Privacy

Privacy policy

Tidigar is built so that your roadmaps reach us only if you choose Tidigar Business. This page explains what that means in the web app, in the apps for iPhone, iPad and Mac, on our websites, when you make an Apple purchase and in Tidigar Business.

Last updated 29 October 2026.

Who we are

Tidigar is made by Hamacher Software AB, a Swedish company (organisation number 556665-2219), which is responsible for the personal data described here. Questions about privacy and personal data go to privacy@tidigar.com.

In short

• Without Tidigar Business, you need no Tidigar account and we never receive your roadmaps. They stay in your browser, your iCloud, your files and your calendars.
• In Tidigar Business we store your organisation's roadmaps and your account in the EU, each organisation in its own separate storage, on the organisation's behalf. You can view and download your account data and delete your account yourself.
• With Tidigar Server, your roadmaps stay on your own server, which never contacts us.
• The apps contain no analytics, advertising or tracking.
• Our websites count visits without cookies.
• Purchases in the apps are handled by Apple, and we never see your payment details.

Your roadmaps

In the web app at app.tidigar.com, a roadmap is saved in that browser's own storage on your device. It stays there until you delete it or clear the browser's data.

The apps keep roadmaps in your own iCloud Drive when iCloud is available, otherwise on the device. You can also open and read a roadmap file where it lies, for example in iCloud Drive, OneDrive or Dropbox, or keep a roadmap in a calendar. That file or calendar then stays with the service you chose, under that service's terms, and Tidigar reads and writes it from your device.

The apps ask for access to your calendars only when you turn on calendar storage. Tidigar then reads and changes only calendars that hold a Tidigar roadmap, or a new calendar it creates for one. Other calendars and events are left alone.

Share links and embeds

A share link carries the whole plan after the # in the address. Browsers never send that part to a server, so the plan is not sent to us when someone opens the link. Anyone who has the link can read the plan, so share it the way you would share the plan itself.

An embedded roadmap works the same way: the plan is in the address of the embed, and the page that shows it is run by whoever published it.

A roadmap kept in a calendar gives every event a web address on open.tidigar.com that identifies the roadmap and the record. If you open such an address in a browser, the browser sends it to our server like any other address. We use it only to show the page, and we keep no record of it.

The apps

The apps for iPhone, iPad and Mac work without a Tidigar account. If you choose to sign in to Tidigar Business, they send your sign-in details, profile changes and Business roadmap edits to our service, and receive your organisation's plans, members and subscription status. The Tidigar Business section below describes that data and how to download or delete it. The apps sign in by email code or, where they are offered, with Apple or a passkey. Google, Microsoft and GitHub sign-in are available only on the web.

Signing in with Apple asks Apple only for your email address, not your name; Apple can give us a private relay address instead of your own. Business credentials are kept in the device's Keychain, together with your Apple user identifier when you signed in with Apple on that device, so that the app signs out if you stop using Apple with Tidigar. Business plans chosen for offline access and pending edits are also kept on the device so you can work without a connection.

The apps download roadmap templates from app.tidigar.com, which reaches our hosting provider in the same way as visiting a website (see below), without sending your roadmaps. They contain no advertising, tracking or analytics scripts.

If you have chosen to share analytics with app developers in your device's settings, Apple sends us anonymous crash and usage reports. You can turn this off in the device's privacy settings.

Our websites

tidigar.com, app.tidigar.com, open.tidigar.com and embed.tidigar.com are hosted by Cloudflare. As with any website, Cloudflare processes your IP address and the technical details of each request to deliver the pages and protect them against attacks.

On tidigar.com, app.tidigar.com, open.tidigar.com and embed.tidigar.com we use Cloudflare Web Analytics to count visits. It sets no cookies, does not follow you across sites and gives us only totals, such as how many visits a page had. For embedded roadmaps and opened links it also tells us which websites they were on. It does not see your roadmaps.

Apple purchases

Files and calendars and Export without Tidigar are separate non-consumable one-time purchases in the Apple apps. Apple handles the payment and your Apple Account under Apple's privacy policy. We receive sales figures from Apple, but not who you are. The app asks the App Store which purchases have verified access.

Tidigar Business

Tidigar Business is a paid service where we keep an organisation's roadmaps on our servers, so they open in browsers and the native apps and members see each other's changes. It is the only part of Tidigar where we store your roadmaps. Everything above about the web app and the apps applies when you do not use Business.

What we store

• Your account: your email address, the name you add and your profile picture, whether you want an email when you are assigned an activity, and the language of the app you last used, for that email. When you last used Business, in the app, with an agent token or through an assistant, recorded at most once an hour. If you use Gravatar, we also keep its email address. If you sign in with Google, Microsoft, GitHub or Apple, the identifier of that account and the address it gives us. Your sessions, so you stay signed in, for at most a year, and temporary sign-in requests.
• Passkeys: if you add a passkey, its public key, credential identifier, signature counter, the kind of password manager or security key that made it (its AAGUID), whether it can sync and is synced, the name you give it, and when it was added and last used. The private key stays in your password manager or security key, and your fingerprint, face or device code is checked on your device and never reaches us. While you sign in with a passkey we keep a one-time challenge for at most five minutes.
• Signed-in devices: for each session, a random identifier and a coarse label of the browser and platform it was signed in from, such as "Safari · Mac" or "Tidigar · iPhone", taken once from the browser's or app's self-description at sign-in, with when it started and was last used. We store no version numbers, full browser description or IP address with it.
• Sign in with Apple: an encrypted authorization from Apple, which we check with Apple once a day and use to revoke Tidigar's access when you remove Apple sign-in or delete your account. If Apple gives us a private relay address, we also keep whether Apple currently forwards email to it, so we send nothing Apple would not deliver.
• Your organisations: their names and pictures, members, invitations and roles, and when their owners last got their monthly overview. Who was removed from an organisation or left it, and when, so they are not added again without an invitation.
• Microsoft Entra: if an owner connects the organisation's Microsoft Entra tenant, its tenant identifier, which owner started the connection and when it was made. To confirm the connection, we ask Microsoft once for a token for the tenant and keep nothing from it. We read no users or groups from the tenant; people join when they sign in with Microsoft.
• Company sign-in: if an owner connects the organisation's own sign-in provider, such as Okta, its address, the application's client ID, which owner set it up and when it was set up and connected. For each person who signs in through it, the provider's identifier for them and the email address it gives. We read no users or groups from the provider.
• Roadmaps: the current version of each roadmap in your organisation, its earlier versions for 30 days, deleted roadmaps in the trash for 30 days, their thumbnails, which member each activity is assigned to, by whom and when, and each activity's history of which member changed what and when, for a year. A new assignment waits a few minutes before its email is sent and is then removed.
• Subscriptions: the status and number of seats of each organisation's subscription. Each month its owners get an email overview of the seats paid and used, the owners and editors added, editors who have not used Business for 30 days with when they last did, and the next invoice's amount and date, which we ask Stripe for when sending it.
• Screens: for each screen an editor makes, the saved view it shows, its name and story, whether it shows a join code, who made it and when, and a one-way hash of its link's secret part, never the secret itself.

We do not keep your IP address in your account record. To limit repeated sign-in attempts, we keep counters keyed by hashes of the IP address or email address. A hash is not the original address, but is not a guarantee of anonymity.

Business also produces operational logs with request identifiers, API paths, status codes, response times and errors. Paths may contain organisation or plan identifiers; the application does not log roadmap bodies or session credentials. These logs help us operate and secure the service. Cloudflare Workers Logs retains them for up to seven days under its current retention limits.

Each organisation apart

Each organisation's roadmaps, versions and thumbnails are kept in a separate storage area of their own. One organisation's data is never stored together with another's, and members of one organisation cannot reach another's roadmaps.

A link to a roadmap in Business opens it only for members of its organisation; to anyone else, including chat apps that show a preview of the link, it says only that it leads to a roadmap in Tidigar Business. If an owner turns on previews of roadmap links, anyone who has a link, and the chat app that shows it, sees the roadmap's name and thumbnail. The preview is the same for everyone, so we and Cloudflare keep it for up to a minute; turning previews off takes effect within that minute.

Screens

An editor can make a screen of one saved view of a roadmap, to show it on a wall screen or in a web page. Its link, on embed.tidigar.com, carries a secret, and anyone who has the link, or a website that embeds the screen, can read that view without an account. An organisation that keeps its roadmaps in the organisation cannot make screens. For each screen we publish a copy of what the view shows: the activities its filters select, without descriptions, other views or fields the view does not use; the names of assigned members when the view shows assignees; the roadmap's and organisation's names, the story the editor wrote for the screen, and the roadmap's own short link, a random code that names neither the organisation nor the roadmap. That link opens the roadmap only for members of its organisation; the screen's Open in Tidigar leads there, and if the editor turns on the screen's join code, the screen also shows it as a QR code. The copy is updated about a minute after the roadmap changes.

The part of the link after the # is the secret, which browsers never send to us. We store the copy under a hash of it on data.tidigar.com, which sets no cookies and asks search engines not to index it. Cloudflare serves the copy from its global network and may cache it for up to a minute, so readers never reach the organisation's storage. Every reader of a screen, signed in or not, reads only the copy and asks our servers nothing about its session or the roadmap. Readers of a screen can change the plan they see without saving anything. A reader who opens the roadmap's link from the screen without being a member may instead open what the screen shows as their own copy in their browser.

The copy is deleted when the screen is deleted, its view or roadmap is deleted, or the organisation becomes read-only after its subscription ends or is deleted. Readers then see that the roadmap is no longer shared, after at most about two minutes. Copies already opened or saved by readers remain with them.

Profiles and invitations

Members of the same organisation can see each other's names, email addresses, roles and profile pictures, and who is editing a shared plan. Invitations send the invited address an email naming the organisation. When another member assigns you an activity, we email you its name, the roadmap's name and who assigned it, with a link to the roadmap; you can turn this off in your account.

When you sign in with Google, Microsoft or GitHub without having chosen a picture, our server copies your provider profile picture when available. Microsoft asks for permission to read your profile. Apple does not provide a profile picture. You can replace or remove the copied picture in Account and profile; later sign-ins do not overwrite that choice. Pictures are served by Tidigar, so other members do not contact your provider to view them.

If no provider picture is available when you first sign in without having chosen a picture, our server checks whether your email address has a public Gravatar picture. It sends a SHA-256 hash of the address to Gravatar, operated by Automattic, and stores the picture if one exists. A hash can still identify an address to that service. You can remove the picture, upload your own or clear the Gravatar address in Account and profile; that stops further automatic lookups. You can also choose another Gravatar address there. Stored Gravatar pictures are refreshed when requested after a week. Browsers and native apps receive the picture from Tidigar and do not contact Gravatar directly. See Automattic's privacy policy.

Who is responsible

For roadmaps and members, the organisation that uses Business is responsible for the personal data, and Hamacher Software AB processes it on the organisation's behalf under our data processing agreement, which an owner accepts when starting the subscription. For accounts, sign-in and billing, Hamacher Software AB is responsible.

Where it is stored and who helps us

Business runs on Cloudflare. Its persistent Business account and organisation databases are restricted to the EU. This storage restriction does not mean that all request handling, security metadata, support access or email delivery stays in the EU. Cloudflare operates a global network, which caches published screen copies near their readers, and sends sign-in, invitation, assignment and subscription-end emails.

Cloudflare is our subprocessor for the organisation data covered by the data processing agreement. Stripe handles subscriptions, payments, invoices and VAT under Stripe's privacy policy; we never see card numbers. For these billing activities Stripe acts as our processor and, for its own regulatory and fraud-prevention purposes, as an independent controller. Billing is separate from processing your organisation's roadmaps. When an owner starts a subscription we tell Stripe which part of the app they started from, such as the organisation's page, so we can see which ways into a subscription people use.

Gravatar receives the address hash described above. Signing in with Google, Microsoft, GitHub or Apple, where configured, is optional; the provider receives the sign-in request and gives us your identifier, email address and, where supported, profile picture, not access to your roadmaps. Apple also tells us when you stop using Apple with Tidigar, delete your Apple Account or change email forwarding to a relay address; we then remove the Apple sign-in and end your sessions, or update the forwarding state. Removing GitHub from your Tidigar account removes that sign-in method; you can also revoke the OAuth App in your GitHub settings. For GitHub, we request email access and read the public profile picture, never repository access. These profile and identity services are described here separately from the organisation's subprocessor list.

These providers may process some data outside the EU or EEA, including in the United States. Where required, transfers use the European Commission's standard contractual clauses or an applicable EU–US Data Privacy Framework certification. You can ask privacy@tidigar.com for information about the applicable safeguards or a copy of them.

See and download your data

When you are signed in, your account in Tidigar shows your email address, your picture and the organisations and invitations you have. Download my personal data gives you your account data in one file: your account and picture, with your email choice, language and when you last used Business, your organisations and roles, your sign-in methods including your passkeys' details, your sessions and their device labels, your pending sign-in emails and your invitations. Tidigar has no passwords, and the keys that keep you signed in and your passkeys' public keys are never part of the file.

In your account you can also see and rename your passkeys, remove one, and see the devices where you are signed in and sign out any one of them.

Owners can download a complete package of their organisation at any time, also after a subscription has ended: every roadmap with its earlier versions and thumbnails, the members, invitations and pictures. Members can also download single roadmaps as a file or as Markdown, unless an owner has chosen to keep that to owners.

How long we keep it

We keep your account until you delete it, which you can do yourself in your account in Tidigar. Deleting your account deletes your sign-ins, passkeys, sessions and picture after you have left your organisations. It also revokes Tidigar's Apple authorization with Apple. If you own any organisation, including a personal space, first hand over ownership and leave it, or explicitly delete the organisation. An owner cannot delete their account, even when the organisation has another owner. Other members must leave their organisations before deleting their account.

Removing a passkey deletes it from Tidigar at once; your password manager keeps its own copy until you delete it there. Signing out a device deletes that session and its label. Removing Apple sign-in also revokes that authorization. The forwarding state of an Apple relay address is kept until you delete your account, also after you remove Apple sign-in, so that we keep sending nothing to an address Apple does not forward.

Sign-in links and codes expire after 15 minutes and passkey challenges after five minutes; invitations expire after seven days. Expired temporary records are cleaned up as the service handles new requests. Session access ends after 30 days without use and after a year at the latest.

When an organisation's subscription ends, its roadmaps become read-only and can still be downloaded. Deletion is due after 90 days and requires at least 14 days' advance email notice to its owners; if notice is delayed, deletion waits. Owners can request earlier deletion at privacy@tidigar.com. Deleted Business data can remain in the hosting provider's recovery copies for up to 30 days. Invoices and payment records are kept as long as accounting law requires.

Business plans and pending edits can also have offline copies on your devices. Signing out ends access to Business. Browser clients remove linked caches when they process sign-out or loss of access, while permitted unsent edits can be kept as a local recovery draft. Native apps may retain offline copies and pending edits for the signed-out account to avoid losing work; they are not made available to another account. Files, images, printouts and other copies you have exported remain under your control, and server deletion does not erase them.

Cookies and browser storage

Tidigar uses only what it needs to work, so it asks for no consent and shows no cookie banner. We use no advertising or tracking cookies, and our visit counts set none.

• The web app keeps local roadmaps and settings in your browser's storage. When you choose Business, the linked plans and edits are sent to Business and may also be cached on the device for offline use.
• Tidigar Business in a browser sets two cookies when you sign in. __Host-tidigar-session keeps you signed in. __Host-tidigar-signed-in holds only the value 1, says nothing about who you are, and lets the web app know it should check your sign-in, so visitors who never sign in are not checked. Both end after 30 days without use, and after a year at the latest, or when you sign out.
• The native apps keep the Business session credential in Keychain instead of a browser cookie. Signing out or deleting the account removes the credential.
• Signing in with Google, Microsoft or GitHub on the web sets a cookie, __Host-tidigar-sign-in, for at most ten minutes while you sign in, so that the answer comes back to the same browser.
• Signing in with Apple on the web likewise sets __Host-tidigar-apple for at most ten minutes.
• Cloudflare may set a cookie to tell people from automated attacks, and Stripe sets its own cookies on its payment page to prevent fraud, under their own privacy policies.

When you write to us

If you email us, we use your address and your message to answer you, and keep the conversation as long as it is needed for that, or for accounting when it concerns a purchase.

Legal basis and your rights

We process personal data for hosting, security and visit counts because we have a legitimate interest in running the websites safely and knowing which pages are used. We process emails to answer you and, for purchases, to fulfil our agreement with you.

In Tidigar Business, we process accounts and sign-in to provide the service under our agreement, and billing records to fulfil the agreement and meet accounting obligations. Security logs and abuse prevention serve our legitimate interest in protecting the service.

Profile pictures and the Gravatar lookup serve our legitimate interest in helping colleagues recognise each other; you can remove or replace the picture and object by contacting us.

Roadmaps and organisation membership are processed on the organisation's instructions; that organisation determines its own legal basis and handles requests about the content it controls. Account and invitation data comes from you, your chosen identity provider or the person inviting you.

Required account and payment details are needed to provide the corresponding service; names, pictures, passkeys and external sign-in providers are optional. We do not use Business data for advertising or AI training, or make solely automated decisions that have legal or similarly significant effects on you.

You have the right to ask what personal data we hold about you, and to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. In Tidigar Business you can see, download and delete your data yourself, as described above; for anything else, write to privacy@tidigar.com. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten).

Changes

If we change how Tidigar handles personal data, we update this page and the date at the top before the change takes effect.