Privacy Policy

1. Who We Are

Joka ("the Service") is a project management application operated by Mandatory Fun. This policy explains how we collect, use, and protect your personal information when you use our service.

2. What We Collect

Account information: Your name and email address, received from your OAuth provider (Google or GitHub) when you sign in. We do not collect or store passwords.

Usage data: Actions you take in the Service (creating tickets, assigning people) are recorded as part of the product's core functionality. Server access logs record IP addresses and request timestamps.

3. What We Don't Collect

• Passwords (you sign in with an existing account, e.g. Google or GitHub - we never see or store a password)
• Third-party analytics that use cookies, fingerprinting, or cross-site tracking
• Behavioural data beyond what's needed to operate the Service
• Individual performance metrics (the product is structurally designed not to produce them)

4. How We Use Your Data

We use your data to:

• Provide and operate the Service
• Authenticate your identity
• Send transactional emails (invitations, account notifications)

We may use anonymised, aggregate data across all teams to publish research and improve the Service. No individual team, person, or ticket is identifiable in aggregate data.

We do not sell, rent, or share your personal data with third parties for marketing purposes. We never will.

5. Third-Party Services

We use the following third-party services to operate Joka:

• Google / GitHub - Sign-in authentication
• Hetzner Online GmbH - Infrastructure and hosting

Each service processes only the minimum data necessary for its function.

6. Cookies

We use a single encrypted session cookie to keep you signed in. We do not use any third-party cookies, tracking pixels, or behavioural analytics.

7. Data Retention

Your data is retained while your account is active. You may request deletion at any time by contacting us.

8. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate information
• Delete your account and all associated data
• Export your data in a machine-readable format

To exercise these rights, contact [email protected].

9. Data Security

We encrypt your data in transit and at rest, and collect only what is needed to operate the Service.

10. International Transfers

Your data is hosted on servers in the United States, operated by Hetzner Online GmbH and Google Cloud Platform. If you are located outside the United States, your data is transferred to and processed in the United States. We ensure appropriate safeguards are in place for international data transfers in accordance with applicable data protection laws, including the Australian Privacy Act 1988 and the EU General Data Protection Regulation (GDPR) where applicable.

11. Legal Basis

We process your data on the basis of:

• Contract: To provide the Service you signed up for
• Legitimate interest: To operate and improve the Service
• Legal obligation: To comply with applicable laws

We comply with the Australian Privacy Act 1988 and the EU General Data Protection Regulation (GDPR) where applicable.

12. Changes to This Policy

We may update this policy with 30 days' notice. Material changes will be communicated via email or in-app notification.

13. Contact

For privacy questions or data requests, contact us at [email protected].

Mandatory Fun.