Privacy Policy

Last updated: 2026-05-10

This Privacy Policy explains how Hoot collects, uses, and protects personal data when you use the service. We follow the Brazilian General Data Protection Law (Lei nº 13.709/2018 — LGPD).

1. Who is the data controller

Hoot is operated by the team behind it and acts as the data controller for personal data of account holders. For data submitted to a board (e.g. feedback from end users), the board owner is the controller and Hoot acts as a data processor on their behalf. Contact: [email protected].

2. What data we collect

• Account data: name, email, password (hashed), language preference, and, if you sign in with a social provider, the provider ID and avatar.
• Content you create: projects, boards, posts, comments, votes, files, invitations.
• Feedback submissions on your boards: the name, email and message provided by the submitter.
• Technical data: IP address, browser, device, and pages visited, collected through logs and cookies needed to operate the service.

3. Why we use it (legal basis)

• Performance of contract: to create your account, host your boards, and provide the service.
• Legitimate interest: to keep the service secure, prevent abuse, and improve features.
• Consent: when you opt in to optional communications or features that require it.
• Legal obligation: to comply with applicable laws and lawful requests from authorities.

4. Cookies

We use cookies that are strictly necessary to keep you signed in, remember your language preference, and protect against CSRF attacks. We do not use third-party advertising or cross-site tracking cookies.

5. Sharing with third parties

We share personal data only with service providers that help us run Hoot, under written agreements that require adequate protection:

• Hosting and infrastructure providers;
• Email delivery providers (transactional emails);
• Authentication providers you choose to sign in with (e.g. Google, GitHub).

We do not sell personal data.

6. International transfers

Some providers may process data outside Brazil. When this happens, we rely on the safeguards permitted by LGPD, such as standard contractual clauses or transfers to countries with an adequate level of protection.

7. Retention

We keep account data for as long as your account is active. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where retention is required by law (e.g. tax or audit obligations) or to defend legal claims.

8. Your rights

Under LGPD, you have the right to:

• Confirm whether we process your personal data and access it;
• Correct incomplete, inaccurate, or outdated data;
• Anonymize, block, or delete unnecessary or excessive data;
• Port your data to another service provider;
• Withdraw consent and request deletion of data processed under consent;
• Object to processing carried out under legitimate interest;
• File a complaint with the Brazilian National Data Protection Authority (ANPD).

To exercise any of these rights, email [email protected]. We will respond within the period required by law.

9. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS), hashed passwords, access controls, and audit logging. No system is 100% secure; we will notify the ANPD and affected users about security incidents as required by law.

10. Children

Hoot is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us so we can remove it.

11. Changes to this Policy

We may update this Policy. When we do, we will update the "Last updated" date above and, for material changes, notify you by email or in-app notice.

12. Contact

For privacy questions or to exercise your rights, contact us at [email protected].