Data Policy
Last updated August 2026. Where SlayTab data lives, how long it is kept, how it is secured, and who processes it.
The privacy policy explains what we collect and why, in plain terms. This page is the technical companion: the categories of data, where each lives, how long we keep it, and the measures protecting it. It is the document to send to a security reviewer.
1. Data categories
| Category | Examples | Where it is stored |
|---|---|---|
| Identity | Name, email, bcrypt password hash | Our database |
| Content | Uploaded files, links, notes, tasks | Our database and file system |
| Calendar | Event titles, times, locations, descriptions | Our database, refreshed from the source |
| Credentials | Google refresh token, calendar feed URLs | Our database |
| Assistant | Your messages and the assistant's replies | Our database |
| Access tokens | Extension API tokens | Our database, SHA-256 hashed |
| Billing | Subscription status, invoice records, payment ids | Our database and Razorpay |
| Operational | Web server and error logs, email delivery records | Our servers |
| Security | Sign-up, sign-in and failed sign-in records: time, IP address, browser, and an approximate location if geolocation is enabled | Our database, and ipwho.is for the location lookup |
2. Sub-processors
Each sees only what its feature requires. This list changes only with notice.
| Processor | Purpose | Data | Region |
|---|---|---|---|
| OpenAI or Anthropic | AI assistant | Your message and the workspace content it searches | United States |
| Calendar sync | Calendar events, OAuth token | International | |
| Razorpay | Payments | Email, payment details | India |
| Email provider | Transactional and product email | Name, email, message contents | United States |
| DuckDuckGo | Site icons for saved links | Domain names only | United States |
| jsDelivr | Icon font delivery | IP address, browser | Global CDN |
| ipwho.is | Approximate location of a sign-in | IP address only | International |
The AI provider and Google are used only if you use those features, and ipwho.is only if sign-in geolocation is enabled on this deployment. An account that never opens the assistant and never connects a calendar sends data to neither.
3. Retention
| Data | Kept |
|---|---|
| Account and content | Until the account is closed |
| Archived items, notes and tasks | Until you delete them; archive is not automatic deletion |
| Calendar events | Replaced on each sync; removed when the calendar is disconnected |
| Assistant conversations | Until you start a new chat or close the account |
| Closed accounts | Removed from live systems within 30 days |
| Invoices and payment records | As tax and accounting law requires, typically 8 years in India |
| Sign-in records | Kept with the account and deleted with it |
| Server logs | Rolled off on the host's schedule, normally within 30 days |
| Backups | Expire on their own cycle, normally within 30 days |
4. Security measures
- Passwords stored as bcrypt hashes; never recoverable, never logged.
- API tokens stored as SHA-256 hashes and displayed once at creation.
- Every query is scoped to the signed-in account — one user's data is unreachable from another's session.
- All state-changing requests carry a CSRF token; the API authenticates with bearer tokens rather than cookies.
- Uploads are extension-checked, renamed, never overwritten, and served from a directory where code execution is disabled.
- Record identifiers in URLs are encrypted, so they cannot be read from an address bar or a referrer header.
- Payment card data never reaches our servers.
- Traffic is served over HTTPS.
Stated plainly: database contents are not encrypted at rest beyond what the hosting platform provides, and OAuth refresh tokens are stored in recoverable form because the service must use them to sync your calendar unattended. If your threat model requires envelope encryption or customer-managed keys, SlayTab does not currently meet it.
5. Access
Access to production systems is limited to the people who operate the service. We access account content only to fix a fault you have reported, to investigate abuse, or where the law requires it. We do not read customer content for product research.
6. Breach handling
If we discover a breach affecting personal data, we will investigate, contain it, and notify affected users and the relevant authority within the timeframes the applicable law sets — no later than 72 hours after becoming aware where the GDPR applies. Notification will describe what happened, what data was involved and what you should do.
7. Your control
- Export: ask and we will provide your content in a machine-readable form.
- Delete: notes and tasks can be permanently deleted in-app after archiving. For full account deletion, email privacy@slaytab.com — it is a manual process, completed within 30 days.
- Revoke third-party access: disconnect a calendar in-app or at your Google account; revoke an extension token in Account.