Privacy Policy
This policy explains how Draggable ("we", "us") handles personal information when you use the hosted OpenRows service at app.openrows.io, our sign-in service at auth.openrows.io, and this website (together, the "Service"). OpenRows is an open-source alternative to Airtable, released under the AGPL-3.0.
The short version
- Your workspace data is yours. We store it to run the Service and for nothing else.
- We don't sell your data, we don't show ads, and we don't use ad trackers.
- We don't use your content to train AI models.
- You can ask us for a copy of your data or to delete it at any time.
What we collect
- Account information. When you sign up with an email and password, we collect your name, email address and a securely hashed password. When you sign in with GitHub or Google, we receive your name, email address and profile picture from that provider. We don't get your GitHub or Google password.
- Workspace content. The bases, tables, records, files, comments and automations you and your collaborators create or upload.
- Billing information. If you subscribe to a paid plan, payment is handled by Polar, our merchant of record. We receive your plan, billing status, and limited billing details such as your name, email and country, but not your full card number.
- Usage and technical data. Server logs that include your IP address, browser type, the pages and API endpoints you request, timestamps and error reports. We also count usage (records, storage, automation runs, API calls) to apply plan limits.
- Cookies. We use only the cookies needed to keep you signed in and secure your session. We don't use advertising or cross-site tracking cookies.
How we use it
- To provide, maintain and secure the Service, including signing you in and syncing your data with collaborators.
- To enforce plan limits and process subscriptions.
- To send essential emails such as invitations, password resets and important account or service notices.
- To diagnose problems, prevent abuse and improve performance.
- To comply with legal obligations.
Where data protection laws such as the GDPR apply, we rely on performing our contract with you, our legitimate interest in running a secure and reliable service, and compliance with legal obligations.
Who we share it with
We share personal information only with service providers that help us run the Service, and only as needed:
| Provider | Purpose |
|---|---|
| Servers we operate | Hosting the application, database and file storage |
| Cloudflare | DNS, network security and secure connections to our servers |
| Polar | Payments, invoicing and tax as merchant of record |
| GitHub and Google | Sign-in, only if you choose to sign in with them |
We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy will continue to apply to your data. We never sell your personal information.
Your workspace content
We access your content only to provide the Service, to respond to your support requests, to investigate abuse or security issues, or when required by law. We don't use your content to train artificial intelligence or machine learning models.
Retention
We keep your account and workspace content for as long as your account is active. Items you delete go to the trash and are then permanently removed. When you delete your account, or ask us to, we delete your personal information and workspace content within 30 days, except where we must keep certain records (for example, billing records) to meet legal obligations. Encrypted backups are overwritten on a rolling basis within a further 30 days. Server logs are kept for up to 90 days.
Your rights
Wherever you live, you can ask us to:
- give you access to the personal information we hold about you;
- export your data in a portable format;
- correct inaccurate information;
- delete your account and data;
- restrict or object to certain processing.
Email [email protected] and we'll respond within 30 days. You also have the right to complain to your local data protection authority.
Security
We encrypt data in transit with TLS, hash passwords, isolate each workspace's data, and limit access to our systems. No system is perfectly secure, but we work hard to protect your information and will notify affected users of a breach as required by law.
International transfers
Our providers may process data in countries other than your own. Where required, we rely on appropriate safeguards such as standard contractual clauses.
Self-hosted OpenRows
This policy covers only the hosted Service run by Draggable. If you use an OpenRows instance run by someone else, including one you host yourself, that operator is responsible for how your data is handled.
Children
The Service isn't intended for anyone under 16, and we don't knowingly collect information from them. If you believe a child has given us personal information, contact us and we'll delete it.
Changes to this policy
We may update this policy from time to time. If we make significant changes, we'll notify you by email or in the app before they take effect. The effective date at the top shows when it last changed.
Contact
Questions or requests about privacy: [email protected].