Security & Privacy
Careful With Student Work, by Default.
What we store, where it lives, who can see it, and how accounts are protected, in plain language. The Privacy Policy is the full legal version.
Your account
Protected from the moment you sign up. Every account gets the same protections, with nothing to switch on.
Hashed passwords
Passwords are hashed with bcrypt before they're stored. We never keep a password in plain text.
Confirmed email addresses
Every account confirms its email with a single-use link, and joining a class requires it.
Guessing gets slower
Repeated wrong passwords make each further attempt wait longer, and the account owner gets an email when that starts.
Sessions you control
You stay signed in for up to 30 days. Sign out of all other devices from Settings, and changing your password signs you out everywhere.
Who can see what
Classes keep each group's work inside the group. What someone can open depends on where they sit in the class.
Group boards
A group's board is visible to the students in that group and the teachers covering it. Class group boards can never be shared with a public link.
Co-teacher boundaries
A co-teacher limited to certain groups can't see the rest of the class: not the other groups, their students or their boards.
Personal boards
Only people who join through your invite link can open your own boards. A read-only public link is off until you turn it on, never shows assignees, comments or attachments, and can be regenerated to cut off the old one.
Attachments
Files are stored separately from the database, and new uploads are served through links that expire after one hour.
Where your data lives
A short list of providers, and no third-party trackers.
Database in Singapore
Accounts and board content are stored with Supabase, in Singapore.
Encrypted in transit
Every connection between your browser and Kanbedu uses HTTPS.
No ads or third-party trackers
No advertising cookies, no third-party tracking cookies and no Google Analytics. Our own log of which features get used stays in our database and is deleted after 180 days. We don't sell your data.
A short list of providers
Supabase, Google Cloud Storage, Vercel, Brevo for email and GitHub for encrypted backups. The Privacy Policy says what each one receives.
Your data
Your data, your call. Delete it, ask for a copy, or ask what we hold.
Delete your account
Delete it yourself from Settings. Your account, activity history, uploaded files and any board only you are on are removed straight away. Shared boards stay with the other members, and a class you own has to be deleted first.
Activity your lecturer sees
In a class, your lecturer sees activity such as comments posted and how tasks moved. It's a prompt for a conversation, and Kanbedu never makes a decision about you automatically.
Requests about your data
Email kanbeduapp@gmail.com for a copy of your data, a correction or a deletion. We aim to reply within 30 days.
Found a security problem?
Tell us at kanbeduapp@gmail.com.
Read the Full Versions.
The Privacy Policy and Terms of Service are the legal detail behind this page.