The short version
- We collect what we need to run your workspace and bill you, and nothing for advertising.
- There are no analytics or advertising trackers on trainyard.app and no tracking cookies.
- Card details go straight to Stripe; we never see or store your card number.
- We don't sell or rent personal information.
- You can export your workspace at any time and ask us to delete it.
Who is responsible
Agile Agilist Inc. operates trainyard.app and is responsible for the personal information described here. For the content of a workspace (boards, plans, class work), the customer who owns the workspace decides what goes in it; we process that content on their behalf. Questions about privacy: .
What we collect
Account and sign-up
Your name, email address and company when you sign up or are invited; a password if you choose one (stored only as a salted scrypt hash, never in readable form); your role in the workspace; and a one-time code we email you to confirm your address.
Students in a class
When a trainer adds students to a class, we store each student's name and email so we can send them their personal link and show their name on the class board. Students don't create an account or a password.
What you put in Trainyard
Boards, sticky notes, plans, objectives, risks, class exercises, files and anything else you or your team add. If you connect Jira, Azure DevOps, Miro, Lucid, Mural, Trello or monday.com, we store the access tokens encrypted (AES-256-GCM) and the items we sync.
Payments
For paid plans: your plan, number of seats, billing interval and the status of your subscription and invoices. Stripe collects your card or bank details directly; we receive only a customer reference and the status of your payments.
Technical information
Our servers log each request with its time, address (URL) and the IP address it came from, to keep the service secure, limit abuse and fix problems. Your browser keeps your sign-in key and your current workspace in its local storage so you stay signed in; nothing else is stored on your device.
Booking a session
If you book a demo, support or billing call, the booking is made in Google Calendar, which collects the name, email and any note you enter and sends the invitation.
Writing to us
If you email us, we keep the conversation so we can help you and refer back to it.
Why we use it
- To provide the service you signed up for: running your workspace, sending sign-up codes, class links and the emails the product needs. This is necessary to perform our contract with you.
- To bill you and meet tax and accounting obligations: subscriptions, invoices, trial confirmations and the reminder before your first charge.
- To keep Trainyard secure and working: preventing abuse, investigating problems, backups. This is our legitimate interest in running a safe service.
- To answer you when you contact support or book a session.
We don't use your workspace content to train AI models. If your workspace uses the optional AI assistant, the text you ask it about is sent to the AI provider for that request only (see below).
Who processes it for us
We use a small number of service providers, each only for the job listed and under their own data protection terms:
- Hostinger: the virtual server that runs Trainyard and stores its database.
- Cloudflare: DNS and network protection in front of trainyard.app.
- Stripe: payments, invoices and the customer billing portal.
- Postmark: sending account, class and billing emails.
- Google Workspace: our email, and Google Calendar for booked sessions.
- Anthropic, only when the AI assistant is turned on for a workspace: processes the prompts sent to it.
Some of these providers process data outside your country, including in the United States. Where the law requires it, we rely on their standard contractual safeguards for those transfers. We may also disclose information when the law requires it, or to protect the rights and safety of our users or the public.
How long we keep it
- Workspace content and accounts: for as long as the workspace exists. When a workspace is deleted, its content is removed from the live service within 30 days and from backups as they roll over.
- Student names and emails: until the trainer removes the student or the class is deleted.
- Billing records: as long as tax and accounting law requires, usually seven years.
- Server logs: kept for a short period for security and troubleshooting, then deleted.
Your choices and rights
Depending on where you live (for example under Canada's PIPEDA, the EU and UK GDPR, or US state privacy laws), you can ask to see the personal information we hold about you, correct it, export it, delete it, or object to or restrict how we use it. Workspace owners can export everything from Plan & billing at any time. For anything else, write to ; we answer within 30 days. If you are a student or a member of someone else's workspace, we may refer your request to the workspace owner, who controls that content. You can also complain to your data protection authority, such as the Office of the Privacy Commissioner of Canada.
Security
Traffic to trainyard.app is encrypted with HTTPS. Passwords are hashed, integration tokens are encrypted at rest, each workspace is kept separate, and access is limited to what each role needs. No service is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires. To report a vulnerability, email [email protected].
Children
Trainyard is a professional tool for teams and trainers. It is not meant for children under 16, and we don't knowingly collect their information.
Changes
If we change this policy in a way that matters, we'll update the date at the top and tell workspace owners by email before the change takes effect.
See also the terms of service.