This privacy policy outlines how Just Another Power-Up, owned and operated by Rokas Ulickas through MB “Kodas nuo nulio”, registered in Lithuania with company code 305146439 (“we”, “us”, or “our”), collects and uses your personal data when you use our website and our Trello Power-Ups: Just Another Label Sync, Email Inbox for Trello, Time Tracking for Trello, SLA Alerts for Trello, Client Forms & Portal for Trello, and our free Power-Ups Card Age, Card Priority and Checklist Front (together, the “Services”).
1. Our commitment to your privacy
Our core philosophy is built on the GDPR principles of data minimization and purpose limitation. We collect only the essential information required for specific, stated purposes to provide you with a functional and reliable service. We believe that a clear understanding of what information we collect, why we collect it, and how it is used is fundamental to building trust. This approach is consistent with regulatory requirements, such as the EU's General Data Protection Regulation (GDPR), which mandate that information related to data processing be provided in a concise, transparent, and easily accessible format, using clear and plain language.
2. Data we collect and how we use it
We never store the contents of your Trello cards — including descriptions, comments, or attachments — on our servers, and we do not keep a copy of your mailbox: an email shown on a card or in the Power-Up is loaded from Gmail each time, from a stored reference. There are five narrow exceptions, each listed in the table below and created only by something you do: a message you schedule to send later (held until it is sent), files you attach to an outgoing message (held until it is sent or cancelled), an AI summary you ask for, the card title recorded for reporting, which is usually the email's subject line, and — when you track time — the name of the card and the list the entry belongs to, so a report stays readable after a card is renamed or moved. Client Forms & Portal also keeps some of what your clients send through it, so they can see it again in their portal; its rows in the table below list exactly what. The information we collect is strictly limited to the following categories:
| Data type | Purpose of collection |
|---|---|
| Trello member IDs, workspace IDs, board IDs, and board names | To associate your Trello account with our Power-Ups, enable core service functionality (such as syncing labels between boards or creating cards from emails), manage your subscription, and facilitate customer support. |
| Your Trello name and email address | When you authorize a paid Power-Up, Trello gives us your full name and the email address on your Trello account. We read them again at most once a week, to catch a change. We use them to send you one welcome email per Power-Up when you start using it, to answer you when you contact support, to label your customer record at Stripe, and to show who you are in our product analytics (PostHog). We do not use them for newsletters or advertising. |
| Trello API token | Granted by you via Trello's OAuth flow and used only to perform actions you authorize (read boards, sync labels, create cards, etc.). The token is stored in our database so that automatic, webhook-triggered functionality can run even while you are not actively using the Power-Up. Using Disconnect Account revokes the token with Trello so it can no longer be used; you may also request erasure of the stored record by contacting us. |
| Google account connection (Email Inbox only) | When you connect Gmail to Email Inbox, we receive your email address and an OAuth grant used to show your mail inside Trello, send the replies you write, and archive, flag or mark messages when you ask. The connection credentials are stored securely and used only for these features. See section 3 for the full Gmail data commitments. |
| Email-to-card references (Email Inbox only) | Turning an email into a card stores a reference (link) to that email, the list of people you have chosen to share it with and what they may do (read, reply, or compose), and the card's own state — whether it is snoozed until a chosen time, and whether you marked it as needing no reply. The email's contents are not stored; they are loaded from Gmail when an authorized person opens the card. |
| Messages you schedule to send later (Email Inbox only) | Choosing “send later” stores the message you wrote — recipients, subject, body and any files you attached — so that it can be sent at the time you picked without your browser being open. Attached files are deleted as soon as the message is sent or cancelled, and unused ones are removed automatically after 48 hours. |
| AI drafts and thread summaries (Email Inbox only) | When you press “Suggest reply” or ask for a summary, the relevant part of that email thread is sent to Google's Gemini API to produce the text, and the resulting summary is stored so the same recap is shown on the card and in the reader. This happens only when you ask; nothing is drafted, summarized or sent on its own. See section 3. |
| Contact suggestions (Email Inbox only) | The names and email addresses of people your connected mailbox has written to or heard from, taken from the headers of mail the Power-Up already loads for you, so that addressing a new message can offer suggestions. No additional Google permission is used to obtain them, and they are never used to contact anyone. |
| Text you write into the Power-Up (Email Inbox only) | Your reply templates, the auto-reply message you configure, and the company context and reply guidelines you give the AI are stored as part of your configuration, so they are available on every board and mailbox you use. |
| Time entries (Time Tracking only) | When you start a timer or add time by hand, we record who tracked it, the card, list and board it belongs to, the date and duration, and any note you typed. The name of the card and of the list are stored alongside the identifiers so that a report you run months later still reads correctly after a card has been renamed, moved or archived. This is the record the reports, the timesheet and the CSV export are built from. |
| Estimates and workspace settings (Time Tracking only) | An estimate you set on a card, and the workspace's own preferences — time format, date format, first day of the week, CSV separator, and how long a forgotten timer may run before it is closed automatically. Report views you save, and your own display preferences, are stored too. |
| Clients, rates and budgets (Time Tracking only) | The clients a workspace adds: a name, an hourly rate and its currency. Which client a board or card belongs to, a budget in hours or money you set on a card, and whether a time entry is billable. Reports use these to show amounts. |
| Your timezone (Time Tracking only) | Read once from your browser's own setting so that a day and a week start when they start for you, rather than asking you to pick from a list. It is used for nothing else. |
| Card move history (SLA Alerts only) | On a board where a member turns tracking on, which card entered which list and when it left, so every card can show how long it has been in its list and be measured against the time limits you set. When tracking starts, the board’s recent activity (up to 90 days) is read once to date the cards already there. We do not store card titles or descriptions. For each card under a limit we keep where it stands (due soon, over) and when an alert was sent, so no card is alerted twice. Limits, working hours and time zone are stored per board. |
| Alert connections (SLA Alerts only) | The Trello authorization of the member who turns tracking on, used to receive the board’s card moves, and of the member who saves each limit, used to post that limit’s comments, which Trello shows as that member’s action. We also keep the Trello username of the member who saves each limit, so that a card with no members of its own can still mention them; to mention a card’s members we read their usernames from Trello when an alert is sent. If you add a Slack incoming webhook to a limit, its address is used only to post that limit’s alerts. Authorizations and webhook addresses are stored encrypted. |
| Forms you build (Client Forms & Portal only) | Each form’s title, introduction, questions, thank-you text and card settings (list, labels, members, card name), the address that is notified of new answers, and the Trello authorization of the member who published it, stored encrypted, because cards from that form are created as that member. |
| Answers sent through a form (Client Forms & Portal only) | An answer becomes a Trello card on your board, and files are attached to that card. Files pass through our server in memory only and are never written to disk or to our database. For each answer we keep a record: the form, the card it became, whether that worked, the sender’s email address if the form asks for it, and a one-way hash of the sender’s IP address, used only to limit answers per visitor and stop abuse. The IP address itself is not stored. When the sender gets a portal link, we also keep a copy of their own answers, so they can read them in the portal without seeing the card’s description. |
| Your clients and their portal (Client Forms & Portal only) | For each client a workspace adds or who fills in a form with a client email question: their email address, a name if given, a hash of their private link (never the link itself), whether they want email updates, when they last opened the portal, and which cards have been shared with them. A client does not need a Trello account. Per board we store the stages you named, which list shows which stage, and the board webhook used to notice card moves, with the Trello authorization it runs under stored encrypted. |
| Messages and approvals (Client Forms & Portal only) | Messages between your team and a client about a card: the text, the names of attached files (the files are card attachments), who wrote it and when. Each message is also added to the card as a comment. For an approval request: your question, which card files the client may see, where the card moves on each answer, the client’s decision and comment, the names of files they attached, a hash of their IP address, and when they opened the request and were reminded. |
| Reporting data (Email Inbox only) | For each conversation turned into a card: the card, board and list identifiers, the list's name, the card's title as it was created (which is usually the email's subject line), the Trello member who replied, and the times the first message arrived, the first reply was sent, and the card was archived. This is what the Reports tab is built from; it contains no message bodies. |
| Automation and sync configuration | Trello webhook identifiers created on your behalf, your configured source and target boards and sync preferences (Label Sync), and your Gmail search queries and destination lists (Email Inbox automations), to run the automatic features you set up. Some client-side display preferences are kept in Trello's private member storage. |
| Email address, Stripe customer ID, and subscription ID | To process subscription payments, manage your account, send billing-related emails (trial reminders, payment confirmations, failed payment notices), and prevent fraudulent transactions. We use a third-party payment processor and do not store credit card numbers on our servers. |
| Install-link clicks | When you click an install button on justanotherpowerup.com, we record the page you first arrived on, the domain of the website that sent you there, and any campaign tags in the link you followed (for example utm_source or an ad click identifier). We also set one cookie, jap_click, on trello-powerups.recodin.lt for 30 days. It holds only a random identifier for that click. If you then use one of our Power-Ups, the click is linked to your Trello member identifier, so we can tell which pages, articles and ads bring people who go on to use the Power-Ups. The cookie is set by us, not by an advertising network, and the click data is never shared with advertising platforms. |
| Launch notices | If you ask to be told when a Power-Up is available, we store the email address you typed, the page you asked from and the date. As with install-link clicks, we also keep the page you first arrived on, the website that sent you and any campaign tags. We use the address to send you that one message, and we email ourselves a copy when you ask. No cookie is set. |
| Email Inbox activity per board | For each board, the Trello member identifiers of the people who used Email Inbox there and when they last did. Email Inbox is priced per active member (someone who used it on the board in the last 30 days), so this is how the number of members billed is counted. |
| Free Power-Ups | Card Age and Card Priority send nothing to our servers; their settings are kept in Trello's own storage. Checklist Front keeps its settings in Trello too, and sends us usage events (described below) with your Trello member and board identifiers. |
| Support chat | Our website and the Power-Ups show a support chat run by tawk.to. What you type into it, and the name or email address you give it, are sent to tawk.to so that we can answer you. A chat started inside a Power-Up is tagged with that Power-Up's name. |
| Product usage events and feedback | Records of which features were used and when (for example “a card was created” or “a reply was sent”), stored with your Trello member and board identifiers so we can see whether the Power-Ups work as intended. They never contain email or card content. These events are kept in our own database and also sent to PostHog, our product-analytics processor, on servers in the European Union (section 5). Along with them PostHog receives your Trello name and email address, your plan status, which of our Power-Ups you use and how many mailboxes you connected, so that we can see which people a problem affects. If you send feedback through the Power-Up, we store your message and, if you provide it, an address to reply to. |
When you add one of our Power-Ups to your Trello board, we receive a unique, alphanumeric Trello member ID along with board and workspace identifiers. This data is essential for the Power-Up to function as intended.
For subscription payments, we use the third-party payment processor Stripe. When you provide your payment details, that information is sent directly to Stripe for processing. Stripe securely stores and manages your full payment information; it is never stored on our servers.
3. How we use your Gmail data (Email Inbox)
Email Inbox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
What we access. With your permission, and only in the mailbox you connect, the Power-Up reads: message headers (sender, recipients, subject, date), message bodies, attachments, labels and thread identifiers, and your account's own email address. It writes in two ways only: it changes three labels — UNREAD when you open a conversation, INBOX when you archive one, SPAM when you mark one as spam — and it sends messages you have written. It never deletes a message, never moves one to Trash, never applies your own labels, and never changes Gmail settings or filters.
What we keep. Message bodies and attachments are never stored on our servers. What we derive from your mail and do store is limited to: a reference (identifier) to the email a card was made from, a thread summary if you asked for one, the names and email addresses of people your mailbox has corresponded with (so the composer can suggest addresses), the card's title as created (usually the subject line), and the timestamps the Reports tab is built from. Section 2 lists each of these with its purpose, and section 8 says how long each is kept.
We use your Gmail access only to run the features you ask for — showing your mail inside Trello, sending the replies and messages you write, tidying messages (archive, spam, flags) when you ask, and creating the cards and automations you set up. We never sell your Gmail data, never use it for advertising, and never use it to train any AI model of ours. Your messages are sent through your own Gmail account — we do not operate our own mail service.
Messages sent without you pressing send: the Power-Up sends mail on its own in exactly two cases, both of which you switch on yourself: a message you scheduled with “send later”, and the auto-reply template you configured for a mailbox (first contact only, after the delay you set, and only to the senders you allow). You can cancel a scheduled message and turn auto-reply off at any time.
AI drafting and summaries: when you press “Suggest reply” or ask for a thread summary, we send the relevant messages from that thread — together with the company context and reply guidelines you configured — to Google's Gemini API, which generates the text and returns it to us. Google acts as our processor for that call; its handling of the content is governed by the Gemini API terms. We use the Gemini API on a paid tier, under which Google does not use the prompts we send or the responses it returns to improve or train its products, and does not have them reviewed by humans for that purpose. Google retains this content for a limited period solely to detect abuse of its API, as described in those terms. Your mail is never used to develop, improve or train any AI or ML model — ours, Google's, or anyone else's. This happens only on your explicit request, never in the background and never for automations or auto-replies. The generated draft is shown to you to edit and is not stored; a generated summary is stored so the same recap appears on the card and in the reader, and it is deleted when you disconnect that mailbox.
Who can see an email on a card: an email you turn into a card is visible only to you by default — its contents sit in a private part of the card, not the description, so other board members can't see it or even know it's there. You can open it up per card, or for a whole mailbox, to specific teammates or to the board, and choose whether they may only read it, also reply to it, or also compose new mail from that mailbox. Any of this can be revoked at any time.
You can disconnect a Gmail account at any time in the Power-Up's settings. This removes its connection immediately, along with the AI summaries built from that mailbox and any permission you gave others to send from it; you can also choose to delete its automations, pending scheduled messages and auto-reply settings in the same step. You can also revoke access from your Google account's security settings.
4. Our legal basis for processing your data
Under the GDPR, every instance of processing personal data must have a clear and established legal justification. We rely on the following lawful bases for our data processing activities:
Our primary legal basis for processing your Trello member ID, Google account connection, and payment information is contractual necessity. Processing this information is essential to deliver the subscription service you purchase from us. For example, without your Trello ID, we cannot link the Power-Ups to your account, and without processing your payment information, we cannot deliver the paid subscription service.
Client Forms & Portal. The forms, answers, clients, messages and approvals described in section 2 belong to the workspace that uses the Power-Up. For that data the workspace is the controller and we process it on its behalf, only to run the forms and the portal it set up. A client who wants their data seen, corrected or deleted can ask the workspace they work with, or write to us and we will pass the request on and carry it out.
We may also process limited operational data — such as webhook delivery records, error logs, and the usage events described in section 2 — for our legitimate interests in keeping the service reliable and secure, detecting abuse, diagnosing issues, and understanding which features are actually used. We never use it to build advertising profiles.
We use your Trello name and email address on the basis of our legitimate interest in helping new users get started and in supporting the people who use the Power-Ups: one welcome email per Power-Up, replies to your support requests, and knowing whom a problem affects. If you do not want the welcome email or want your name and address removed from our analytics, email rokas@justanotherpowerup.com.
We use Google Analytics on the basis of your consent, which you give by clicking Allow on the banner. You can withdraw it at any time with the Change your cookie choice button in section 2. Withdrawing stops the counting and removes the cookies.
We keep a launch-notice address on the basis of your consent, which you give by typing it in and pressing Get notified. You can withdraw it at any time by emailing rokas@justanotherpowerup.com, and we will delete the address.
5. Data sharing and disclosure
A core aspect of our privacy commitment is that we do not sell or share your personal information with third parties for their marketing or advertising purposes. Your data is not a product; it is a tool used solely to provide our service to you.
We only share your information with trusted third-party service providers when it is necessary for the operation of our business. These service providers act as data processors on our behalf and are bound by their own data privacy obligations:
- Trello / Atlassian — hosts the Power-Ups and provides the Trello API. See Atlassian's privacy policy.
- Google — the Gmail account you connect to Email Inbox, and the Gemini API that generates a reply draft or thread summary when you ask for one (section 3). See Google's privacy policy.
- Stripe — processes subscription payments. We never see your payment card details. See Stripe's privacy policy.
- PostHog — product analytics, hosted in the European Union. Receives the usage events described in section 2 (feature used, Trello member and board identifiers) and your Trello name, email address and plan status, never email or card content. See PostHog’s privacy policy.
- Amazon Web Services (AWS SES) — delivers transactional email, including the emails Client Forms & Portal sends to your clients (their portal link, stage changes, messages, approval requests and one reminder). See AWS privacy notice.
- Google Analytics (Google Ireland Limited) — counts visits to our website. Receives the pages you view, the links you click, your device and browser type and your approximate location, worked out from your IP address, only if you clicked Allow on the cookie banner. Google does not log or store IP addresses for Google Analytics 4 data from the European Union. See Google's privacy policy.
- tawk.to — runs the support chat on our website and in the Power-Ups. Receives what you type into the chat and any name or email address you give it. See tawk.to’s privacy policy.
No Gmail content leaves us except to Google. Message headers, bodies and attachments are sent only between your mailbox and the Power-Up, and — when you press “Suggest reply” or ask for a summary — to Google's Gemini API. Stripe, PostHog, AWS, tawk.to and Google Analytics never receive Gmail content of any kind, raw or derived; Stripe receives billing identifiers and your Trello email address, PostHog receives feature-usage events with your Trello identifiers, name and email address, and AWS delivers transactional email we send you.
In addition, we may be required to disclose your personal information in limited, legally mandated circumstances. This includes responding to valid court orders, subpoenas, or other lawful government requests. We may also disclose information to protect our rights, property, or safety, or those of our users, as permitted by law.
6. Your privacy rights (GDPR & CCPA)
Both the GDPR and CCPA provide you with significant rights regarding your personal information. To exercise any of the rights detailed below, please contact us at the email address provided in the “Contact us” section.
- Right to Know / Access: You have the right to request information about the personal data we have collected about you.
- Right to Deletion: You have the right to request the deletion of your personal data from our systems.
- Right to Correction: You have the right to request the correction of any inaccurate personal information we hold about you.
- Right to Data Portability (GDPR): You have the right to request a copy of your personal data in a machine-readable format.
- Right to Object & Restriction of Processing (GDPR): You have the right to object to our processing of your personal data under certain conditions.
- Right to Withdraw Consent and to lodge a complaint with a supervisory authority (in Lithuania, the State Data Protection Inspectorate).
Clicking Disconnect Account in a Power-Up's settings revokes your Trello token (and, for Email Inbox, disconnecting a Gmail account removes that connection); to have your stored records fully erased, email us and we will delete them. As we do not sell your personal information or collect sensitive personal data, certain rights under the CCPA (such as the Right to Opt-Out of Sale) are not applicable to our services. We will not discriminate against you for exercising any of your privacy rights.
7. Data storage and security
Data, including your Trello API token, Google account connection, and configuration, is stored in a PostgreSQL database hosted on infrastructure we operate in the European Union. We use industry-standard encryption (TLS 1.2+) for data in transit and standard database access controls, and connection credentials — including Gmail refresh tokens — are encrypted at rest with AES-256-GCM, under a key held outside the database. An email on a card is not stored — we keep only a reference that loads it from Gmail when an authorized person opens the card — and the five exceptions named in section 2 (a scheduled message and its attachments, an AI summary you asked for, the card title kept for reporting, and the card and list names kept on a time entry) live in the same database, under the same controls — as do time entries, estimates and workspace settings. Access to production data is restricted to the operator of the Services.
8. Data retention
We retain your personal data only for as long as is necessary to provide our services and for a reasonable period thereafter to comply with our legal and financial obligations.
- Subscription records are retained for the duration of your active subscription, and for up to 7 years afterwards to comply with applicable tax and accounting laws.
- Your Trello token, Google connection, webhook IDs, and configuration (sync groups, automations, email-to-card references, templates, auto-reply and AI settings, contact suggestions) are retained for as long as you use the Power-Ups, and are deleted on request.
- Files attached to an outgoing message are deleted as soon as that message is sent or cancelled; anything staged and then abandoned is removed automatically after 48 hours.
- A scheduled message is kept until it sends or you cancel it. Its record, including the text you wrote, then remains until you disconnect the mailbox with the delete option or ask us to erase it.
- AI summaries are kept until the mailbox they were built from is disconnected, or until you ask us to erase them.
- Your Trello name and email address are kept while you use any of our Power-Ups, and are deleted on request. We keep a record of which welcome emails were sent, so none is sent twice.
- Support chats are kept by tawk.to under its own retention, and are deleted on request.
- Time entries, estimates, clients, rates, budgets, Time Tracking settings and the timezone read from your browser are kept for as long as the workspace uses the Power-Up, so that historical reports and timesheets stay accurate, and are deleted on request. Ending a subscription does not delete them — the records stay readable and exportable — so ask us if you want them erased.
- SLA Alerts card move history, limits and working hours are kept while the board is tracked. Turning tracking off stops recording; ask us and we delete a board’s history. Deleting a limit deletes the authorization and Slack webhook address saved with it; the authorization that tracks the board is deleted on request.
- Client Forms & Portal data. Forms and their answer records are kept until the form is deleted, which deletes them too. Removing a client deletes their email address, name and link, their access to every card, the copies of their answers that no other client can open, and their messages and approvals. Deleting a card removes every client’s access to it. Everything else is kept while the workspace uses the Power-Up and is deleted on request. The
cp_portalcookie expires after 30 days. - Install-link clicks that are never linked to a Power-Up user are deleted after 90 days. A click linked to a member is kept for as long as that member's usage events, and is deleted on request. The
jap_clickcookie expires after 30 days. - Google Analytics data is kept for 14 months, then deleted by Google. The
_gaand_ga_NJ709488WZcookies expire after 2 years at most. - Launch-notice addresses are deleted once the notice is sent, and never kept longer than 12 months.
- Email Inbox activity per board is kept while the board uses Email Inbox, and is deleted on request.
- Reporting data and usage events are kept while you use the Power-Up so that historical reports stay accurate, and are deleted on request. The copy of the usage events held by PostHog follows that provider’s own retention, and is deleted on request too.
Once the applicable retention period has passed, the data will be deleted.
9. International transfers
Our primary infrastructure is located in the European Union. Some third-party providers (Stripe, AWS, Google, tawk.to) may process data in other regions, including the United States, under standard contractual clauses or equivalent safeguards.
10. Children
The Services are not intended for anyone under 16. We do not knowingly collect information from children.
11. Contact us
For any questions about this privacy policy or to exercise your privacy rights, please contact our support at rokas@justanotherpowerup.com. When submitting a request, please provide sufficient information to allow us to verify your identity and understand the nature of your request.
12. Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices or to comply with new legal requirements. When we make changes, we will post the updated policy on this page with a revised effective date. Material changes will be communicated via email to subscribed users where applicable.