Typity is operated by AngryPancakes LLC, an Oklahoma limited liability company (“Typity,” “we,” or “us”). This policy covers our website, application, and related services, including accounts, collaboration, subscriptions, and support. AngryPancakes LLC acts as a controller when we decide why and how to process personal information, including for account administration, billing, security, and our own support operations. When an organization determines the purposes of processing personal information in its workspace and we handle that information on its behalf, we act as its processor for that processing. That organization is responsible for its own privacy notices and instructions. The Data processing section of our Terms governs personal data we process on a customer’s behalf. You may contact the organization about its workspace content or contact us for help directing a request; this does not limit rights you can exercise directly against us. Questions and privacy requests can be sent to support@typity.com or by postal mail to AngryPancakes LLC, PO Box 21030, Oklahoma City, OK 73156-1030.

Information you provide

• Account and security information: your name, email address, profile information, preferences, workspace memberships, authentication records, and records of acceptance of our Terms of Use. Passwords are stored as one-way hashes. Two-factor authentication records, recovery codes, sessions, and integration authorizations help secure or connect your account.
• Your content: Boards, Kanban lists and cards, nodes, Details, Notes, folders, comments, connections, drawings, images, files, sharing choices, and related revisions and synchronization records. Content may include personal information about you or other people you choose to include.
• Billing information: subscription and payment status, customer and subscription identifiers, plan details, and transaction records. Stripe collects payment and billing details through its checkout and billing portal; Typity does not receive your full card number.
• Communications: support requests, feedback, and information you include when contacting us. Please provide only information needed to resolve your request.

Information collected automatically or from others

When you use Typity, we and our infrastructure providers process technical information such as IP addresses, browser and device information, request times, authentication events, errors, and resource usage to deliver and protect the service. Typity records product activity and aggregate usage counts to operate collaboration, understand feature use, and improve reliability. Our client diagnostic pipeline is designed to remove full page URLs and private content before upload; this does not mean infrastructure providers never process network addresses or request metadata.

If you choose Google sign-in, we receive the account identifiers and basic profile information Google provides for authentication, such as your name, email address, and profile image. Stripe supplies subscription and transaction information needed to manage your plan. Other users may provide your email address when inviting you or include information about you in shared content.

Local-first storage

Data from many features you use is copied into browser storage on your device so Typity can load quickly and support offline use. Depending on what you access, this can include Boards, Kanban content, Notes, Details, comments, workspace navigation, preferences, and cached images or files. Changes made offline are stored locally and queued for synchronization when the device reconnects and access is authorized. Not every feature or file is available offline.

Downloaded data can remain accessible in that browser while offline, including after a session expires. Explicit sign-out removes the account’s tracked offline replicas; you can also remove local data through your browser’s site-data controls. Uninstalling an app or closing a tab does not necessarily clear browser storage. Clearing local data can permanently discard changes that have not synchronized. Revoking access cannot remotely erase a disconnected device or copies someone has already exported. Ordinary browser storage relies on your browser profile and device security and is not encrypted by Typity’s optional Note-body encryption feature.

Cookies and similar technologies

We use cookies and browser storage to keep you signed in, secure accounts, remember preferences, and support local copies and offline operation. Providers involved in sign-in, payment, and abuse prevention may use their own cookies or similar technologies when you use those features. You can control cookies and site data in your browser, but blocking or removing them can prevent sign-in, synchronization, and other features from working.

We do not sell personal information or share it for cross-context behavioral advertising, and we do not use advertising trackers to follow you across unrelated websites. Typity does not change its necessary operational data collection in response to a browser’s Do Not Track signal. Global Privacy Control does not change these practices because we do not sell or share information for that advertising purpose.

How and why we use information

We use information to provide, personalize, and synchronize Typity; authenticate accounts; process subscriptions; deliver account, security, and activity messages; answer support requests; understand feature use and improve the service; detect fraud and abuse; diagnose failures; maintain backups; enforce our terms; and meet legal obligations. Marketing email is optional and can be disabled in account settings or through a message’s unsubscribe control. Opting out of marketing does not stop essential account, billing, security, or legal notices.

Legal grounds for processing

Where European Economic Area, United Kingdom, or similar data-protection law applies, we rely on the following grounds as appropriate: performing our agreement with you to provide the service and manage subscriptions; our legitimate interests in securing, maintaining, and improving Typity and responding to support requests, balanced against your rights; compliance with legal obligations; and your consent where required, such as for optional marketing. Where we rely on consent, you may withdraw it at any time without affecting processing that was lawful before withdrawal.

Sharing and collaboration

Workspaces are private by default. Workspace members can access information according to their role. Sharing a Board, Note, or branch gives recipients access within the scope you choose; shortcuts do not grant access by themselves. Collaborators may see your name, contributions, comments, activity, and live presence or editing updates. Invitations and membership management may require account contact information. Review the audience before sharing personal information.

People with access can copy or export information they can view. Removing a share or deleting your account does not remove copies they already made or necessarily erase contributions to shared work. If you use Typity through an organization, that organization may make its own decisions about access to, use of, and retention of its workspace content.

Service providers and connected services

We disclose information needed to operate the service to providers: Cloudflare supplies hosting, databases, file storage, live collaboration infrastructure, and security, including signup abuse protection; Amazon Web Services supplies email delivery and, where configured, offsite backup storage; Stripe processes payments and manages subscriptions; and Google supplies optional sign-in. Authorized personnel and contractors may access information as needed for operations, support, security, or legal compliance.

Providers process information under their applicable agreements and privacy terms. Some, including payment and sign-in providers, also process information for their own legal, security, or account purposes. When you authorize an integration, including an AI assistant or other connected client, it can receive data and perform actions within the permissions you grant. That service’s handling of received data is governed by its own terms and privacy policy. Revoking an integration stops future authorized access but does not retrieve data already sent to it. External websites linked from Typity have their own privacy practices.

Other circumstances in which information may be disclosed

• Legal and safety needs: when reasonably necessary to comply with applicable law or valid legal process, enforce our agreements, investigate abuse, or protect the rights, property, or safety of users, Typity, or others.
• Business changes: in connection with a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, subject to applicable confidentiality and legal protections. A recipient must handle personal information consistently with this policy unless a change is permitted by law and the required notice or consent is provided.
• At your direction: when you ask us to disclose information or give consent.
• Aggregate information: statistics that do not reasonably identify you may be used or disclosed to describe service usage and performance.

Security and Note encryption

We use safeguards such as encrypted HTTPS connections, access controls, account protections, and operational monitoring to protect information. No service, transmission, or storage system can be guaranteed completely secure. Protect your devices, account credentials, and recovery codes, particularly on shared computers.

Optional Note encryption encrypts a Note’s body in your browser. It does not encrypt an entire workspace: titles, placement, sharing metadata, and other information needed to operate the service remain readable. Boards, Details, comments, separately stored files, and unencrypted Notes are not covered by Note-body encryption. Earlier unencrypted revisions or backups may remain subject to retention. Keep your Note passphrase or recovery key safe; we cannot recover an encrypted body without an appropriate key.

Retention, export, and deletion

We retain information for as long as reasonably needed for the purposes described here, taking account of the type of information, account status, collaboration and recovery needs, and legal requirements. Client diagnostic events are normally retained for up to 30 days. Successfully delivered in-app support requests are retained for up to 365 days; pending or failed requests may be retained longer for delivery or resolution. Those periods do not set the retention of separate email correspondence or providers’ records.

Workspace content, revisions, activity, synchronization records, and deletion records may remain while needed for offline synchronization, collaboration, history, security, and recovery. Database backups can contain deleted content: daily snapshots are retained for up to 121 days, monthly snapshots for 365 days, and annual snapshots for up to three years. Separately stored files, images, and revision payloads remain in offsite recovery storage for a 90-day recovery window after their removal from primary storage is confirmed. Archiving content does not start that window. Expiration is performed by scheduled cleanup and can be delayed by immutable-storage locks, legal holds, or a failure that prevents safe verification of source deletion. Restoring an older database backup does not guarantee that expired files or images can be recovered. We may retain records needed for taxes, accounting, fraud prevention, disputes, or legal obligations after an account closes.

Account settings offer a content export for workspaces you own and a separate export of account-specific records. Item Settings offer individual Board, Kanban, and Note exports. You choose whether to include content, metadata, and attachments. Encrypted Note bodies remain encrypted. Before deleting an account, you must resolve ownership of every workspace you own, such as by deleting the workspace or transferring ownership where available. Account deletion removes credentials, sessions, personal access records, client diagnostics, and in-app support records. Shared history may retain your contributions and an internal identifier displayed as “Deleted user,” and content you contributed to other people’s workspaces may remain. Replacing a name does not necessarily make these records anonymous; their content or context may still identify you. Deletion cannot remove independently retained copies held by recipients or disconnected devices.

International processing

AngryPancakes LLC is based in the United States. Typity and its providers may process and store information in the United States and other countries where they operate, whose privacy laws may differ from those where you live. Transfer safeguards depend on the provider, the countries involved, and applicable law. Cloudflare’s Data Processing Addendum and AWS’s data-protection terms include European Commission Standard Contractual Clauses and UK transfer provisions for transfers covered by those terms. Those are contractual safeguards, not a promise that information stays in your country. Payment and sign-in providers may also process information as independent controllers under their own privacy terms. The Data processing section of our Terms is the standard agreement for customer-directed processing. Contact support@typity.com to ask which processing locations and transfer arrangements apply to your information, or when additional transfer clauses are required. Using Typity does not waive your statutory privacy rights.

Your choices and privacy rights

You can update available profile settings, manage notification and marketing preferences, revoke sessions and integrations, enable two-factor authentication, manage shares, export account records, and request account deletion. You may choose not to provide optional information; some information is necessary to create an account or use a particular feature.

Depending on your location and applicable law, you may have rights to know or access the personal information we hold, obtain a portable copy, correct inaccuracies, request deletion, restrict or object to processing, withdraw consent, and opt out of certain uses or disclosures. California and other United States residents may have applicable rights concerning categories of information collected, sources, purposes, recipients, and sale, sharing, or targeted advertising. The sections above describe these practices; we do not sell personal information or share it for cross-context behavioral advertising. We will not unlawfully discriminate against you for exercising a privacy right.

Send requests to support@typity.com or the postal address above. We may verify your identity and, where applicable, an authorized agent’s authority using information proportionate to the request. Do not send passwords or recovery keys. We respond within the time required by applicable law, explain applicable exceptions or extensions, and provide reasons if we cannot fulfill a request. If an appeal right applies, reply to our response requesting an appeal. You may also complain to your local privacy regulator, including an EEA supervisory authority or the UK Information Commissioner’s Office where applicable.

Children

Typity is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Where local law requires a higher age or parental authorization, that requirement also applies. Contact us if you believe a child has provided personal information in violation of these requirements so we can investigate and take appropriate action, including deletion where required.

Policy updates

We will publish revisions here with an updated effective date. For material changes, we will provide additional notice as appropriate, such as an in-app notice or email, and obtain consent when legally required. A policy update does not remove rights you have under applicable law.