Privacy policy

MyDash (“MyDash”, “we”, “us”) is a dashboard that shows the key numbers from apps you connect. This policy explains what we collect, why, how we protect it and how you can delete it. It covers the website at https://mydash.u.jpapps.net, the MyDash web app and the MyDash iPhone and Android apps.

The service is operated by the company named in our Terms of service. For anything in this policy, email privacy@mydash.app.

The short version

• We read account-level totals from the apps you connect, like revenue, followers or orders. Not your customers’ details.
• We only read. MyDash never posts, edits, deletes or moves money in a connected account.
• Access tokens and API keys are encrypted at rest.
• We never sell your data, and we don’t use it for advertising.
• You can disconnect any app or delete your account at any time, and the data goes with it.

What we collect

Your account

Your name, email address, a password (stored only as a one-way hash), your time zone and your settings. If you use the mobile apps with notifications on, a push notification token for your device.

Data from apps you connect

When you connect an app (Instagram, Facebook, TikTok, YouTube, Google Ads, Meta Ads, Google Analytics, Salesforce, Close, QuickBooks, Stripe, Square, PayPal, Clover, Shopify, Amazon Seller, Monday.com, ADP, Stock watchlist), you sign in with that app or give us API credentials, and choose which account to connect. We then store:

• the access and refresh tokens or API keys the app gives us, encrypted;
• the name and ID of the account you chose (for example a Facebook Page, an ad account or a store);
• the numbers MyDash shows: period totals and daily totals for each key number (for example “Revenue, 1 to 30 September: $84,300”), plus labels such as a top product or top page.

We request read-only access wherever the platform offers it, and only the permissions needed to calculate those numbers. We do not store individual posts, messages, orders, invoices, transactions or your customers’ personal information. To calculate a total, some platforms send us individual records; we add them up and discard them.

Where you send updates

The destinations you set up for updates and alerts: email addresses, phone numbers (text and WhatsApp), Telegram chats, Discord, Microsoft Teams and Slack webhook addresses, and Notion tokens and pages. Webhook addresses and tokens are encrypted.

Requests and messages

What you send us when you request an integration or a custom dashboard, or email us.

Technical data

Server logs (IP address, time, request, error details) to keep the service running and secure. Logs are kept for up to 90 days.

How we use it

• to show your dashboard, compare periods and draw charts;
• to send the updates and alerts you set up, to the destinations you chose;
• to keep your account secure, prevent abuse and fix problems;
• to answer your messages and requests;
• to count which integrations people ask for, in aggregate.

We don’t sell your data, share it for advertising, or use data from connected apps to train AI models. We only email you about the service, plus product news if you opt in.

Google user data

If you connect YouTube, Google Ads or Google Analytics, MyDash requests read-only access to your channel analytics, ad account reports or Analytics property reports, only to show the totals described above. MyDash’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. No person at MyDash reads this data, except with your permission to help with a support request, for security, or when the law requires it.

Facebook, Instagram and Meta Ads data

If you connect Instagram, Facebook or Meta Ads, MyDash reads the insights of the account, Page or ad account you choose (followers, reach, views, engagements, ad spend, impressions, clicks) to show them on your dashboard. It does not read your private messages and never posts. See Deleting your data for how to remove it.

Who processes data for us

We use a small number of service providers, each only for what it does for MyDash:

• our hosting and database provider, which stores the service’s data;
• Resend, to send email;
• Twilio, to send text and WhatsApp messages;
• Apple and Google, to deliver push notifications to your phone;
• Telegram, Discord, Microsoft, Slack and Notion, only when you choose them as a destination.

The apps you connect receive the API requests we make on your behalf. We share data with authorities only when the law requires it. If MyDash is ever sold or merged, this policy continues to apply to your data.

How we protect it

• Connection tokens, API keys and destination secrets are encrypted with AES-256-GCM, each with its own random nonce.
• Passwords are hashed with Argon2id. Sign-in sessions are short-lived and rotated.
• All traffic uses HTTPS.
• Access to production systems is limited to the people who run the service.

How long we keep it

• Your numbers and connection: until you disconnect the app or delete your account.
• Daily history: up to about 400 days, so you can compare periods.
• After you delete your account: deleted immediately. Nothing is kept except what the law requires (such as billing records), and copies in encrypted backups expire within 30 days.

Deleting your data

You can delete your data at any time. Step by step: Delete your MyDash account.

• One app: in MyDash, open Connections and choose Disconnect. We delete the stored tokens and that app’s numbers. You can also remove MyDash from the app’s own settings (for example Facebook → Settings → Business integrations, or your Google Account → Third-party connections).
• Everything: in MyDash, open Settings and choose Delete account. Your account, connections, numbers, destinations, updates and alerts are deleted immediately.
• By email: write to privacy@mydash.app from your account’s email address and we will delete everything and confirm.

Your rights

Depending on where you live (including under Canada’s PIPEDA, the EU and UK GDPR and US state laws), you can ask to access, correct, export or delete your personal information, and to object to or restrict how we use it. Email privacy@mydash.app. We answer within 30 days. You can also complain to your data protection authority.

Cookies

This website sets no cookies and runs no analytics or advertising scripts. The web app uses one essential cookie to keep you signed in.

Children

MyDash is a business tool and is not meant for anyone under 16.

International transfers

Our service providers may process data outside your country. When they do, we rely on safeguards the law recognises, such as standard contractual clauses.

Changes

If we change this policy in a way that matters, we will email you before the change takes effect. The date at the top shows the latest version.

Contact

Privacy questions and requests: privacy@mydash.app. Anything else: hello@mydash.app.