roadkit
Open app

Privacy
policy.

What Roadkit stores, why it stores it, and what it will never do with it. Last updated 29 August 2026.

1. Who is responsible

Roadkit is operated by RoadKit, SARL, registered at FRANCE under number 32069535600149. For anything in this policy, write to [email protected].

We are the data controller for the personal data described here, and we act as a processor for the content you put into your roadmaps.

2. What we collect

Your account

  • Your email address, which is how you sign in and how we reach you about the service.
  • Your display name, if you set one. It is optional and can be blank.
  • Your password, stored only as a scrypt hash with a per-account salt. We cannot read it, and neither can anyone who obtains the database.
  • When the account was created, and roughly when it was last used.

Your workspace

  • The workspace name, the plan it is on, and its members and their roles.
  • Identifiers issued by Stripe for the customer and the subscription, so we can show your plan without calling Stripe on every page load.
  • Invitations you have issued, as an email address and a hashed one-time token.

What you create

  • Your roadmaps: lanes, items, dates, owners, notes, markers and settings, exactly as you entered or imported them. This is stored as one document per roadmap.
  • Themes you save for your workspace.
  • Share links you create, including the hash of a link password if you set one. The link itself carries no personal data beyond the roadmap it points at.

Technical data

  • Server logs, kept briefly for diagnosing faults. They contain request paths and error details, and never the session cookie or your password.
  • If you submit the contact form or join the waitlist, the IP address and browser user-agent of that submission. Those two endpoints are public and unauthenticated, so this is what lets us tell a person from a script. They are not used for anything else, and nowhere else in the product records them.

Payment data

Card numbers never touch our servers. Checkout and the billing portal are hosted by Stripe, which sends us the outcome: which plan, whether it is active, when the period ends. Your invoices live in Stripe and are reachable from the billing page.

3. What we do not do

  • There is no analytics on this site. No Google Analytics, no tag manager, no session recorder, no heatmap, no advertising or retargeting pixel of any kind.
  • We do not sell, rent or share personal data with anyone for their own purposes.
  • We do not read your roadmaps, and we do not use their content to train machine learning models - ours or anybody else's.
  • We do not build a profile of you or track you across other websites.

4. Why we are allowed to hold it

  • To perform our contract with you: your account, your workspace, your roadmaps, and the billing needed to keep the plan running.
  • Our legitimate interest in a working, un-abused service: server logs, rate limiting, and the IP recorded against a public form submission.
  • A legal obligation: invoices and the accounting records that go with them.
  • Your consent: only if you ask us for something optional, such as being told when a feature ships. There is nothing on consent today.

5. How long we keep it

  • Account, workspace and roadmap data: for as long as the account exists, and then until it is deleted on request or with the account.
  • Backups: deleted data can persist in a backup for up to 30 days before the backup itself expires.
  • Invoices and accounting records: ten years, which is the retention French commercial law requires and which we cannot shorten at request.
  • Contact form and waitlist entries: until handled, and no longer than 24 months.
  • The internal log of staff actions on customer accounts: 24 months. It exists so that administrative access is accountable.

6. Who else processes it

Only the services the product genuinely runs on:

  • Stripe - payments, invoices and the billing portal. Stripe is a controller in its own right for payment data. It may transfer data to the United States under the European Commission's standard contractual clauses.
  • OVH - the servers and the database, located in FRANCE.
  • Brevo (Sendinblue SAS, France) - transactional email only: confirming your address, resetting your password, and passing on what you send us through the contact form. Its servers are in the European Union, and no newsletter or marketing message is sent from it. Click and open tracking are off.

There is nothing else. No CDN with a tracking edge, no support widget, no font served from a third party at page load.

7. Cookies and local storage

There is no cookie banner on this site because there is nothing to consent to. What we set is:

  • rk_session - the cookie that keeps you signed in. HttpOnly, so scripts cannot read it, and it holds a token whose hash is what the server stores. It expires after 30 days, or when you sign out.
  • rk_admin_return - set only when a member of our staff is signed in as a customer account with that customer's knowledge, so they can return to their own. It does not exist in an ordinary session.
  • roadkit-color-mode - your light or dark preference, kept in your browser's local storage. It never reaches our servers.

All three are strictly necessary or a preference you set yourself. None of them track you.

8. Share links

A share link renders a read-only copy of one roadmap to anyone holding the URL, with no account required. Treat it as public: an unlisted address is not a permission system. You can put a password on a link, and you can revoke a link at any time, which stops it working immediately for everyone you sent it to. We count how many times a link has been opened, and nothing about who opened it.

9. How it is protected

  • Traffic is served over TLS.
  • Passwords are stored as scrypt hashes, and session tokens are stored hashed too.
  • Every query for a roadmap is scoped to the workspace of the person asking, in one place in the code rather than repeated per endpoint, and that isolation is covered by automated tests.
  • Staff access to a customer account is limited, requires a deliberate action, shows the customer a banner while it is happening, and is written to an audit log.

10. Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, hand it to you in a portable format, or object to processing based on legitimate interest. Two of those need no request at all: you can edit your profile from the account settings, and you can export any roadmap as a file whenever you like.

For the rest, write to [email protected]. We answer within one month. If we get it wrong, you can complain to your national data protection authority - in France, the CNIL, at cnil.fr.

11. Children

Roadkit is a tool for work and is not directed at children. We do not knowingly create accounts for anyone under 16.

12. Changes

If this policy changes in a way that affects you, we will say so on this page and, for anything material, by email before it takes effect. The date at the top is the version you are reading.

See also the terms of service.