Plain English, no fine print.

kanNINJA is operated by Brandon Korous, a sole proprietor based in California, doing business as kanNINJA (part of the WizeWorks brand). For privacy questions or to exercise the rights described below, email privacy@kanninja.com.

Mailing address: [Address — to be added].

This policy covers the kanninja.com / kanninja.app web app, our marketing pages, and any related services. It does not cover third-party sites we link to, even when we link to them often.

We collect only what we need to run the service.

Account information

When you create an account, our authentication provider Clerk handles your name, email, password (hashed — we never see it), and any social login identifiers you choose to use. We receive a user ID and the basic profile fields from Clerk.

Billing information

When you subscribe to a paid plan, Stripe processes your card. We never see or store your full card number. We do receive and store the last four digits, card brand, billing country and postal code, and the Stripe customer and subscription IDs so we can show your billing history and renew your plan.

Content you create

Boards, lists, cards, comments, checklists, attachments, custom fields, time entries, and anything else you put into kanNINJA. We store this so the product works. We do not read it for any purpose other than operating the service and responding to your support requests.

Usage and device data

Pages you visit, features you click, approximate location derived from IP, browser type, operating system, and timestamps. We use this through Google Analytics and Microsoft Clarity (see section 06).

AI prompts and outputs

When you use an AI feature, the contents of the cards or prompts involved are sent to OpenAI to generate a response. We keep a record of the request and response so the feature can show history and so we can debug failures.

Integration data

If you connect Google Calendar, Slack, or GitHub, we receive OAuth tokens and the data you authorize us to read (calendar events, channel metadata, repository metadata). We only fetch what the integration needs.

Email

Our email provider Resend delivers transactional messages (invitations, password resets, billing receipts, important account notices). Resend logs delivery metadata.

We use the information above to:

• Operate, maintain, and secure the service.
• Authenticate you and protect your account.
• Process payments and renew or cancel your subscription.
• Send transactional email (invitations, receipts, security notices).
• Power AI features when you invoke them — we do not run AI on your content unless you ask us to.
• Understand which features are used and which are broken, through analytics and session replay.
• Respond to support requests and bug reports.
• Comply with legal obligations and enforce our Terms.

We do not sell your personal information. We do not share it with advertisers. We do not use your content to train any AI model — ours or anyone else's.

We share information with a small set of service providers ("subprocessors") who help us run the service, each under a contract that limits what they can do with it. The current list is on our Subprocessors page. It includes Clerk (auth), Stripe (payments), Supabase (database and realtime), OpenAI (AI features), Microsoft Clarity (session replay), Google Analytics (web analytics), Resend (email), and Microsoft Azure (hosting).

Beyond subprocessors, we share information only:

• With other members of a board or clan you belong to — they see what you contribute there, the way they would in any shared workspace.
• When the law requires it (subpoena, court order, valid government request). We push back on overbroad requests.
• If kanNINJA is acquired or merged, customer data transfers to the successor under this policy. We will give notice before that happens.

AI features are opt-in: you have to invoke them. When you do, we send the relevant card content or prompt to OpenAI's API and return the response.

OpenAI's API platform commits not to use API inputs or outputs to train its models, and to delete request data within 30 days unless required by law. We rely on those commitments. We add one of our own: we do not train, fine-tune, or build any model on customer content.

You can disable AI features for your account in Settings. If you are on a team plan, the workspace owner can disable them for everyone.

We use a small number of cookies and similar technologies. The full breakdown is on our Cookie Policy; the short version:

• Strictly necessary cookies keep you signed in (set by Clerk) and remember your theme and basic preferences. These cannot be turned off.
• Analytics — Google Analytics counts page views and events to tell us which features are used.
• Session replay — Microsoft Clarity records anonymized session recordings and heatmaps so we can see where the product confuses people. Form input, passwords, and card content are masked by default.

California residents may opt out of analytics and session replay using the link in the footer or by emailing privacy@kanninja.com. Necessary cookies remain because the service does not work without them.

Under the California Consumer Privacy Act and the California Privacy Rights Act, California residents have the following rights:

• Right to know — what categories of personal information we collect, where it comes from, why we collect it, and who we share it with.
• Right to access — a copy of the personal information we hold about you.
• Right to correct — ask us to fix inaccurate personal information.
• Right to delete — ask us to delete your personal information, subject to legal exceptions (fraud prevention, tax records, ongoing transactions).
• Right to opt out of sale or sharing — we do not sell personal information and do not share it for cross-context behavioral advertising. The right exists regardless.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information beyond what is needed for the service.
• Right to non-discrimination — exercising any of these rights will not change the price you pay or the service you receive.

To exercise any of these rights, email privacy@kanninja.com from the address on your account or include enough information that we can verify it is you. We respond within 45 days, and will tell you if we need an additional 45 days. You can also authorize an agent to act on your behalf.

We hold information only as long as we have a reason to.

Account data

Until you delete your account. We then remove it from live systems within 30 days.

Backups

Up to 90 days. Encrypted backups age out on a rolling schedule and overwrite themselves.

Audit logs

Up to 12 months for security and incident investigation.

Billing records

Up to 7 years for tax and accounting purposes, as required by law.

AI request logs

Up to 90 days for debugging and abuse investigation.

Analytics and session replay

Google Analytics: 14 months. Microsoft Clarity: up to 12 months.

We use TLS 1.2+ for all data in transit and AES-256 for data at rest in the database. The application runs on Microsoft Azure Kubernetes Service in the West US 3 region. Access to production systems is limited to the smallest set of people who need it, behind multi-factor authentication. We log administrative actions.

No security program is perfect. If you discover a vulnerability, please report it responsibly to security@kanninja.com. We will not pursue legal action against good-faith research.

Children

kanNINJA is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, email privacy@kanninja.com and we will delete it.

International transfers

kanNINJA is operated from the United States and your data is processed in the United States (Azure West US 3). If you use the service from outside the United States, you consent to that transfer and processing.

Changes to this policy

We will update this policy when we change how we handle data. Material changes will be announced by email or in the app at least seven days before they take effect. The "last updated" date at the top of this page is the version of record.