Privacy Policy
Last updated: 8 October 2026
This policy explains in plain words what personal data Slicemap collects, why, who can see it and how long it is kept. It is written to meet the EU and UK General Data Protection Regulation (GDPR and UK GDPR) and Russian Federal Law No. 152-FZ “On Personal Data”, which applies because the operator lives in Russia.
Who is responsible for your data
Slicemap is run by Dmitrii Sergeevich Bugaev, a private individual in Volgograd, Russia (the operator, “we” in this policy). He is the controller of your personal data: the person who decides how it is used. Email: [email protected]. The full postal address is available on request.
There is no data protection officer: write to the operator directly.
We have not yet appointed a representative in the EU or the UK under Article 27 of the GDPR and the UK GDPR. When we do, their name and contact details will appear here.
This policy covers the website slicemap.dev, the app at app.slicemap.dev and the package for connecting a coding agent that you run on your own computer.
What data we collect
- Your name and email address, which you give when you sign up.
- Your password, if you set one, stored only as a hash (a one-way transformation that cannot be turned back into the password).
- If you sign in with GitHub or Google: what that service sends us once you allow it—your account ID there, name, username, email address and the link to your profile picture. We never get your password there, and Slicemap does not show that picture.
- Sign-in records: IP address, browser details and the time you signed in.
- Server logs: IP address, time of the request, the page address and the response code.
- When you visit the website slicemap.dev: your IP address, browser details, the page address and the time of the request, which pass through Cloudflare, the company that hosts the website.
- Only if you allow analytics cookies on the website: which pages of slicemap.dev you open and how far you scroll them, which links leading off the website you click, the link or search engine you came from, your approximate location (country, region and city), the type of your device and browser, and whether you clicked “Join the free beta”. We collect it with Google Analytics.
- Access tokens for your coding agent (API keys in the app): the token name, a hash of the token and when it was last used. The token itself is not stored.
- The days on which your coding agent changed a map: the date only, without what was changed.
- What you create: workspaces, projects, maps, steps, stories, acceptance criteria, personas, releases and the text in them, including any personal data you put there.
- The date, time and version of the documents you accepted.
- The emails you send to the operator.
We collect nothing else.
Why we use it and on what legal basis
- Creating your account, signing you in and storing your maps: performance of our contract with you, Article 6(1)(b) GDPR.
- Working together in workspaces and sharing maps with public links: Article 6(1)(b).
- Letting your coding agent work with your maps using your token: Article 6(1)(b).
- Server logs: our legitimate interest in protecting the service and its users from attacks and in fixing failures, Article 6(1)(f).
- Delivering the website slicemap.dev through Cloudflare and protecting it from attacks: our legitimate interest in running the website, Article 6(1)(f).
- Website analytics with Google Analytics: your consent, Article 6(1)(a) GDPR, which you give with the “Allow” button on the website. You can withdraw it at any time with “Cookie settings” at the bottom of any page of the website; this does not affect what was collected before.
- Counting the days on which your agent changed a map: our legitimate interest in deciding whether the beta should continue, Article 6(1)(f). We count days only: no content, no IP address, no token.
- Answering your requests about your rights: our legal obligation to answer them, Article 6(1)(c).
- Reviewing notices of illegal content and answering the people who sent them: our legal obligation under the Digital Services Act, Article 6(1)(c).
- Answering your other emails: our legitimate interest in replying to you, Article 6(1)(f).
- Keeping a record of the documents you accepted: our legitimate interest in being able to show what you agreed to, Article 6(1)(f).
Because the operator lives in Russia, Russian Federal Law No. 152-FZ also applies and requires a separate consent to the processing of personal data. You give it with a separate checkbox when you sign up, or on the consent screen after your first sign-in with GitHub or Google (see Consent to Data Processing). For the GDPR we rely on the bases above, not on that sign-up consent.
We do not use your data for advertising, mailings, profiling or training AI models. Google Analytics is set up without advertising features and without Google signals.
Who can see your data
- You.
- Members of the workspaces you belong to: they see your name and email address in the member list and the content of shared maps.
- Anyone you give a public link to a map: they see the content of that map only. Members’ names and email addresses, including who a story is assigned to, are not shown there. You can revoke the link at any time.
- The hosting company in the European Union that runs the servers, acting as our processor.
- Cloudflare, Inc., which hosts the website slicemap.dev and delivers it to your browser, acting as our processor: it handles your requests to the website, including your IP address. The app at app.slicemap.dev does not go through Cloudflare.
- Google, which provides Google Analytics, acting as our processor, but only if you allow analytics cookies on the website.
- The email delivery service in the European Union that sends the link confirming your email address when you sign up, acting as our processor: it sees your email address and that email.
- The email service that hosts the operator’s mailbox, for the emails you send us.
- The operator, when fixing a problem you reported or keeping the service running.
No one else. We do not sell your personal information or share it beyond the list above. We disclose data to public authorities only when a law that binds the operator requires it.
If you sign in with GitHub or Google, that service learns that you use Slicemap and when you sign in. What it does with that is governed by its own privacy policy; we send it nothing about you.
If you connect a coding agent, a program on your computer reads your maps with your token. Where it sends what it reads is up to you and your agreement with the agent’s provider: the operator is not part of that transfer.
Slicemap does not connect to your code repository, so it never sees your code, and it does not call AI models.
Where your data is stored
The service and its database run on servers in Lithuania (European Union). Encrypted nightly backups are kept on a separate server in the European Union. The data of this service is not stored in Russia and is not copied there.
Emails you send us are kept by our email service, which may store them outside the European Union, including in the United States. The data of the service itself stays in the European Union.
The website slicemap.dev itself holds no personal data. Cloudflare delivers it from its data centres around the world, usually the one nearest to you, and Google Analytics data is stored by Google, including in the United States. Both transfer such data to the United States under the European Commission’s standard contractual clauses in their data processing terms; Cloudflare is also certified under the EU–US Data Privacy Framework. Google Analytics does not log or store the IP addresses of visitors from the EU, Switzerland or the UK: it uses them only to find the approximate location and then discards them.
The operator administers the service remotely from Russia, a country for which the European Commission has not adopted an adequacy decision. When administering the service, the operator can see data on the servers, for example to fix a problem, but does not copy it out of the European Union.
How we protect your data
- Traffic between your browser and Slicemap is encrypted with HTTPS.
- Passwords and tokens are stored only as hashes.
- Access rules are enforced by the database itself, so other people’s workspaces, maps and profiles are not returned even if someone bypasses the interface.
- Only the operator can sign in to the servers and the database.
- Backups that leave the main server are encrypted.
- Server logs are kept for no more than 30 days.
- Software on the servers is kept up to date.
How long we keep it
- Your account, sign-in records and the content you created: while your account exists.
- After your account is deleted or you withdraw your consent, your data is removed from the database and destroyed within 30 days. The exception is the emails you sent us, such as the request to delete your account: they are kept up to one year after the answer, even though the account is gone.
- Database backups: 7 days on the main server, 30 days for the encrypted copy in the European Union, then they are overwritten.
- Server logs: 30 days.
- Website analytics: 2 months in Google Analytics, then Google deletes it.
- Requests to the website: Cloudflare keeps records of them only for a limited time needed to deliver and protect the website, under its data processing terms; we keep no logs of the website ourselves.
- The days on which your agent changed a map: while your account exists, and no longer than 12 months.
- The record of the documents you accepted: while your account exists.
- Your emails to the operator: no longer than one year after the answer.
Your rights
Under the GDPR and the UK GDPR you have the right to:
- find out whether we process your data and get a copy of it (access);
- have inaccurate data corrected (rectification);
- have your data deleted (erasure);
- have the use of your data limited (restriction of processing);
- object to processing based on our legitimate interests, such as server logs and counting agent days;
- get your data in a machine-readable form (data portability). Any map can be exported from the app to a JSON file at any time; for anything else, ask us;
- withdraw your consent to analytics cookies at any time with “Cookie settings” at the bottom of any page of the website.
Under Russian law you can also withdraw your consent to the processing of personal data. This closes your account: Slicemap cannot work without your name, email address and maps.
To use a right, email [email protected] from the address you signed up with, so we know the request is yours. We answer within 10 working days.
You can complain to a data protection supervisory authority: in the EU, in the member state where you live, work or where you think the infringement took place; in the UK, to the Information Commission (formerly the ICO).
You must give your name, email address and a password, or sign in with GitHub or Google, to create an account: without that we cannot provide the service. Everything else you put into Slicemap is up to you.
We make no automated decisions about you and do no profiling.
Slicemap is for people aged 18 and over.
Changes to this policy
When we change this policy in a meaningful way, we publish the new version on this page with a new date, and the app asks you to accept the documents again the next time you sign in. Typos are fixed without a new version.