Privacy Policy

Who we are

WarRoom is operated by Nelson Development (Pty) Ltd, trading as One Eleven, registered at 1 Cormorant Crescent, Cape Town, Western Cape, 7945, South Africa. In this policy, “One Eleven”, “we” and “us” mean that company. We are the data controller (the “responsible party” under South Africa’s POPIA) for your personal data. For any question about this policy or your data, email support@oneeleven.tech.

WarRoom is a workspace for teams and the clients they work with. For your account, and for how we run the service, we decide how your data is used. The content an organization keeps in WarRoom (its projects, tickets, documents and chats) belongs to that organization, and we handle it on the organization’s behalf. If your question is about what your organization does with that content, ask its owner or an admin first; we will help them answer.

What we collect

Account information

Your name, email address, profile photo (if you add one), and how you sign in: with an email and password, with Google, or with Apple. Passwords are stored only as a secure hash by our sign-in provider; we never see them.

What you create

Boards, projects, tickets, sprints, documents, comments, chat messages, reactions, files and photos you attach, time entries, status updates and the feedback you send us.

Settings

Your notification choices, the chats you mute, the people you block, and, if you set quiet hours, your quiet-hours schedule and your time zone, so notifications stay silent at the right local time.

Reports

If you report a message or a person, we keep the report: who made it, who or what was reported (including a copy of the reported message), the reason and any note you add.

Technical information

Like any website, our servers receive your IP address and your browser or device type when you use WarRoom. We use these to run, secure and fix the service. We use only the cookies needed to keep you signed in and to remember settings such as your theme. We do not use advertising or analytics cookies.

Integrations you choose

If you connect GitHub or Google Calendar, we access only what that integration needs, with your permission, to power the feature. Google Calendar is explained in detail below.

The WarRoom Mobile app

The phone app uses the same account and the same data as the website. These parts are specific to the app.

Push notifications

The app asks your permission before it sends notifications, and you can turn them off at any time in the app’s Settings or in your phone’s settings. When notifications are on, we store a push token for your phone (a random address used to deliver notifications to it), whether it is an iPhone or an Android phone, and the app version. We do not collect the name you gave your phone.

A notification says who sent something and where. It also shows a short preview of the message, unless you turn off Show message text in emails in Settings on the website, which covers notifications too. Notifications travel from our servers through Expo, then through Apple Push Notification service (iPhone) or Firebase Cloud Messaging (Android), to your phone. Expo keeps your push token so it can deliver notifications, and does not keep the content of a notification after delivering it.

We delete a phone’s push token when you sign out on that phone, when Apple or Google tell us the app is no longer installed there, or when you delete your account.

Sign in with Apple and Google

If you sign in with Apple or Google, they tell us your name and email address and confirm it is you. With Apple you can choose Hide My Email; we then receive a private relay address from Apple instead of your real one. We never receive your Apple or Google password.

Camera and photos

The app asks for camera or photo access only when you choose to attach a picture in chat. We receive only the photos you take or pick, and they are shared with the people in that chat. The app does not use your microphone, location or contacts.

GIFs

When you search for a GIF, the search words go to our server, which passes them to GIPHY without your name, email or any account identifier. The GIF images then load straight from GIPHY’s servers, so GIPHY receives your IP address and device type, as any website would.

App updates

When it opens, the app checks Expo’s servers for small updates. That check sends your phone’s operating system, details of the app version and a random identifier for this installation of the app. It does not send your name, email or account.

If the app crashes, the next update check also sends Expo a short technical error message (the type of error and its description, at most 1,024 characters), which helps keep updates safe. The app does not put your name, email, account or messages in it.

Diagnostics and tracking

The app contains no advertising or analytics tools, and no crash-reporting service beyond the short update-check message described above. It does not track you across other companies’ apps or websites. If you have chosen in your phone’s settings to share crash reports with app developers, Apple or Google may pass anonymous crash reports to us.

On your phone

The app keeps your sign-in encrypted on your phone, plus a few small preferences, such as your recently used emoji. Signing out removes your sign-in; uninstalling the app removes everything.

How we use it, and our legal basis

• To provide WarRoom: your account, sign-in, working with your team and clients, notifications, and the integrations you turn on. We need this to provide the service you signed up for (contract).
• To keep WarRoom safe: security, preventing abuse, filtering objectionable content, and handling reports. This is in our and our users’ legitimate interests, and sometimes a legal duty.
• Push notifications: only with your permission, which you can withdraw in your phone’s settings at any time (consent).
• Emails about activity you missed: in our legitimate interest in keeping you informed. Every such email has a link to turn it off.
• Support and improvement: answering you, and fixing and improving WarRoom (legitimate interests).
• Legal reasons: where the law requires us to keep or share information (legal obligation).

We do not sell your data, use it for advertising, or use it to train artificial-intelligence models.

AI features

When you use an AI feature, such as the board assistant, your request and the content it needs (for example, the board you are on) are sent to Anthropic to produce the answer. Under its commercial terms, Anthropic does not use this data to train its models. You can also connect WarRoom to an AI assistant of your choice through our API or MCP connection; that assistant then reads your WarRoom data only when you ask it to.

Google Calendar data & Limited Use

If you choose to connect Google Calendar, WarRoom requests only the read-only scope .../auth/calendar.events.owned.readonly alongside the standard openid and email sign-in scopes. This scope reads events on your own calendars only (including meetings you were invited to); it does not access other people’s calendars shared with you. We never request permission to create, edit, or delete anything in your calendar.

With that read-only access we fetch your upcoming events from your primary calendar — event title, start and end time, location, and video-call link — for the sole purpose of showing your agenda and meeting reminders inside WarRoom. We do not store your calendar events on our servers: they are fetched on demand and shown only to you. To keep the connection working we store only the connected account’s email address and an encrypted access token (encrypted at rest), used solely to read your events on your behalf.

We do not sell this data, use it for advertising, or use it to develop, train, or improve any generalized artificial-intelligence or machine-learning models. No human reads your Google Calendar data except where you explicitly request support, where necessary for security, or to comply with applicable law. You can disconnect Google Calendar at any time from within WarRoom — which deletes the stored token — or revoke access from your Google Account permissions.

WarRoom’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

WarRoom also lets you read your own upcoming events through our API and AI-assistant integration (for example, connecting WarRoom to an AI assistant such as Claude). In that case your calendar data is sent to that assistant only when you request it, solely to answer you — and those AI providers do not use your calendar data to train or improve their models.

Who can see your information

• The people you work with, according to their role. Members of a project see that project’s work and chats, and an organization’s owners and admins can see every project in it. A channel is seen by its members, and a direct message only by the people in it. A client sees only the projects they were invited to.
• When you report something, the report goes to the owners and admins of that organization and to One Eleven, and is acted on within 24 hours.
• Our service providers, listed below, only to run WarRoom for us.
• When the law requires it, for example a valid court order, or to protect someone’s safety.
• If our business changes hands: the new owner would have to keep to this policy.

Service providers

These companies process personal data for us, only to provide WarRoom. Each is bound by data protection terms with us and must protect your data at least as well as this policy describes.

• Supabase

  Sign-in, the main database and file storage (chat attachments, profile photos, project files).

  Location: European Union (Ireland)

• Cloudflare

  Hosting the website and app servers, network security, and sending our emails (sign-in links and notification emails).

  Location: Global network; United States company

• Anthropic

  The AI features you choose to use, such as the board assistant.

  Location: United States

• Expo

  Relaying push notifications to your phone, and delivering app updates.

  Location: United States

• Apple

  Sign in with Apple, push notifications on iPhone (Apple Push Notification service) and the App Store.

  Location: United States

• Google

  Sign in with Google, Google Calendar (only if you connect it), push notifications on Android (Firebase Cloud Messaging) and Google Play.

  Location: United States

• GIPHY

  GIF search, and the GIF images shown in chat.

  Location: United States

• Slack

  The website’s Feedback button sends your message and your email address to One Eleven’s Slack workspace.

  Location: United States

• GitHub

  Only if your organization connects GitHub: linking repositories, issues and pull requests to projects.

  Location: United States

International transfers

Our main database is in the European Union (Ireland). Some of the providers above, and our own team, work from other countries, including the United States and South Africa, so your data may be accessed from there. When data leaves the UK or the European Economic Area, we rely on the safeguards the law provides: an adequacy decision (such as the EU–US Data Privacy Framework and its UK extension, for providers certified under it), or the standard contractual clauses approved by the European Commission together with the UK’s addendum to them. Email us for a copy of the safeguard that applies.

How long we keep it

• Your account and your messages: for as long as your account exists. When you delete your account they are deleted, except your messages in shared conversations, which stay with the organization as “Former member”.
• What else you create (tickets, documents, boards and so on): for as long as the organization it belongs to uses WarRoom. If an organization stops using WarRoom, its owner can ask us to delete its workspace and everything in it.
• Push tokens: until you sign out on that phone or delete your account, or until Apple or Google tell us the app is no longer installed there.
• Abuse reports: 12 months, then deleted automatically.
• Technical logs (such as IP addresses): 30 days.
• Database backups: made daily, and each one is kept 7 days. Data you delete can therefore remain in a backup for up to 7 days, and is then gone.

Deleting your account

You can delete your account at any time: in the app (Settings, then Delete my account), on the website (Settings, then Delete my account), or by email if you cannot sign in. Deleting in the app or on the website is immediate. Step-by-step instructions are on our account deletion page.

What is deleted: your sign-in, your profile (name and photo), your API tokens and connected apps, your push tokens, your settings (including the people you blocked), your reactions in chat, and your membership of every organization and project.

What is kept, and why: WarRoom is a shared workspace, so what you contributed is also part of other people’s record of the work. Your messages in shared conversations, and your tickets, comments, documents, boards and time entries, stay with the organization, but your name is removed from them: they show as “Former member”. Before you delete your account you can delete your own messages yourself, or ask an organization admin to remove content. We also keep:

• the name on any document you formally signed off, because a signature is a record the organization may need for legal claims;
• a record that an account was deleted, and when, without your name or email;
• any billing, tax or legal records the law requires us to keep, for as long as it requires.

Your rights

Depending on where you live (for example under the UK GDPR, the EU GDPR or South Africa’s POPIA), you have the right to:

• get a copy of your personal data (you can also use Export my data in Settings on the website);
• have inaccurate data corrected;
• have your data deleted;
• restrict, or object to, how we use it;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent (for example push notifications);
• complain to a data protection authority: the Information Commissioner’s Office in the UK, your local authority in the EU, or the Information Regulator in South Africa.

To use any of these rights, email support@oneeleven.tech. We reply within one month. We may need to confirm it is you before we act.

Children

WarRoom is a workplace tool. It is not intended for children, and you must be at least 18 to use it. If we learn that someone under 18 has an account, we will delete it.

Security

All data travels encrypted (HTTPS). Secrets and access tokens are encrypted at rest, and access is controlled by row-level security and role-based permissions throughout the app. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Changes

We will post updates to this page with a new “last updated” date. If a change is significant, we will also tell you in the app or by email.

Contact

Nelson Development (Pty) Ltd, trading as One Eleven, registered at 1 Cormorant Crescent, Cape Town, Western Cape, 7945, South Africa. Email support@oneeleven.tech. See also our support page and Terms of Use.