Peel is a retro board built so that we can't read what your team writes. This policy explains the little we do process, why, and what you can ask of us. It covers the Peel website, web app, and the Slack and Microsoft Teams apps (together, “Peel”). It is written to meet the EU/EEA and UK General Data Protection Regulation (“GDPR”) and Türkiye's Personal Data Protection Law No. 6698 (“KVKK”).
1. Who we are
Peel is operated by 1801 Labs (İstanbul, Türkiye) (“we”, “us”). For account, billing-status, integration and support data we are the data controller. Contact: [email protected].
2. The short version
- Participants never create an account. They open a link, pick a name and an animal avatar.
- Board content is end-to-end encrypted. Card text, names, board titles, votes and stickers are encrypted in your browser with a key that lives in the part of the link after “#”, which browsers never send to servers. We store and relay ciphertext we cannot read.
- No analytics, no ads, no tracking cookies. No third-party scripts run on Peel, except Paddle's checkout script on the checkout page.
- Unclaimed boards are deleted 60 days after the last visit.
3. What we process and why
3.1 Boards (everyone)
Encrypted content (cards, GIF choices, names and avatars shown on the board, board name, custom template titles, votes, reactions, stickers, actions, check-ins): stored as ciphertext in a Cloudflare Durable Object so the board works in real time. We cannot decrypt it and do not have the keys.
Plaintext metadata needed to run the service: the type of each operation (e.g. “card added”), its size and server timestamp, the board phase, participant and card counts, the catalogue template id (never a custom title), a lock flag, creation and expiry times. Purpose: delivering the board, limits and abuse prevention, live status in Slack/Teams, and anonymous daily counters (e.g. “boards created”) without any identifiers. Legal basis: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) and our legitimate interest in running a secure service (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
3.2 Network data
Like any website, your IP address and browser details reach Cloudflare's network when you connect. They are used transiently to deliver traffic, enforce rate limits and stop abuse. We do not store IP addresses in our databasesand do not use them to identify you. Legal basis: legitimate interests (security and availability).
3.3 Facilitator accounts (optional)
If you sign in with Google, Apple or Microsoft Entra ID (via Teams), we receive and store a provider account identifier, your name and, if the provider shares it, your email address; which providers you linked; and when the account was created. We also store a key bundle that your browser encrypts with a key derived from your passkey or recovery code — we only ever hold ciphertext. We set one session cookie (see §5). Purpose: keeping boards beyond 60 days, syncing them across devices, team spaces and paid features. Legal basis: contract.
3.4 Payments
Paid plans are sold by Paddle.com Market Ltd (“Paddle”), our merchant of record. Paddle collects your payment details, billing address and tax information and acts as an independent controller under its own privacy notice. We receive your plan, subscription status and period, Paddle customer and subscription identifiers, and country. We never see your card number. Legal basis: contract; legal obligations for records we must keep.
3.5 Slack and Microsoft Teams (when a workspace installs Peel)
We store the workspace or tenant id, the channel or conversation id, message timestamps for live status updates, and the bot token (encrypted at rest). Messages we post contain the board link and metadata (title, phase, counts). Card text is only sent to Slack or Teams when a facilitator explicitly posts a summary after a confirmation dialog. If a team turns on mentions, we look up member ids to mention action owners. Legal basis: contract with the installing organisation; legitimate interests.
3.6 GIFs
GIF searches go through our server to GIPHY so that GIPHY does not receive participants' IP addresses. GIPHY receives the search term and language only. Images are served from our cache.
3.7 Support and security reports
When you email us we process your email address and what you write, to answer you. Legal basis: legitimate interests; contract where it concerns your subscription.
4. What we don't do
- We don't read, analyse, train models on, or sell board content. We can't read it.
- We don't use analytics SDKs, advertising, profiling, fingerprinting or third-party tracking.
- We don't make decisions about you based solely on automated processing.
5. Cookies and local storage
Signed-in facilitators get one strictly necessary cookie, peel_session (httpOnly, Secure, SameSite=Lax), which keeps you signed in. Your browser's local storage keeps your theme and language preferences and, for boards you created, the board keys — these never leave your device unless you sign in, and then only inside your encrypted key bundle. Because we use no analytics, advertising or other non-essential cookies, consent is not required under the ePrivacy rules and we don't show a cookie banner. The checkout page loads Paddle, which may set cookies needed to process your payment (see Paddle's cookie policy).
6. Who receives data
- Cloudflare, Inc. — hosting, real-time servers, databases and storage (processor). Peel runs only on Cloudflare.
- Paddle — payments, invoices and tax (independent controller).
- Google, Apple, Microsoft — sign-in, only if you choose that provider.
- Slack, Microsoft — only when your organisation installs the integration and only what is described in §3.5.
- GIPHY — search terms, via our proxy.
- Our email provider — support correspondence (Cloudflare Email Routing).
- Authorities, where we are legally required to — and even then we can only hand over ciphertext and metadata.
7. International transfers
Cloudflare and Paddle process data on global infrastructure, including outside Türkiye and the EEA. Where required we rely on the European Commission's Standard Contractual Clauses (and the EU–US Data Privacy Framework where the recipient is certified) and, for transfers from Türkiye, on the standard contracts under KVKK Article 9, notified to the Personal Data Protection Authority as required.
8. How long we keep data
- Boards without an account: deleted 60 days after the last visit (each visit resets the clock).
- Boards claimed by an account: until you delete them or your account. If you delete your account, its boards get the 60-day expiry back.
- Account and key bundle: until you delete your account (you can do it yourself in “My boards”).
- Sessions: until you sign out or the session expires.
- Integration data: until the app is uninstalled or the token is revoked.
- Subscription records: as long as tax and commercial law require (up to 10 years in Türkiye).
- Support email: up to 24 months after the conversation ends.
9. Your rights
Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Under KVKK Article 11 you can learn whether your data is processed, request information, learn the purpose and recipients, request correction or deletion, object to results of automated analysis, and claim compensation for unlawful processing. Write to [email protected]; we answer within 30 days. You can also complain to your data protection authority — in Türkiye the Kişisel Verileri Koruma Kurumu, in the EU your local supervisory authority.
Because board content is encrypted with keys we don't have, we cannot search it for your name. We can delete a board if you prove you own it (see Support); we will never ask for the part of the link after “#”.
10. Children
Peel is meant for teams at work and school and is not directed at children under 16. Facilitator accounts require you to be at least 16.
11. Security
End-to-end encryption, TLS everywhere, a strict Content Security Policy and least-privilege access. Details on our security page.
12. Changes
We will post changes here and update the date above. Material changes will be announced on the site and, for account holders, by email in advance.