Privacy Policy
Effective 31 October 2026. BostonIvy (爬山虎) is self-hosted: your tasks, projects and account live on a server that you or your organization runs. IvyLabs, who makes BostonIvy, does not run that server and never receives your data. No BostonIvy app sends telemetry, analytics or crash reports to IvyLabs or anyone else.
The English version of this policy is authoritative. Versions in other languages are translations.
Who is responsible for your data
- The operator of your BostonIvy server — you, or the organization that set it up — holds and controls everything stored on it. Questions about that data, and requests to see, correct, export or delete it, go to the operator.
- IvyLabs writes the software. IvyLabs does not run a public BostonIvy service, has no access to anyone's server, and receives nothing from the apps.
- This policy covers the server (BostonIvy OS), the web app (BostonIvy Web) and BostonIvy for Android.
No tracking
The server, the web app and the Android app contain no analytics, telemetry, crash reporting, advertising or tracking components. The Android app includes no Firebase, Google Play services, Crashlytics or Sentry. Fonts ship with the apps and are never downloaded from the internet.
What the server stores
| Data | What it is | How long |
|---|---|---|
| Account | Username, email address, display name, avatar, preferences such as time zone and language. Passwords are stored only as hashes; two-factor secrets are encrypted | Until the account is deleted |
| Sessions | For each signed-in device: IP address, user agent, device name and last activity | Removed 30 days after the session expires |
| Your work | Projects, tasks, comments, attachments, labels, reminders, time records, boards and views, saved filters. People you share something with can see it | Until you delete it; deleted items stay in the trash for 30 days |
| Agent activity | A record of the changes made through connected AI agents (OAuth apps and API tokens), so you can review and undo them. Tokens are stored only as hashes | 90 days |
| Security log | Sign-ins, password changes, new tokens and other security events, with the IP address | 180 days by default; the operator can change this |
| Delivery records | Records that prevent duplicate requests; webhook delivery records | 24 hours; 30 days |
Who the server connects to
Only to services its operator has configured:
- A mail server, to send notifications, password resets and export notices.
- Webhooks, to addresses that you or an administrator enter.
- OpenID Connect providers such as Google, Microsoft or Keycloak, if sign-in with them is set up. When you use one, the server exchanges identity information with it.
- Gravatar, if you choose a Gravatar avatar: your avatar address points to gravatar.com, with a hash of your email address.
- S3-compatible object storage, if the operator stores attachments there.
The web app
BostonIvy Web runs in your browser and talks only to your own server.
Cookies. Both are set by the server and cannot be read by the page's scripts:
| Cookie | Purpose | Lifetime |
|---|---|---|
bostonivy_refresh |
Keeps you signed in | 30 days of inactivity by default, renewed as you use it; removed when you sign out |
bostonivy_oidc |
Holds an encrypted state while you sign in with a third-party account | 10 minutes |
The short-lived access token stays in the page's memory and is gone when you close the tab.
Stored in your browser. The web app keeps a few settings in this browser only, and never sends them anywhere: a marker that you are signed in (no token), your style and light or dark mode, your interface language, which projects are collapsed in the sidebar, and which columns each table view shows. When you open a password-protected share link, a short-lived access token for it is kept for that tab and removed when it expires or the tab closes. Nothing is cached for offline use.
Other sites. The web app loads nothing from third parties. Two things can still make your browser contact another site:
- An external image in a task description or comment, if one was added through the API (for example by an agent or an import). That site can see your IP address.
- A Gravatar avatar: the browser loads it from gravatar.com, which can see your IP address and the domain of your BostonIvy site.
The web app writes to your clipboard only when you press a Copy button, never reads it, and asks for no notification, location, camera or microphone permission. The web server bundled with BostonIvy keeps no access log.
BostonIvy for Android
The app is a client for the server whose address you enter when you sign in. It supports https, and plain http for servers on a local network; over http, data is not encrypted in transit.
Permissions.
| Permission | Why | When |
|---|---|---|
| Internet | To connect to your server | Granted at install |
| Microphone | Voice quick add | Asked the first time you use it; everything else works if you decline |
The app does not ask for notifications, location, contacts, camera, calendar or storage. Attachments go through the system file picker and save dialog, which only give access to the file you choose.
Voice quick add. The app uses Android's speech recognizer and receives only the recognized text; it never records or keeps audio. It asks for recognition on the device first, so with the language pack installed your voice stays on the phone. Otherwise the phone's speech service (often Google's) recognizes it online, under that service's own privacy policy. The text, with your device's time zone, is sent to your server, which turns it into a task.
On the device. Your sign-in (server address, tokens, user name and ID) is kept in Android's encrypted storage and removed when you sign out. Your interface language and appearance are kept as ordinary preferences. Tasks are only held in memory, with no offline copy. Downloaded attachments are saved only where you choose. Android backup is turned off, so none of this goes to cloud backups or moves to a new phone.
Other connections. If your server offers sign-in with a third-party account, the provider's sign-in page opens in your browser. If your server sits behind Cloudflare Access, the app opens your organization's Access sign-in page and retrieves the sign-in credential from Cloudflare (login.cloudflareaccess.org). Images in task descriptions are not loaded. The app connects to nothing else.
AI agents you connect
You can connect AI agents to BostonIvy with an OAuth app or an API token. An agent works with the permissions you grant it, its changes are recorded so you can review and undo them, and you can revoke its access at any time. What an agent's provider (for example Anthropic or OpenAI) does with the data the agent reads is governed by that provider's privacy policy, not this one.
Your choices
- Export your data. In BostonIvy Web, account settings › Export data downloads everything you own as a ZIP file.
- Delete your account. In BostonIvy Web, account settings › Delete account. By default you have 7 days to change your mind (the operator can change this period); after that, your account and your data are deleted from the server. You can also ask your server's operator to delete it.
- Revoke an agent. Remove its API token or revoke the authorized app in account settings, or on the Connect an agent page of the Android app.
- On Android. Signing out removes your sign-in from the phone; uninstalling removes all of the app's data. You can withdraw the microphone permission in system settings.
Changes to this policy
When the apps change what they do with data, this page changes with them, and the effective date at the top shows when.
Contact
Questions about this policy or about the BostonIvy software: privacy@ivylabs.app. For the data on your server, contact its operator; IvyLabs cannot see or change it.