Privacy policy

Last updated 20 October 2026

Trawpie is a team progress tracker run by Rushikesh Vibhandik for student and research project groups. He is the data controller: the person responsible for your information under UK data protection law (UK GDPR). This page explains what Trawpie keeps, why, how long, and your rights. Questions or requests: rushivibhandik.college@gmail.com.

What we store

Your account: your name, email address and, if you add one, your profile photo. Sign-in is handled by Google Firebase Authentication (email and password, "Sign in with Google", or "Continue with Microsoft" where the site offers it), which also records when you signed up and last signed in.
Your teams' work: the teams you belong to and your role, and what you and your teammates add: weeks, tasks, deadlines, sub-tasks, time logged, comments and @mentions, lab notebook entries, meetings, parts, spending and budgets, papers, risks, requirements, team logos and links to files. Each record notes who made or last changed it.
Your settings: your theme, menu style and which emails you want.
Student verification (optional): if you verify a university email to get Pro Education, that address and when it was verified. The 6-digit code is stored only as a scrambled hash and deleted once used.
Feedback you send with the Feedback button: your message, name and email, and, if you leave it ticked, the page, browser, app version and recent error messages. Never your task contents.
Error reports: when something crashes in your browser, the error message, where in the app it happened, the browser and app version, and your account ID. Email addresses and long numbers are removed from the message first.
In your browser only: a few settings such as filters, unsent comment drafts and which mentions you have read. These never leave your device.

Everything except the browser-only settings is stored in Google Firebase (Cloud Firestore, in London, europe-west2). Team data is visible only to members of that team, as enforced by the database's security rules; your name and photo are shown to the teams you join. Feedback and error reports can be read only by the Trawpie administrator.

Why we use it (lawful basis)

To provide the service you signed up for (contract): your account, your teams' work, invitations and the emails you choose to receive.
Legitimate interests: keeping Trawpie secure and working (error reports, bot protection, backups) and improving it from your feedback.

Emails

Trawpie sends emails through Resend, an email delivery service: invitations to join a team, student verification codes, and, if your team has Pro and you haven't turned them off, @mention notifications and a Monday summary. Resend receives the recipient's address and the email's contents in order to deliver it, and may process them outside the UK under its data processing terms. Turn notifications on or off in your account.

Bot protection

To make sure requests to the database come from the real Trawpie app and not from scripts, the site uses Firebase App Check with Google reCAPTCHA Enterprise. It checks signals from your browser and device in the background (no puzzle to solve) and sends them to Google for this purpose. Google's use of this information is covered by the Google Privacy Policy.

Google Drive, Sheets and Calendar

These features are optional and only run when you press the button for them. You sign in to your own Google account and approve access; Trawpie runs in your browser and talks to Google directly. It asks for the narrowest permissions available:

Google Drive (drive.file): to upload a file you choose into a Trawpie folder in your Drive, share it with your team, and create the Google Sheets you export to. Trawpie can only see files it created or that you picked, never the rest of your Drive.
Google Calendar (calendar.app.created): to create a separate "Trawpie" calendar in your account and keep task deadlines and project phases in it. Trawpie cannot see or change any of your other calendars.

The access is only used for these actions. Trawpie does not keep your Google access token on a server, does not read your other Google data, and stores only the link to an uploaded file (with the task it belongs to).

Trawpie's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft OneDrive

Where the site offers it, "Upload to my OneDrive" works the same way: you sign in to your own Microsoft account and approve access (Microsoft Graph Files.ReadWrite). Trawpie uses it only to upload a file you choose into a Trawpie folder in your OneDrive and share it with your team; it stores only the link. You can remove the access at any time from your Microsoft account's app permissions.

GitHub links

If you add a link to a GitHub issue or pull request, your browser asks GitHub's public API whether it is open, closed or merged. No GitHub account is used and nothing about you is sent to GitHub beyond the request itself.

AI summaries

"Copy for AI" builds a text summary of the board that you can paste into a chatbot of your choice; nothing is sent automatically. If you choose to add your own Gemini API key, the summary is sent from your browser to Google's Gemini service with that key, which is kept only in your browser.

What we don't do

We don't sell or rent your information, or use it for advertising.
We don't use advertising or tracking cookies or analytics.
We don't share your information with anyone outside your teams, except the service providers that run Trawpie: Google (Firebase, reCAPTCHA, and Drive, Sheets or Calendar if you use them), Resend for email, and Microsoft OneDrive if you use it.

How long we keep it

Your account and settings: until you delete your account.
Team data: while the team exists. A team owner can delete the team, which removes everything in it.
Error reports: deleted automatically after 30 days. Feedback: after one year.
Backups of the database (for recovering from mistakes or failures): daily copies are kept for 30 days and weekly copies for 14 weeks, then deleted. Deleted data disappears from backups on that schedule.

Your rights

See your data: Your account ▸ App and data ▸ Download my data gives you a file with everything Trawpie stores about you.
Correct it: change your name and photo in Your account; edit your work in your teams.
Delete it: Your account ▸ App and data ▸ Delete my account. Your login, profile, settings, memberships, student verification, feedback and error reports are deleted, and teams where you are the only member are deleted with everything in them. Work you shared in other teams (tasks, comments, notes) stays for your teammates, but your name on it is replaced with "Former member". If you own a team that has other members, first make one of them the owner (Settings ▸ Members ▸ Make owner).
Object, restrict or move your data: email rushivibhandik.college@gmail.com. We reply within one month.
Files you uploaded stay in your own Google Drive; you can delete them there. You can remove Trawpie's access to your Google account at any time at myaccount.google.com/permissions, and delete the Trawpie calendar in Google Calendar.
If you're unhappy with how your data is handled, you can complain to the UK Information Commissioner's Office at ico.org.uk.

Children

Trawpie is meant for university and research teams and isn't intended for children under 13.

Security

Data is sent over HTTPS and stored by Google Firebase. Access is limited by team membership and role (owner, admin, member, viewer), checked on the server.

Changes

If this policy changes, the date at the top will change. Significant changes will be announced in the app.