Privacy
What Retroplis keeps, what it cannot read, and what it logs.
Your retros
Cards, votes, actions and notes are encrypted in your browser before they leave it. The
key lives only in the invite link, after the #, which browsers never send to
a server. Retroplis cannot read your retros and cannot recover them without the link.
Encrypted updates pass through a relay so teammates stay in sync, and are kept there for up to 90 days. Your own copy is stored in your browser.
Who can read a retro
Anyone holding the invite link can read and edit that retro. Cards stay hidden from teammates until the facilitator reveals them, but that is enforced by the app each person runs, not by encryption. Share links only with people you trust with the retro.
Signing in
Sign-in uses a one-time code sent to your email by Cloudflare Access, or your Atlassian account. Retroplis receives your email address and name so teammates can see who is in the retro, and sets a cookie that keeps you signed in for 30 days. Guests who join by invite link give a name and no email.
Jira
If you connect Jira, Retroplis keeps the connection in a cookie in your browser, encrypted so only Retroplis can read it. When you send actions to Jira, the action text, owner and due date go to your Jira site. Retroplis keeps no copy. Disconnect any time from the wrap-up.
What is logged
The hosting platform records request details such as time, address and the page requested, for running and securing the service. This never includes retro content. There are no advertising or analytics trackers, and nothing is sold or shared.
Removing data
- Remove a retro from your device from its menu. Teammates keep their own copies.
- Relayed updates expire on their own after 90 days.
- Clearing site data for retroplis.app removes everything stored in your browser.