Legal

Privacy Policy

ProjectBook is built for collaborative design-thinking work. This policy explains what information the service handles, why it is used, how cookies support core product behavior, and what choices users and deployment operators should review before a production release.

Last updated April 5, 2026
This page is a branded ProjectBook template based on the current repository behavior. It should be reviewed by legal counsel before production use.

Scope and purpose

Back to top

This Privacy Policy describes how ProjectBook handles information when people sign in, create accounts, collaborate in workspaces, and use project tools across the application.

It is written for the current ProjectBook repository, which is a SvelteKit application with account authentication, workspace collaboration, project artifacts, and browser cookies that support sign-in, notices, sidebar preferences, and scoped demo state.

If a specific deployment of ProjectBook adds third-party services, integrations, or regulatory disclosures that are not present in this repository, that deployment should publish supplemental privacy details.

Information ProjectBook may collect

Back to top

ProjectBook may handle information that users provide directly, information created while using the product, and limited technical data needed to secure and operate the service.

The current repository behavior supports the following categories of information.

Account and profile information

Examples include name, email address, login credentials, account verification state, and password-reset related records.

Workspace and project content

Examples include projects, stories, journeys, problem statements, ideas, tasks, feedback, pages, resources, calendars, notifications, invites, and other collaboration records users create or view in the product.

Authentication and security data

Examples include session identifiers, verification tokens, reset tokens, rate-limit events, request IDs, and security-related metadata used to prevent abuse or maintain access control.

Browser, device, and usage context

Examples include IP-based request limiting, browser cookie state, navigation context, and preference information needed to keep the interface usable.

Cookies and browser technologies

Back to top

ProjectBook uses cookies and similar browser state to provide core application behavior. Some of these technologies are essential for authentication or state continuity, while others support interface preferences.

This repository does not currently include a separate cookie banner or preference center. Users can use browser controls to manage cookies, but disabling essential cookies may prevent sign-in or break core workflows.

  • Essential cookies support login, session continuity, and protected-route access.
  • Preference cookies support interface behavior such as sidebar state.
  • Cookie names, durations, and purposes should be reviewed again if the deployment model changes.

projectbook_session

An HTTP-only session cookie used to keep an authenticated browser signed in. In the current implementation, it lasts about 7 days by default or up to 30 days when the user selects remember me.

projectbook_auth_notice

A short-lived notice cookie used to pass one-time auth messages between pages, such as password reset or verification confirmations.

sidebar:state

A browser cookie used to remember whether the sidebar is expanded or collapsed so the interface returns in the preferred layout.

projectbook_scope_state*

Chunked HTTP-only cookies used by this repository's scoped demo state flow to persist workspace snapshot data for an authenticated session. The wildcard reflects multiple cookie chunks when larger state needs to be stored.

How ProjectBook may use information

Back to top

ProjectBook may use information to create and manage accounts, authenticate sessions, protect the application from abuse, and make workspace collaboration possible.

Information may also be used to render dashboards, load project artifacts, support password reset and email verification flows, enforce permissions, and preserve product state that users expect across requests.

Where a deployment adds support, operational teams may also use information to troubleshoot service issues, respond to support requests, maintain reliability, or comply with legal obligations.

How information may be shared

Back to top

Within the product, information is shared with authorized workspace or project participants according to account permissions, role assignments, and the pages they can access.

Outside the product, information may be disclosed when reasonably necessary to host, secure, maintain, investigate, or legally protect a ProjectBook deployment.

This repository does not describe selling personal information. If a production deployment introduces third-party processors, analytics, or other integrations, the operator of that deployment should disclose them clearly.

Retention

Back to top

ProjectBook retains information for as long as needed to operate the service, maintain account continuity, support collaboration records, and satisfy security or legal needs appropriate for the deployment.

In this repository's current demo and development setup, much of the application data is stored in memory and may reset when the server restarts. That behavior is an implementation detail, not a universal retention promise for future deployments.

Production operators should align retention schedules with contractual requirements, legal obligations, and the practical need to preserve workspace history.

Security

Back to top

ProjectBook uses reasonable technical measures in the current codebase to protect accounts and sessions, including password hashing, HTTP-only session cookies for core authentication, permission checks, and rate limiting.

No internet service can guarantee absolute security, and deployment choices matter. Operators should evaluate hosting, transport security, backup practices, access logging, and incident response procedures before using ProjectBook in production.

User choices and privacy rights

Back to top

Users may have choices regarding account information, cookie controls, and the content they create or remove inside the product, subject to organizational settings and legal obligations.

Depending on the jurisdiction and deployment, users may also have rights to request access, correction, deletion, or portability of certain personal information. ProjectBook does not make jurisdiction-specific promises in this template.

If a deployment collects personal information in ways that trigger additional notice, consent, or opt-out obligations, that deployment should publish the required disclosures and request-handling process.

Children's privacy

Back to top

ProjectBook is intended for professional, educational, or organizational collaboration use and is not designed as a service directed to children.

If an operator learns that personal information was submitted in a way that conflicts with applicable rules for children, that operator should review the submission and remove or remediate it as appropriate.

Policy updates and contact

Back to top

ProjectBook may update this Privacy Policy as the service, legal obligations, or deployment model changes. When that happens, the updated version should be posted with a new effective or last-updated date.

This repository does not publish a dedicated legal or privacy contact email. Questions should be directed through the support, administrator, or account-management channel made available in the relevant ProjectBook deployment until a specific legal contact is published.