Privacy Policy

Effective November 14, 2026

This is a plain-language document. We tried to write it so it is easy to read and says what the service actually does. It is still a binding document, so please read it.

This policy explains how JustRoadmap (“the app”, “the service”) at www.justroadmap.io collects, uses, stores, shares and deletes information, and the choices you have. It applies to the website, the roadmap editor, and the JustRoadmap iOS and Android apps.

Summary

JustRoadmap is a visual roadmap maker. We collect only what we need to run your account and save your roadmaps.
If you sign in with Google, we receive only your Google account ID, email address, name and profile picture, and we use them only to create your account, sign you in and show who is signed in.
If you sign in with Apple, we receive only your Apple account identifier, your email address (or the private relay address Apple creates if you choose to hide it) and, the first time, your name, used the same way.
If you sign in with X, on the website or in the iOS or Android app, we receive only your X account identifier, name, username and profile picture, used the same way. X often doesn't share a verified email, so we ask you for one and verify it with a code before your account is created. We don't post to X or read your posts.
We do not sell your data, show ads, or use your data to train AI models.
We use Google Analytics, through Google Tag Manager, to understand how the website is used. Your sign-in details, including any Google user data, are never sent to it. Google Analytics runs on the website only, never in the iOS or Android apps.
The iOS and Android apps use the same account and the same information as the website. They store a session token on your device in secure storage, have no offline mode, and include no analytics, crash reporting, push notifications, in-app purchases or advertising. See iOS and Android apps.
You can access, correct, export or delete your data. Delete your account yourself from the account menu on the website or in the iOS or Android app (Delete account), or email contact@justroadmap.io.

Who we are

JustRoadmap is operated by Clifty Inc. (“Clifty”, “we”, “us”, “our”), clifty.io. Clifty Inc. is responsible for the personal information described here. Contact us at contact@justroadmap.io.

What the app does

JustRoadmap lets you plan work on a month-by-month timeline. You create roadmaps with lanes and rows, add items and milestones, drag them to change dates, link dependencies, add descriptions, links, checklists and progress, and export a roadmap as a PDF, PNG or JPEG. Your roadmaps save automatically to your account. You need an account so your roadmaps are private to you and available when you come back. You can use JustRoadmap in a web browser or in our iOS and Android apps, with the same account, including personal and team workspaces.

iOS and Android apps

The JustRoadmap iOS and Android apps are part of the same service as the website. You sign in with the same account (email and password, Apple, Google or Sign in with X), and you can use personal and team workspaces. Sign in with X in the apps works the same as on the website: we receive only your X account identifier, name, username and profile picture; if X doesn't share a verified email, we ask you for one and verify it with a code; we never post to X or read your posts. The apps collect your name, email address, user ID and roadmap content. This information is linked to your account and is not used for tracking.

Session tokens are stored on your device in secure storage (the iOS Keychain or the Android Keystore). The apps need a network connection: there is no offline mode, and your roadmaps are fetched from and saved to our servers. The apps use the same authentication, hosting and database providers as the website. They do not include any other third-party services, and they contain no analytics, crash reporting, push notifications, in-app purchases, advertising or tracking code. Our authentication provider does not collect telemetry from the apps. Google Analytics runs on the website only, never in the apps.

You can delete your account in the app from the menu (Delete account). You type DELETE to confirm. Team workspaces you own are transferred to another member or deleted, the same as on the website, and the app signs you out when deletion is complete. See Data retention and Your privacy choices.

Google user data

You can create a JustRoadmap account and sign in with your Google account (“Sign in with Google”). This section explains exactly what we get from Google and what we do with it. Using Google is optional; you can use an email address and password instead.

What Google data we access

We request only the basic sign-in scopes openid, userinfo.email and userinfo.profile. These give us:

Scope	Data	Why we need it
`openid`	Your Google account ID (a unique identifier)	Link your Google sign-in to your JustRoadmap account
`userinfo.email`	Your email address	Identify your account, sign you in and contact you about your account
`userinfo.profile`	Your name and profile picture	Show who is signed in, in the app's account menu

We do not request or access your Gmail, Google Drive, Calendar, Contacts, YouTube or any other Google service or data, and we never receive your Google password.

How we use Google data

Only to create your JustRoadmap account, sign you in, keep your roadmaps tied to your account, and show your name and profile picture in the app. We use your email address to identify your account and, when needed, to contact you about your account or important changes to the service. We do not use Google user data for advertising, profiling, marketing lists, or to develop, improve or train AI or machine-learning models.

How we store and protect it

Your Google sign-in is handled by our authentication provider, which stores your account details. We keep a copy of your email address, name, profile picture URL and account identifiers in our database, run by our cloud hosting and database providers. Data between your browser and JustRoadmap, and between our servers and our authentication provider, is encrypted in transit with HTTPS (TLS). Access to the production systems is limited to the people who operate the service, using accounts protected by the providers' access controls.

How we share it

We do not sell, rent or trade Google user data, and we do not share it with advertisers, data brokers or information resellers. We share it only with the service providers that run JustRoadmap for us (authentication, cloud hosting and database, listed below), under their terms and only to provide the service, or if required by law, or as part of a merger, acquisition or sale of assets with notice to you. No person at Clifty reads your Google user data unless you ask us to (for example, for support), it is needed for security or to investigate abuse, or the law requires it.

Retention and deletion

We keep your Google user data for as long as you have a JustRoadmap account. To delete it, choose Delete account in the account menu and confirm: we immediately delete your account record and all your roadmaps from our database and delete your account at our authentication provider. You can also email contact@justroadmap.io from the address on your account and ask us to delete it; we will do so within 30 days and confirm by email. Copies in provider backups and logs expire on those providers' schedules. You can also remove JustRoadmap's access to your Google account at any time at myaccount.google.com/permissions. Revoking access stops future Google sign-ins; it does not by itself delete the data we already hold, so email us if you also want your account deleted.

Limited Use disclosure

JustRoadmap's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Information we collect

Account information

When you sign up with an email address and password, our authentication provider collects your email address and your password (stored by that provider in hashed form; we never see it), and sends a code to verify your email. When you sign up with Google, we receive the Google data described above. When you sign up with Apple, we receive your Apple account identifier, your email address or, if you choose “Hide My Email”, a private relay address from Apple that forwards to you, and, the first time only, your name. When you sign up with X, on the website or in the iOS or Android app, we receive your X account identifier, name, username and profile picture, plus the email address you enter and verify with a code if X doesn't share a verified one (we never use an unverified address to link accounts). We don't post to X or read your posts. In every case we store your account identifier, email address, name (if provided) and profile picture URL (if provided) in our database.

Team workspaces, invitations and roles

You can create team workspaces, or turn your personal workspace into one (its roadmaps and share links move with it, become visible to the members you invite according to their role, and you get a new, empty personal workspace), and invite people by email. For each invitation we store the invitee's email address, the role offered, who sent it, when it expires (after 14 days) and a hash of the invitation link (not the link itself). If the address has no JustRoadmap account yet, our authentication provider sends one invitation email to it on our behalf; otherwise the person who invited them shares the link. We match an invitation to your account by your verified email address, so if you signed in with an Apple private relay address the workspace Admin needs to invite that address.

Members of a team workspace can see each other's name, email address and role, and see or edit the workspace's roadmaps according to their role (Owner, Admin, Editor or Viewer) and any per-roadmap access an Owner, Admin or the roadmap's creator sets. We store each per-roadmap access setting (member, roadmap and level), whether a roadmap is restricted to listed members, who created each roadmap and who saved it last (so the editor can tell a member “Sam saved changes at 9:41 AM” instead of overwriting their work). Roadmaps in a team workspace belong to that workspace, and its Owners and Admins control who can access them.

An item on a roadmap can have an owner. The owner is either a name someone types or a link to a member of the workspace. When someone picks a member as the owner, we store a link to that member and copy their name (or their email address, if they have not set a name) onto the item. Members who can open the roadmap, and the apps and AI assistants they connect, can see that name as the item's owner. If the member leaves or is removed from the workspace, we remove the link; the copied name stays on the item until someone changes or clears it.

If you create a view-only share link, anyone who has the link and its password can view that roadmap without signing in, and, if you allow embedding, other websites can show it in a frame. Every link has a password and an expiry date of at most 90 days. For each link we store a random link token, whether embedding is allowed, the expiry date, who created it and a salted scrypt hash of the password (never the password itself). When someone enters a link's password correctly, we set a strictly necessary cookie in their browser for up to 12 hours so they don't have to type it again (for embeds, a partitioned cookie that only works inside that website's frame). Share and embed pages are not listed in search engines. Revoking a link deletes it and the roadmap stops being available through it right away. You choose what to share; please don't share links to roadmaps that contain information other people shouldn't see.

Roadmap content

What you create in the app: roadmap names, lanes and their colors, rows, items and milestones with their dates, dependencies, descriptions, links, checklists and progress. For the Risk view we also store each item's planned (baseline) end date, recorded when the item is first given dates and reset only when you choose to, so we can show when work has slipped. Exports (PDF, PNG, JPEG) are generated in your browser and downloaded to your device; we do not store exported files.

Technical and log data

When you use the service, our hosting provider records standard request logs, such as IP address, browser user agent, the page or API requested, the response status and the time. Our authentication provider records sign-in events and may process device and network signals to detect bots and abuse. We also keep temporary in-memory counters of requests per account to limit abuse; these are not stored. In the iOS and Android apps, a session token is stored on your device in secure storage (the iOS Keychain or the Android Keystore) so you stay signed in. Requests from the apps go to our servers over HTTPS, and our hosting and authentication providers record the same kinds of standard logs as for the website.

Usage analytics

Only if you accept analytics cookies (we ask every visitor first; a Global Privacy Control signal counts as no), we use Google Analytics, loaded through Google Tag Manager, on our public website pages (the home page, Features, Contact, Privacy, Terms and Cookie Policy) to understand how people find JustRoadmap (for example, which pages are visited, how they found us, and which browsers and devices people use), so we can improve it. It is not loaded in the app or editor, on sign-in, or on shared, embedded or invitation links, and the page addresses we report to it keep only campaign (utm_) parameters, never other query parameters. Google Analytics collects pages viewed and interactions, device and browser details, the referring site, and an approximate location derived from your IP address, and stores identifiers in cookies.

We do not send your name, email address, account ID, roadmap content or any Google user data from sign-in to Google Analytics or Tag Manager, and we do not use analytics data for advertising. Google processes this data as described in How Google uses information from sites that use its services. You can opt out with the Google Analytics opt-out browser add-on, by blocking cookies in your browser, or by choosing Reject in Cookie settings at the bottom of every page.

Google Analytics runs on the website only. The JustRoadmap iOS and Android apps do not load it, and they contain no analytics, crash reporting, push notifications, in-app purchases, advertising or tracking code.

Product usage data

For team workspaces (never personal workspaces; a personal workspace you turn into a team workspace is counted from then on, never for the time before), we collect daily workspace-level counts to help workspace administrators understand how the product is used and to inform future improvements. This data is collected automatically as you use the service. We collect:

Workspace-level daily counts: active members (distinct count of people who opened, created, edited or exported a roadmap that day), roadmaps created, roadmaps edited, items added, exports, invites sent, invites accepted, and share-link views.
Per-member activity markers: a “was active that day” flag per member (workspace, user, day; stored as one row per member per month), with no counters and no content, kept for 30 days and removed when you delete your account, to compute rolling 7-day and 30-day distinct active-member counts.

We store only these daily and monthly aggregated counts and compact activity markers, not a raw log of every action. We do not collect the names or content of your roadmaps or items. Activity markers are automatically deleted after 30 days. Daily counts are kept for 90 days, then rolled up into monthly totals kept for 24 months. Workspace Owners and Admins can view their own workspace's rolling 7-day and 30-day usage in the workspace settings. JustRoadmap operators can also access this data to understand overall product usage.

We do not use this data for advertising, and we do not sell it. If you have questions about usage data collection, contact contact@justroadmap.io.

Cookies and local storage

We use strictly necessary cookies to keep you signed in, protect sign-in from abuse and remember a share-link password you entered. With your consent, we also use Google Analytics cookies on our public website pages. We don't use advertising cookies or advertising pixels. The full list, with how long each cookie lasts, is in our Cookie Policy, and you can change your choice at any time with Cookie settings at the bottom of every page. The iOS and Android apps do not use website cookies; they store only a session token in secure storage on your device, as described in iOS and Android apps.

How we use information

To create your account, verify your email, sign you in and keep your session secure.
To save, load and display your roadmaps, and to let you edit and export them.
To run team workspaces: send and match invitations, apply roles and per-roadmap access, and show view-only links and embeds you create.
To keep the service reliable and secure: rate limiting, preventing abuse, and investigating errors.
To understand, in aggregate, how the website is used (Google Analytics, on the website only) and, for team workspaces, how the product is used (product usage data), so we can improve the service.
To provide workspace Owners and Admins with usage insights for their workspace.
To respond to your requests and contact you about your account or important changes to the service or policies.
To comply with legal obligations.

We do not sell personal information, use it for advertising, build marketing profiles, or use your content or Google user data to train AI models.

Inside JustRoadmap, your information is visible to other people only when you choose: members of team workspaces you join see your name, email address and role and the roadmaps their access allows, and anyone with a view-only link or embed you or a workspace Owner, Admin or roadmap creator creates can view that roadmap.

We share information only with service providers that run JustRoadmap for us, only as needed to provide the service and under their contractual terms. They fall into these categories:

Authentication and sign-in: sign-up, sign-in, sessions, email verification, sign-in with Google, Apple or X (if you choose them), and invitation emails to people invited to a team workspace.
Email delivery: sends the few service emails JustRoadmap sends itself (today only: telling the members of a team workspace that it was deleted with its owner's account), receiving the recipient's address, the workspace name and the message.
Cloud hosting and database: runs the app and stores your account record and roadmaps, with standard request logs.
Bot and abuse protection on sign-in forms: checks browser and network signals during sign-up and sign-in.
Usage analytics: pages viewed and interactions, using cookies (see Cookies and local storage).

The current list of service providers is available on request at contact@justroadmap.io.

We may also disclose information if required by law or legal process, to protect the rights, property or safety of our users, Clifty or the public, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your information and we will notify you.

Data retention

Account information and roadmaps: kept while your account is active.
A deleted roadmap is removed from our database right away, with its access settings and share links.
When a team workspace's Owner deletes it, its roadmaps, memberships, invitations, access settings and share links are removed from our database right away. Members keep their own accounts and personal roadmaps.
Invitations are deleted when accepted, declined or revoked, and stop working after 14 days.
Share links are kept until they are revoked or their roadmap is deleted; every link stops working on its expiry date (at most 90 days after it was created).
When you delete your account from the account menu on the website or in the iOS or Android app, your account record and all your roadmaps are deleted from our database, and your account at our authentication provider is deleted, right away. Team workspaces you own on your own are deleted with it. For each team workspace you own that still has other members, you choose first: make another member the Owner (the workspace, its roadmaps and its members' access stay as they are) or delete it, which deletes its roadmaps, invitations, per-roadmap access and share links and ends access for every member. We name the workspaces that will be deleted before you confirm, and nothing is deleted until every one has a choice. After the deletion, each other member of a team workspace deleted with your account gets a short email saying the workspace was deleted and they no longer have access; it names the workspace but no people. Your membership of other team workspaces and your per-roadmap access settings are removed; roadmaps in those workspaces belong to them and stay available to their members. If you ask by email instead, we do this within 30 days.
Product usage data (daily workspace-level counts and 30-day activity markers): activity markers deleted after 30 days, all usage data deleted after 24 months.
Records that a service email was sent (a one-way hash of the message type, workspace and recipient, no address), used so nobody gets the same email twice: deleted after 30 days.
Request logs and provider backups are kept for limited periods set by our providers and then deleted.

Security

We use HTTPS everywhere (with HSTS), strict security headers, server-side checks that every request only reaches roadmaps the signed-in user is allowed to access (by workspace role and per-roadmap access), unguessable share link tokens with optional salted password hashes and rate-limited password attempts, input validation and request rate limits, and we rely on established providers for authentication, hosting and the database. Passwords are handled by our authentication provider and never stored by us. No system is perfectly secure; if a breach affects your information, we will notify you as required by law. Please report security issues to contact@justroadmap.io. In the iOS and Android apps, session tokens are stored in the device's secure storage (the iOS Keychain or the Android Keystore).

AI assistants you connect

If you connect an AI assistant or another app to JustRoadmap (through our MCP server or a personal access token), it can read and, if you allow it, change roadmaps in the workspaces you choose, within your own role. We store the connection (its name, the workspaces and access you chose, and when it was last used) and only scrambled (hashed) copies of its tokens. Changes it makes are logged with the assistant's name and the tool used, without roadmap content, kept for 90 days and visible to you and to owners and admins of team workspaces. You can disconnect it at any time under Connected assistants. What you send to the assistant itself is handled by its provider under its own terms.

Limited internal staff access

A small number of authorized JustRoadmap staff can use an internal tool to operate and support the service. It shows account metadata and counts only: for example your email address and name, when you signed up, how you sign in, when you were last active, and how many workspaces, roadmaps and team memberships you have. The tool never shows the contents of your roadmaps (titles, items, notes or checklists), and staff cannot open your roadmaps or sign in as you. Every staff view and action is logged, and that log is kept for 30 days.

Staff can also suspend an account or a team workspace (for example to stop abuse), which blocks access and turns off its share links while keeping its data; reactivate it; resend an email verification code; and carry out an account deletion you ask us for by email, which removes your data the same way as deleting it yourself. Each of these actions needs a recorded reason.

Your rights and choices

A short summary, with a button to change your cookie choice and the account deletion steps, is on Your privacy choices.

Access and export: view, edit and export your roadmaps in the app at any time, or ask us for a copy of your personal information and roadmap data.
Correct: your name, email address and picture come from the account you sign in with and are refreshed each time you sign in; ask us to correct anything you can't change yourself.
Delete: delete roadmaps in the app, delete your whole account yourself from the account menu on the website or in the iOS or Android app (Delete account, which cannot be undone), or ask us to delete it by email.
Revoke Google access: at myaccount.google.com/permissions.

To make a request, email contact@justroadmap.io. We respond within 30 days and may need to confirm that the request comes from the account owner. Depending on where you live (for example, in the EU, UK or California), you may have additional rights under local law, including the right to object to or restrict processing and to complain to your data protection authority. We do not sell or “share” personal information for cross-context behavioral advertising. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of analytics cookies (see our Cookie Policy).

Children

JustRoadmap is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

International transfers

Clifty Inc. and our providers may process and store information in the United States and other countries where they operate. These countries may have different data protection laws than where you live. Where required, we rely on our providers' safeguards, such as Standard Contractual Clauses, for these transfers.

Changes to this policy

We may update this policy as the service changes. We will change the effective date at the top, and for significant changes we will notify you in the app or by email before they take effect. We will not use Google user data in new ways without first updating this policy and, where required, asking for your consent.

Contact

Clifty Inc., clifty.io
Email: contact@justroadmap.io
See also our Terms of Service.