Privacy Policy

We collect information in three ways: information you give us directly, information we collect automatically, and information we receive from third parties.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your identity and manage your account and session
• Enable team collaboration features including invitations, shared projects, and role-based access
• Process and store content you create within the platform
• Send transactional emails such as team invitations, password resets, and execution notifications
• Send product updates and announcements (you may opt out at any time)
• Analyse usage patterns to understand how the product is used and where to improve it
• Debug errors, diagnose technical issues, and maintain service reliability and security
• Detect and prevent fraud, abuse, and violations of our Terms of Service
• Comply with applicable legal obligations
• Respond to your enquiries and support requests

We do not sell your personal data. We do not use your content to train AI models that are shared externally.

If you are located in the European Economic Area or the United Kingdom, our legal bases for processing your personal data are:

• Contract performance: Processing necessary to provide the Service you have signed up for.
• Legitimate interests: Analytics, fraud prevention, security, and product improvement, where these interests are not overridden by your rights.
• Consent: Where we rely on your consent (e.g. marketing emails), you may withdraw consent at any time.
• Legal obligation: Where processing is required to comply with applicable law.

We do not sell, rent, or trade your personal data. We share information only in the following circumstances:

Your data is stored in a PostgreSQL database hosted on Supabase's infrastructure (AWS). All data is encrypted in transit using TLS/HTTPS. Data at rest is encrypted by our hosting providers.

We implement access controls, authentication requirements, and monitoring to protect against unauthorised access. Only authorised personnel have access to production data, and only when necessary to operate or support the Service.

Despite our best efforts, no security system is impenetrable. In the event of a data breach that affects your personal data, we will notify affected users and relevant authorities as required by applicable law, typically within 72 hours of becoming aware.

We retain your account data and content for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal, accounting, or fraud-prevention purposes.

Aggregate, anonymised analytics data (which cannot identify you) may be retained indefinitely for product improvement purposes.

Backup copies of data may persist for up to 90 days after deletion from our live systems.

We use the following types of cookies and similar technologies:

• Essential cookies: Required for authentication and core functionality. The Service cannot function without these.
• Analytics cookies: Set by PostHog to track usage patterns and session behaviour. You can opt out of analytics tracking by contacting us or using a browser extension that blocks PostHog.
• Preference cookies: Store your settings and preferences (e.g. last used sign-in method, column preferences) in browser local storage.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from signing in and using the Service.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Deletion: Request that we delete your personal data ("right to be forgotten").
• Portability: Request an export of your data in a machine-readable format.
• Restriction: Request that we limit how we process your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where we rely on consent, withdraw it at any time without affecting prior processing.
• Opt out of marketing: Unsubscribe from marketing emails at any time using the link in any email or by contacting us.

To exercise any of these rights, email us at privacy@goby.app. We will respond within 30 days.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA). You have the right to know what personal information we collect, to request deletion, to opt out of the "sale" of personal information (we do not sell personal information), and to non-discrimination for exercising your rights. To submit a request, contact us at privacy@goby.app.

Goby is operated from the United States. If you access the Service from outside the US, your data will be transferred to and processed in the US. For EEA and UK users, we rely on Standard Contractual Clauses (SCCs) with our service providers to ensure adequate protection of your data in accordance with GDPR.

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected data from a child under 16, please contact us immediately and we will delete it.

The Service may contain links to third-party websites or integrations. This Privacy Policy does not apply to those third-party services and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you use.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by displaying a prominent notice within the Service before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:

For EEA/UK data protection enquiries, you also have the right to lodge a complaint with your local supervisory authority.