Privacy Policy: summary

Summary of the Russian version of 31 October 2026.

This is a summary for convenience. The legally binding version is the Russian one: Privacy Policy in Russian. In case of discrepancy the Russian version prevails.

What this document is

• The Policy describes which personal data of the users of the colabro service at colabro.app (the Service), and of the people they invite to workspaces, its operator Автор сервиса colab (физическое лицо) (the Operator) processes, why, for how long, and how users can manage it. It follows Russian Federal Law No. 152-FZ "On Personal Data".
• It covers account and invitation data. What users put into workspaces is their content: they are responsible for it and for having a basis to process other people's data there (section "Your content" of the Terms). The Operator only stores it and shows it to those the user gave access to, and does not use it for its own purposes.

What data and why

• Email address (from you or from Google and Yandex): sign-in, invitations to workspaces, service letters (confirming the address, a link to set a new password), replies to your requests.
• Name (from you or your Google and Yandex profile): shown to the members of your workspaces and in the journal of edits.
• Google or Yandex account ID and whether the email is verified: sign-in, checking invitations by email.
• Password, only as an irreversible hash: sign-in.
• Whether the address given at sign-up is confirmed; links to confirm the address and to set a new password, as hashes with a term (made at sign-up and on your request: “Forgot your password?”, “Send the letter again”): confirming the address, getting back in.
• Sessions, personal tokens and accesses of connected applications, as hashes with their dates, and the time of the last sign-in: sign-in, showing and revoking access on the Account page.
• IP address, time and type of event (sign-in and failed sign-in, sign-up, password change, granting and revoking access, administrator actions): protection against password guessing and abuse, investigating incidents (the audit log).
• IP address, requested address, time and result of the response: running and debugging the Service (technical server logs).
• Email address of a person invited to a workspace and their answer (entered by the workspace owner, who is responsible for the basis for it): the invitation, the owner's list of members, not inviting again after a refusal.
• Who changed records in workspaces and when: the history of changes and undoing edits.

A connected agent can send the Operator a short description of a feature it missed, without data from your workspaces; it is kept with your account, deleted with it, seen only by the administrator of the Service, and can be turned off on the Account page.

No payment data, phone numbers, documents or geolocation are collected; no analytics, counters or advertising systems are used; data is not sold or passed on for advertising.

Grounds: performing the Terms you are a party to, and for the audit log and the server logs also the Operator's legitimate interest in protecting the Service and accounts (points 5 and 7 of part 1 of article 6 of Law No. 152-FZ).

Where the data is kept

• Data is kept in a database on a server in the Russian Federation; backups are also kept in the Russian Federation.
• Connections are encrypted (HTTPS). Passwords, tokens and sessions are kept only as hashes. Only the administrator of the Service sees the audit log and the list of users.

How long

• Account data: while the account exists; it is deleted with the account. Edits in other people's workspaces stay in their history without your name and email address.
• Audit log: 180 days, then deleted automatically. When an account is deleted, its entries lose the account ID, email addresses and IP addresses.
• Address in an invitation: until it is accepted or revoked or the workspace is deleted. An invitation is valid for 30 days; an unanswered one is deleted 30 days after it expires. Once accepted, the address stays in the list of members while the person is a member. A declined invitation and the mark of refusal are kept for 30 days, and during that time the address cannot be invited to the same workspace again. When an account is deleted, the invitations to its addresses and the marks of refusal are deleted. Invitation events stay in the audit log for 180 days.
• Sign-in session: until you sign out, at most 30 days.
• A link to confirm the address is valid for 24 hours, a link to set a new password from a letter for 1 hour; a used link is deleted at once, an expired one when the next is made or with the account.
• Technical server logs: limited in size, old entries are overwritten automatically.
• History of changes of a workspace: while the workspace exists.
• Backups (daily ones and those made before a database structure update): 30 days, then deleted automatically; deleted data stays in them no longer than that.

Cookies and browser storage

Only cookies needed for the Service to work, no analytics or advertising:

• colab_session: the sign-in session, including a guest's by an access link; up to 30 days, not readable by the scripts of the page.
• colab_oauth (or __Secure-colab_oauth): only while signing in with Google or Yandex, up to 10 minutes.
• colab_lang: the chosen language of the interface; up to 1 year; used only to show pages in that language, holds no personal data.

Browser storage keeps interface settings (for example, whether the journal is open); they are not sent to the server.

Who receives data

• Google and Yandex, if you sign in with them: you sign in on their site and they pass the Service your ID, email address and name. No data from the Service is passed to them; what they learn about the sign-in itself is governed by their policies.
• Yandex Cloud (Yandex.Cloud LLC), to send service letters: confirming the address at sign-up and a link to set a new password. The sending service gets the recipient’s address and the text of the letter; the data is processed in the Russian Federation. The Service sends no mailings or advertising letters.
• Providers of AI agents, only by your decision: an agent you connect gets data with your rights and passes it to its provider on the provider's terms.
• Other users: members of your workspaces see your name next to your edits; the owner of a workspace also sees your verified email address in the list of members.
• The hosting provider provides the server in Russia and does not access the data in normal operation.
• State authorities: only on a demand based on the law.

Your rights

• You may find out which of your data is processed, get a copy, demand that it be corrected, blocked or deleted, withdraw consent where processing is based on it, and appeal against the Operator's actions to Roskomnadzor or a court.
• Name, password and sign-in methods are changed on the Account page. Anything else: a request to the Operator (the address is under Contacts) from the email address of your account. The Operator replies within 10 working days.
• You can delete your account yourself: Account → Delete account; the page lists what will be deleted and asks you to confirm with your password or by signing in again with Google or Yandex. The account of the administrator of the Service and the account named in the server settings are deleted by the Operator on request. What is deleted is described in the Terms. The Service cannot be used without an account, so a demand to stop processing account data means deleting the account.

Changes to the Policy

The Operator may change the Policy. A new version is published on the page of the Russian text with its date and applies from publication.

Contacts

• Operator: Автор сервиса colab (физическое лицо).
• Address for requests about personal data: info@colabro.app.