Card Vault+ Privacy Policy

Last updated: July 3, 2026

Card Vault+ is a Trello Power-Up that saves card snapshots so teams can recover deleted cards and restore older card content. This policy explains what Trello data we access, what we store, why we store it, and how you can control your data.

What Card Vault+ Does

When you enable Card Vault+ on a Trello board, the Power-Up can save snapshots of card content (manually or automatically), show version history, and restore selected fields or recreate deleted cards from saved snapshots. Card Vault+ is card-focused recovery—not a full Trello workspace backup.

Trello Data We Access

With your authorization, Card Vault+ accesses Trello through the official Trello API to:

Read board, list, and card data needed for snapshots and restore previews
Write card updates when you confirm a restore
Register and receive board webhooks for automatic snapshot triggers
Identify your Trello member account during sign-in

Information We Store

Trello account identifiers: Trello member ID, display name, and email when provided by Trello during authorization
Authorization data: Encrypted Trello access tokens on our servers (not exposed to the Power-Up frontend)
Board and card metadata: Connected board IDs, board names, board URLs, protection status, list IDs/names, card IDs, card names, labels, due dates, and board settings you configure
Card snapshots and restore data: Card descriptions, checklists, member metadata, attachment metadata, comments metadata (when enabled), and raw Trello card JSON needed for restore
Operational data: Sync jobs, restore jobs, webhook event metadata, and audit logs needed to operate and secure the service

Card snapshots may contain personal data if your Trello cards include names, emails, or other identifying information in descriptions, comments, or member fields.

Why We Store This Data

Save and retain card snapshots you request or that are captured by automatic saves
Show snapshot history, board health, and recoverable cards in the Power-Up
Restore card content to Trello when you confirm a restore
Operate webhooks, scheduled sync, retention cleanup, and support workflows
Secure the service, prevent abuse, and troubleshoot failures

We do not sell your Trello card content.

Where Data Is Stored

Card snapshots and recovery data are stored in our backend database (PostgreSQL) hosted with our infrastructure provider. Data is not stored in browser localStorage, cookies, or Trello pluginData as the source of truth for recovery.

Small UI preferences in the Power-Up may use browser storage; those preferences are not used as recovery data.

Retention

Snapshot retention depends on your board settings (for example 30 days, 90 days, 1 year, or forever). Expired automatic snapshots are deleted according to your retention policy. Manual snapshots may be kept longer when “keep manual snapshots forever” is enabled. Audit and restore logs may be kept longer for security and support.

Your Choices and Deletion Requests

Revoke Trello authorization from Trello account settings or Card Vault+ reconnect flows
Disable automatic saves or board protection in Card Vault+ settings
Use Trello’s “Remove Personal Settings” for Card Vault+ to clear Power-Up private data stored in Trello
Email us to request deletion of board snapshot data or account-related personal data, subject to legal and operational requirements

Revoking Trello access stops new snapshots and restores that require Trello API access. We process Trello GDPR compliance notifications (account deletion, token revocation, and profile updates) through Trello’s Compliance Polling API when background jobs are enabled in production.

Restore Limitations

Restore recreates a new Trello card or updates an existing card from saved snapshot data. It does not guarantee recovery of attachment files, exact card position, full comment history, or all Trello metadata. Cards that were never snapshotted while protection was enabled cannot be recovered.

Security

We encrypt Trello tokens at rest, use HTTPS in production, scope API access by user and board, and avoid logging sensitive card content in production logs.

Data Processors

We use infrastructure providers to host the API, database, and background jobs. Those providers process data only as needed to run Card Vault+. We may disclose information when required by law or to protect the security and rights of users and the service.

Contact

Privacy questions or data deletion requests: support@nikaj.dev