How Superboard approaches trust, privacy, and security

• We do not sell customer data or use it for advertising.
• We use customer data to operate, secure, support, and improve Superboard, including Ava. This can include review by our team.
• Approved AI service providers process the context needed to do the work. Their terms do not allow them to train their models on that customer data.
• The operational privacy article explains current handling in more detail.

Anonymous hosted use is local-first in the browser. Signed-in cloud Boards use Superboard’s authenticated service and canonical cloud storage when configured. A local namespace in a URL is not an access-control boundary, and private product and API routes stay excluded from public crawling.

Files and AI requests may cross additional service boundaries when the relevant feature is used. The current Privacy Policy—not an architectural slogan—is the public authority for categories, purposes, providers, retention, deletion, and support access.

Support access is for operating, securing, troubleshooting, and improving the product. It is not permission to turn customer Boards into public examples. Public screenshots use deterministic fixtures or separately sanitized public-safe records.

When Ava sends necessary context to an approved AI provider, the product should send the bounded context needed for that request. Provider processing does not expand what Ava is allowed to do, and a provider’s model capabilities do not become current Superboard capabilities by association.

Superboard is being built for people whose operating picture cannot be treated as disposable. The founder spent five years building AI and leading teams for enterprise software at Microsoft. That experience informs the security, recovery, auditability, and operational discipline of the product.

Superboard intends to pursue SOC, ISO, and other certifications as product maturity and customer requirements justify them. Those certifications are direction, not a claim of current certification.

Superboard is responsible for describing its data handling and security boundaries truthfully, operating the service within those boundaries, and making current controls and limitations understandable. The Owner decides which work belongs in Superboard, which supported files, providers, and connections to use, and whether the current product boundary fits the sensitivity and consequence of the mission.

The Owner also keeps the consequential judgment: what outcome is acceptable, which relationships or commitments need care, and when the work should stop or change direction. Using Ava or an external provider does not transfer that responsibility or silently create new authority.

Privacy and security protect how data is handled. Recovery protects the Owner from mistakes made by the Owner or through AI-supported work. They are different protections and deserve separate explanations.

The Recovery guide explains what can be undone or restored today and what remains product direction.