Privacy Policy
This policy explains what the Stale & SLA app ("the app") processes when a monday.com account installs it, why, where it is stored and for how long. The app is operated by Eitan Plaks, an individual developer based in Israel. The app runs entirely on monday.com's application hosting platform (monday code); we do not operate servers or databases of our own, and the app contains no analytics or tracking code. The only usage figures we look at are counts across all accounts, described in section 1.
1. What the app processes
| Data | Purpose | Where it is kept |
|---|---|---|
| Board settings you enter (status column, tracked date column, business hours, holidays, SLA targets, stale threshold, escalation steps, weekly digest day and hour, and the monday.com user IDs of the people who opted in to the digest) | To compute the numbers and decide when alerts fire | monday code storage, segregated per account |
| Per-item timing summaries: item ID, item name, group name, creation and finish time, the current status label and when it was entered, the total time and number of entries per status, last activity time, a planned-date summary (first planned date, current planned date, times rescheduled), computed values, and which alerts already fired | To write the numbers columns without re-reading the whole board every day, to show the widget, item view and digest, and to avoid duplicate alerts | monday code storage, segregated per account |
| Workflow subscriptions created by your automations (subscription ID, the webhook address monday.com issues, the board and threshold) | To call your automations when their Stale & SLA trigger fires | monday code storage, segregated per account |
| Run records (the last 20 runs per board: when, how many items, numbers written, alerts sent, errors) and when the weekly digest was last sent | To show admins what the app did and to send the digest once a week | monday code storage, segregated per account |
| The account's subscription to the app as monday.com reports it (plan, trial, days left) | To enable the features of the account's plan; refreshed at least hourly and whenever monday.com reports a change | monday code storage, segregated per account |
| The ID of each account that installed the app (from monday.com's install event), and the date the app first saw an account use a setting outside the Free plan | To count installs and the use of paid-plan features across all accounts; no count names an account | monday code storage, in one list for the whole app |
| The access token granted by the admin who connects the app, and the monday.com user ID of that admin | To read boards and write the numbers columns in the background, on behalf of the account | monday code Secure Storage, separate for this app |
| Operational logs: event names with account, board, item and user IDs, counts, timings and error messages. monday.com's platform also records each HTTP request's method, full URL including the query string, status, size, response time and user agent. | To operate and troubleshoot the app | monday code logging, kept for the period monday.com's platform keeps logs and then deleted by monday.com |
The app reads board items (their names, groups, status and date columns), the board's activity log, the people in the column you choose for an escalation, and the IDs of a board's owners and subscribers (to check who may see the board). It writes only to the numbers columns it creates: Days in current status, Days since last activity, Days slipped, Times rescheduled, and one Total days in <status> column per tracked status. If a numbers column with exactly one of these titles already exists on the board, the app uses and overwrites that column instead of creating a new one. It posts updates on items when an escalation runs, and sends notifications to the people you chose (escalations, and the weekly digest for the people who opted in). When one of your automations uses the action "Get the stale, at-risk and overdue items on a board", the app returns the names, statuses and day counts of up to 20 items on that board to that automation inside monday.com. The same list is returned when a user asks monday.com's AI assistant what needs attention on a board, through the app's Sidekick tool.
2. Where it is processed, and what the app does not do
- The app runs only on monday.com's application hosting platform (monday code), in its EU data region. The data of every account that installs the app is stored and processed there, whatever region the account is in. monday.com provides this infrastructure as our sub-processor.
- The app sends data only to monday.com and uses no other third-party service. Support: our website truecrane.com is hosted on Cloudflare Pages and measured with Cloudflare Web Analytics; email sent to support@truecrane.com is received by Cloudflare Email Routing and forwarded to our Gmail mailbox (Google).
- No advertising, tracking or analytics cookies. The app sets one cookie, a short-lived HttpOnly cookie used during the admin's one-time connection flow; monday code's hosting edge (Cloudflare) also sets its bot-management cookie __cf_bm, which the app does not read.
- No selling, sharing or profiling of personal data.
- We contact you only to answer your support requests, to announce material changes to the app or to these policies, and to notify your account's admins of a security incident. We send no marketing email.
3. Permissions (OAuth scopes) and why
- me:read, account:read: when an admin connects, to read that admin's user ID and admin status and the account's ID and URL name (the URL name only builds the "Return to monday.com" link and is not stored); and, when an uninstall event arrives, to check whether monday.com still accepts the app's access token.
- boards:read: items, groups, status and date columns, the activity log, the people column chosen for an escalation, and a board's owners and subscribers.
- boards:write: to create the numbers columns listed above and write their values.
- updates:write: to post an escalation update on an item.
- notifications:write: escalation and weekly digest notifications; one notification to the admin who connected the app when a board's first scheduled run finds items that need attention; and notices to that admin about changes or incidents that affect the account.
- users:read: to read the IDs of a board's owners and subscribers when checking who may see the board.
4. Retention and deletion
Data is kept for as long as the app is installed on your account. When the app is uninstalled, monday.com notifies the app. Once monday.com confirms that the app has lost access to the account, the app deletes all of the account's data listed above (settings, timing summaries, workflow subscriptions, alert records, run records, digest records, the cached plan, and the account's entry in the install count; afterwards only a count of uninstalls, with no account ID, remains) and deletes the access token (monday.com has already stopped accepting it). If monday.com cannot confirm this at the time, or the deletion does not finish, we complete the deletion by hand within 30 days of the uninstall. You can ask for earlier deletion at support@truecrane.com.
5. Security
All traffic uses HTTPS. Requests from monday.com are verified: views with a monday.com session token, workflow blocks with the app's signing secret, and lifecycle events (such as install and uninstall) with the app's client secret. The one exception is the hourly call from monday code's scheduler, which carries no credentials: it accepts no data, answers only with an acknowledgement, and starts work at most once every 50 minutes. Before it deletes an account's data on an uninstall event, the app asks monday.com to confirm that the app has lost access. Viewers cannot use the app's views, guests can open them only in read-only mode and only for boards they were invited to, every board read checks that the user can see the board, and only account admins can change settings or connect the app. Before connecting, the admin is shown what the app does with the account's data, with links to this policy and the Terms of Service, and must tick "I agree". Access tokens are kept in monday code Secure Storage, separate for this app, and are never written to logs or sent to the browser. Inputs are validated on every request and text posted to items is HTML-escaped.
6. Your rights
Depending on where you live you may have the right to access, correct, export or delete personal data, or to object to its processing. The personal data the app holds is limited to monday.com user IDs and the item names that your own account entered; requests can be made to support@truecrane.com and will be answered within 30 days.
7. Changes
If this policy changes materially, we will tell users and monday.com at least 30 days before the change takes effect, on the app's listing page and in the app. The current version is always on this page, with its effective date.