Privacy policy
Gapboard is a weekly planning board made by MAPLESPACE INC. ("Maplespace", "we"). This page says what it stores about you, who else handles any of it and why, and what you can do about it. The short version: your board is yours, it isn't sold or used for advertising, and you can take it with you or have it deleted.
What Gapboard stores
- Your account: your email address, when the account was made and last signed in, and your plan (Free or Plus). If you pay for Plus, the customer ID Stripe gives your account, so a renewal or a cancellation reaches the right person. No passwords: you sign in with a one-time code sent by email, and only a hash of that code is kept, for the ten minutes it works.
- Your board: the tasks, projects, habits, quests, notes and settings you enter, including your time zone so reminders arrive at the right local time. Each person's board is stored on its own in a Cloudflare Durable Object; no one else's board can be reached from yours, and nobody else using Gapboard can read it. A copy is cached in your browser or the iPhone app so it works offline.
- Daily snapshots of your board, so a mistake can be undone. The newest thirty are kept.
- Your devices, if you turn on notifications (Plus): the push token Apple issues for the iPhone app, or the push subscription your browser issues. These are used only to send the reminders and nudges you asked for, and are deleted when you turn notifications off, sign out, or the push service says the device is gone.
- A sign-in cookie, signed so it can't be forged, which keeps you signed in for up to thirty days. Gapboard uses no other cookies: no analytics, advertising or tracking cookies.
- Your IP address, briefly, to limit how often sign-in codes can be requested from one place. It is kept for under half an hour.
Who else handles your data, and why
- Cloudflare hosts the app and stores everything above. Its servers keep short-lived request logs, as any web host does.
- Mailgun delivers sign-in codes, so it receives your email address and the code.
- Stripe handles payments for Plus. You enter your card on Stripe's own pages; Gapboard never sees or stores card numbers. Stripe tells Gapboard whether a payment went through and whether a subscription is active. Stripe's handling of your payment details is covered by Stripe's privacy policy.
- Apple, and your browser's push service (for example Google's, Mozilla's or Apple's), carry notifications to your devices if you turn them on. A notification contains a card's name and a line placing it, such as "Task · 10 min · on Thursday". Browser notifications are encrypted so only your browser can read them.
Gapboard does not sell, rent or share your data with anyone else, and does not use it for advertising, analytics, profiling or training AI models.
Apple Health
In the iPhone app, a habit can follow a kind of workout, such as running. If you allow it, the app reads your workouts from Apple Health on your phone and ticks the matching habit on the days you worked out. Only those dates are written to your board; the workouts themselves never leave your phone. Health data is never used for advertising, never shared, and never sold. You can withdraw access at any time in the iPhone's Settings → Health.
Connected services (Google / YouTube)
If you connect a YouTube channel (a Plus feature), Gapboard asks Google for read-only access to that channel (youtube.readonly) and to its YouTube Analytics reports (yt-analytics.readonly). It uses that access for one purpose: to read the channel's running totals — subscribers, views and videos published, with the exact subscriber count taken from the subscribers gained and lost that Analytics reports, since the public count is rounded — and record them as progress on a quest you have chosen.
The OAuth tokens Google issues are stored with your board, are used only by the server to make those reads, and are never sent to your browser or to anyone else. Disconnecting the service in the app deletes the tokens immediately. No other YouTube data is read, and nothing is written to YouTube.
Gapboard's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Your choices
- Take your data with you: Settings → Account → Download a backup gives you your whole board as one file, on every plan, at any time.
- Correct or delete things: edit or delete any card, disconnect any service, turn notifications off, or start your board over, from the app.
- Delete your account: email the address below from your account's address and your account, board, snapshots, devices and connections are deleted for good, normally within a week. Payment records Stripe must keep by law stay with Stripe.
- Ask what Gapboard holds about you, or anything else on this page, at the address below. These rights apply wherever you live.
Keeping it safe, and how long
Everything travels over HTTPS. Your data is kept while your account exists. Moving to the free plan deletes nothing; deleting your account deletes everything listed above. Gapboard's servers run on Cloudflare's worldwide network, so your data may be processed outside the country you live in.
Children
Gapboard is not meant for children under 13, and doesn't knowingly hold an account for one. If you believe a child has made one, email the address below and it will be deleted.
Changes
If this policy changes in a way that matters, the change will be announced in the app or by email before it takes effect. The date below always says when it last changed.
Contact
Questions, requests and account deletion: contact@gapboard.app.
Last updated October 6, 2026.