What the app can see, what it keeps, and when it deletes it.

• crm.objects.contacts / companies / deals — read and write: to read the tag property on the record you are looking at, save the tags you tick, and replace or remove a tag on records when an admin merges or deletes it.
• crm.schemas.contacts / companies / deals — read and write: to create the Tags property and its group, list your multiple-checkbox properties in the settings page, and add, rename or remove tags, which HubSpot stores as the property's options.
• settings.users.read: before any change on the settings page, to check that the signed-in user is a Super Admin.
• oauth: required by HubSpot for every app.

The app requests no sensitive-data scopes and no access to email, files, conversations, tickets or anything else.

In a Cloudflare D1 database:

• Your HubSpot account ID, and when the app was installed and last used.
• The app's OAuth refresh and access tokens for your account, encrypted with AES-256-GCM.
• The list of permissions HubSpot granted.
• Your settings: which property holds tags for each object, and whether users may create tags from the card.
• The colour of each tag, stored against the tag's internal value (for example vip_customer → blue).
• After an uninstall, the date we detected it, kept for up to 30 days.

We do not store any record data: no names, email addresses, companies, deals, notes or property values. Tag names live in HubSpot, as the property's options. While a request is being handled, our backend sees the record ID and the tags involved; it keeps none of it.

The backend runs on Cloudflare Workers, and the database is Cloudflare D1, hosted in North America. Cloudflare, Inc. is our hosting provider and only subprocessor. The backend talks to HubSpot's API and nothing else. There are no analytics, no advertising, no cookies and no AI processing.

HubSpot adds the ID and email address of the signed-in HubSpot user to each request the card makes. The backend uses the account ID to find your tokens. For changes on the settings page, it also asks HubSpot whether that user is a Super Admin and remembers that user's ID with the yes-or-no answer, in memory, for five minutes. Nothing about users is written to the database: no user IDs, names or email addresses.

• It does not read or change the value of any property other than the one that holds your tags. To offer a choice of property in the settings, it reads the list of your property definitions, not their values. About users, it only reads whether one is a Super Admin.
• It does not create, delete or merge records.
• It does not act on its own. Every change comes from someone clicking in the card or the settings page.
• It does not sell, share or use your data for anything else, including training AI models.

• Tokens are encrypted at rest with a key kept in Cloudflare's secret store, separate from the database.
• All traffic uses HTTPS.
• Logs record the account ID, the route and errors. They never contain tokens, email addresses or record data.
• Access to the Cloudflare account is limited to our engineers.

Report a security concern to [email protected]. Please don't post it publicly.