How we look after your account and your data

Accounts and sign-in

• Passwords must be at least 12 characters and are checked against known data breaches (using Have I Been Pwned, which never receives your password).
• Sign-up, sign-in and password resets use one-time codes sent by email.
• Sessions run over HTTPS only. You're signed out after 12 hours without activity, and every 14 days at most.
• Changing your password signs you out everywhere else. You can also sign out of all devices from your account settings.
• Repeated failed sign-ins are slowed down to stop password guessing.

Your Backlog connection

• Chronigami only changes two things in Backlog: an issue's Actual Hours (if an admin turns this on) and new issues created from Portal forms. See How it works for the full list of what we read and write.
• Backlog access tokens are encrypted at rest.
• Each workspace's data is kept separate from every other workspace's.

Where your data lives

Chronigami runs in the United States. The database is hosted by Neon on AWS in Ohio (US East), and the application by Render in Virginia (US East). Email is sent through Postmark. Spam protection on forms is provided by Cloudflare Turnstile.

Payments

Payments are handled by Paddle, our merchant of record. Card details go straight to Paddle and never reach Chronigami.

Your data, your control

• Admins can export reports to CSV or Excel at any time, even if a subscription has lapsed.
• Deactivating a user signs them out everywhere immediately.
• To request a copy of your workspace's data, or its deletion, email support@chronigami.com. We respond within 30 days.
• When a subscription ends, that product's data is kept for 90 days, then deleted permanently. Admins are emailed before anything is deleted.

Service providers

The companies that process data on our behalf are listed in our Privacy Policy.

Reporting a security issue

Found a vulnerability? Email support@chronigami.com with details. We'll acknowledge it and keep you updated.