What the app reads, what it keeps, and what it never does.

• boards:read — status values, status labels, and the board activity log, so the app can see when a status changed and rebuild an item's history the first time it sees it.
• boards:write — to create and update the app's own number and date columns. It writes nowhere else.
• webhooks:write — to register a board webhook, so a status change reaches the app immediately for the stuck-item trigger.

Nothing else is requested. There is no scope for users, updates, files, or any other board data.

In monday code's Document DB, encrypted at rest:

• Your monday account id, and the install state and subscription plan monday reports for it.
• Board, item and column ids — identifiers, not names.
• Status label ids and their text (for example "Waiting on client"), and the timestamps of changes between them.
• Accumulated hours per label per item, and the moment each item entered its current status.
• The webhook URL of each workflow subscription, the ids of board webhooks the app created, and one timer row per item being watched for an SLA.
• The latest AI analysis for each board, and a daily count of analyses per account.

It does not store item names, people, email addresses, updates, files, or any other content from your boards. Item names shown in the board view are fetched by your browser using your own monday permissions and never reach the app's backend.

The backend and the board view run on monday code (Google Cloud Run, in your account's region where monday offers multi-region). There are no analytics, no advertising and no cookies.

One exception: the AI analysis. When someone clicks Explain bottlenecks, the app sends that board's column titles, status names, item counts and hours per status to Anthropic's Claude API. It does not send item names, ids, board names, people, updates or files. Anthropic is our only subprocessor and does not train its models on API data. Nothing is sent unless someone clicks the button.

• It does not read or store the content of your items — names, updates, files or any column other than the status columns it measures.
• It does not write to any column except the number and date columns it manages.
• It does not change statuses, move items, delete anything, or act on your boards on its own. Only automations you build can cause it to act.
• It does not sell your data. The only thing it shares is the AI request described above, sent to Anthropic when someone asks for it. Your data is never used to train any model.

• Every inbound request is verified: signature, expiry and the audience it was issued for.
• Secrets live in monday code's secret store, are read at start-up, and are never logged or committed.
• All request bodies are validated against a schema; queries to monday use named operations and variables, never assembled strings.
• Logs contain ids, counts and error messages — never tokens or payload bodies.
• Security headers are set on every response, and the board view can only be framed by monday itself.

Report a security concern to [email protected]. Please do not post it publicly.