Introduction
This Privacy Policy describes how Sidequest ("we", "us", or "our") collects, uses, and shares information about you when you use our services. Effective Date: September 7, 2026. Version: 069c886f.
If you have questions about this policy, please contact us at x@jxd.dev.
Information We Collect
We collect the following categories of personal data for the purposes described below. Under GDPR Article 6, we rely on the lawful bases shown for each processing purpose:
| Category | Fields collected | Purpose | Lawful basis |
|---|---|---|---|
| Account information | Email address, Account identifier, Name and verification status, Account timestamps | Create and operate your Sidequest account and authenticate access. | Performance of a contract (Article 6(1)(b)) |
| Security and delivery | Session identifiers, IP address and user agent, Hashed sign-in codes, Request and error information, Sanitized health measurements, opaque account IDs, trace IDs and temporary reporting IDs | Deliver and protect the service, prevent abuse and investigate faults. Our legitimate interest is keeping accounts and the service secure. External font requests to rsms.me also disclose your IP address and browser request information to its hosting providers. | Legitimate interests (Article 6(1)(f)) |
| User content | Tasks, lanes and projects, Notes and whiteboards, Sync changes and offline mutations | Store, display and synchronise your board, including offline edits. | Performance of a contract (Article 6(1)(b)) |
| Billing | Customer, checkout, order and subscription identifiers, Email address, Plan, payment status and billing timestamps | Manage subscriptions and paid access. Polar handles checkout and payment information as merchant of record; Sidequest does not receive full card details. | Performance of a contract (Article 6(1)(b)) |
| Accounting records | Transaction identifiers, Payment, tax and reconciliation records | Meet tax and accounting obligations and reconcile transactions. | Compliance with a legal obligation (Article 6(1)(c)) |
| Email and support | Email address, Sign-in email content and delivery status, Privacy requests and support correspondence | Send requested sign-in codes and respond to account, support and privacy requests through x@jxd.dev. | Performance of a contract (Article 6(1)(b)) |
| Analytics | Visits to the board, billing and connections pages, Static page labels, Consented navigation performance and Web Vitals, IP address and browser information received by OpenPanel | With your permission, use OpenPanel to understand visits to the board, billing and connected-app pages. We send fixed paths and labels, excluding query strings, fragments, full referrers, account identity and user content. We do not enable session replay. Rejecting analytics does not affect access. Change or withdraw your choice using Cookie settings. | Consent (Article 6(1)(a)) |
| Connected apps | Client registration information, Permissions and authorisation records, OAuth tokens and expiry times, Content accessed or changed through authorised MCP tools | Allow apps you authorise to read or change Sidequest content through MCP within the permissions granted. Revoking an app stops future authorised access; copies already received are governed by that app’s policies. | Performance of a contract (Article 6(1)(b)) |
Right to Withdraw Consent
Where we rely on your consent for any processing of your personal data, you have the right to withdraw that consent at any time by contacting us at x@jxd.dev. Withdrawing your consent does not affect the lawfulness of any processing we carried out before you withdrew it. Where consent is required to provide a particular feature or service, withdrawing it may mean we are no longer able to offer that feature or service.
Automated Decision-Making and Profiling
We do not engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you within the meaning of GDPR Article 22.
Data Retention
We retain your data for the following periods:
| Category | Retention period |
|---|---|
| Account information | We determine how long to retain account information based on whether your account remains in use, outstanding account requests, and applicable legal obligations. |
| Security and delivery | Retention depends on session and code validity, investigation of security incidents, troubleshooting needs and applicable legal obligations. Expiry prevents use of a credential; it does not promise immediate removal of stored records or logs. |
| User content | Retention depends on your continued use of the content, deletion requests, synchronisation and recovery needs, and applicable legal obligations. Browser copies have no automatic expiry and remain until site data is cleared or the browser evicts it. |
| Billing | Retention depends on the transaction and subscription lifecycle, accounting and tax obligations, refunds, disputes and legal claims. |
| Accounting records | Retention depends on applicable tax and accounting requirements, audits and legal claims. |
| Email and support | Retention depends on delivery and troubleshooting needs, resolving your request, and keeping records needed for applicable legal obligations. Sign-in codes are valid for five minutes; email and delivery records may remain longer. |
| Analytics | Retention depends on the need to understand product usage and applicable provider retention settings. Withdrawal stops new events; requests already underway may complete. Contact x@jxd.dev about data already collected. |
| Connected apps | Retention depends on the authorisation lifecycle, token validity, revocation, security investigations and synchronisation needs. Revocation or token expiry does not promise immediate deletion of all associated records. |
Whether You Are Required to Provide This Data
For each category of personal data we collect, we set out below whether you are required to provide it — by law, under our contract with you, or as a precondition to entering into a contract — or whether provision is voluntary, together with the consequences of failing to provide it.
| Category | Requirement | Consequences |
|---|---|---|
| Account information | Required to enter into a contract | Without an email address we cannot create your account or sign you in. |
| Security and delivery | Required to enter into a contract | Without the request and authentication information needed to secure the service, we cannot provide access. |
| User content | Voluntary | You choose what content to add; features that store or synchronise content need that content to work. |
| Billing | Required to enter into a contract | Payment and subscription information is needed to purchase and administer a subscription. |
| Accounting records | Required by law | Records required for tax and accounting obligations must be provided or retained when you make a purchase. |
| Email and support | Voluntary | Without your email and the information relevant to a request we may be unable to respond or send a sign-in code. |
| Analytics | Voluntary | There is no effect on sign-in, billing or offline functionality if you decline analytics. |
| Connected apps | Required under our contract with you | Connecting an app requires its client details and permission records. Connecting apps is optional. |
Cookies and Tracking
We use the following types of cookies and tracking technologies:
| Category | Lawful basis |
|---|---|
| Essential cookies — required for the service to function | Performance of a contract (Article 6(1)(b)) |
| Analytics cookies — help us understand how the service is used | Consent (Article 6(1)(a)) |
Third-Party Services
We share data with the following third-party services:
| Service | Purpose | Privacy policy |
|---|---|---|
| Axiom | Application health, error diagnostics and operational measurements; optional browser performance measurements follow analytics consent. Credentials and board content are excluded. | View |
| Cloudflare | Hosting, request delivery, security, D1 account and billing storage, and Durable Objects board storage and sync. | View |
| Resend | Deliver sign-in emails, processing recipient addresses, message content and delivery records. | View |
| Polar | Merchant of record for subscriptions, checkout, payment, tax and billing administration. | View |
| OpenPanel | Optional product analytics, enabled only after your permission. | View |
| rsms.me (Inter font hosting) | Serve the Inter stylesheet and fonts; your browser sends network and browser information when requesting them. | View |
| Apps you authorise | Receive account or board information available through the MCP permissions you grant. Review the app’s privacy notice before connecting it. |
Your Rights
You have the following rights regarding your personal data:
- Right to access your personal data
- Right to correct inaccurate data
- Right to request deletion of your data
- Right to receive your data in a portable format
- Right to restrict how we process your data
- Right to object to processing
GDPR Supplemental Disclosures
This section applies to individuals in the European Economic Area (EEA) under the General Data Protection Regulation (GDPR).
Data Controller: JXD Ltd, trading as Sidequest, 86-90 Paul Street, London, EC2A 4NE, United Kingdom
For questions about how we handle your personal data or to exercise your privacy rights, contact x@jxd.dev.
You have the right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or place of the alleged infringement. A list of EEA supervisory authorities is available at edpb.europa.eu/about-edpb/about-edpb/members_en.
Our providers may process personal data outside the EEA. Transfers require an applicable legal basis and safeguards. The European Commission publishes its adequacy decisions. Contact us for details of the processing locations and safeguards applicable to your data, including how to obtain copies, at x@jxd.dev.
UK Privacy Rights (UK-GDPR)
This section applies to individuals in the United Kingdom under the UK General Data Protection Regulation (UK-GDPR), as tailored by the Data Protection Act 2018.
Data Controller: JXD Ltd, trading as Sidequest, 86-90 Paul Street, London, EC2A 4NE, United Kingdom
For questions about how we handle your personal data or to exercise your privacy rights, contact x@jxd.dev.
The supervisory authority for data protection in the UK is the Information Commissioner's Office (ICO). If you believe we have not handled your data in accordance with UK data protection law, you have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint.
Our providers may process personal data outside the UK. Contact x@jxd.dev for details of the processing locations and safeguards applicable to your data, including how to obtain copies.
Contact Us
Contact us:
- Legal Name: JXD Ltd, trading as Sidequest
- Address: 86-90 Paul Street, London, EC2A 4NE, United Kingdom
- Email: x@jxd.dev
- Website: https://sdqst.app