Effective date: August 26, 2026
1. Who We Are
Board Merge & Split ("the Power-Up") is a Trello Power-Up operated by Macon Apps, a trade name of Investor Direction LLC, an Ohio (USA) entity. The service runs on Cloudflare (Workers, D1, KV). This policy covers the Power-Up only; our company privacy policy covers the rest of the site.
2. What the Power-Up Accesses
The Power-Up works entirely through your own Trello authorization. When you authorize it, it reads the structure of the boards you point it at — lists, labels, and card counts — to build a merge or split preview, and when you execute one, it moves lists and cards under your own Trello permissions. It can never change anything you could not change by hand, and an operation Trello refuses under your permissions is recorded as refused rather than performed.
Board and workspace membership is read with Trello's member=false option,
which returns member identifiers and roles only — names, usernames, email addresses,
avatars and bios are never requested from the Trello API, so they never enter the service
at all.
Card content is never requested, so it cannot be stored. The only card-shaped data the service ever handles is card ids — the minimum needed to count cards for the preview and to record which cards a merge moved so the merge can be undone. No titles, descriptions, comments, checklists, attachments, custom-field values or card members, ever.
3. What We Store
Most of what the Power-Up reads is used to answer the request and discarded. It stores a small, deliberate set of data outside Trello, because a previewed, resumable, undoable merge is impossible without it:
- Merge/split plans — board ids and names, the ordered operations (list ids, list names, label names and colours, positions, card counts), so execution runs exactly what you previewed.
- Job receipts — one row per operation performed, with its outcome, forming the audit history and CSV export.
- The undo record — the inverse of every destructive operation, including the card ids a drained list held before its cards were merged into another list. This is what makes a merge reversible; without the id set the cards are indistinguishable afterwards.
- Trello member ids on the rows recording who created each plan and job. These are pseudonymous but re-identifiable through Trello, so we treat them as personal data (see section 11).
- Billing records — your workspace's Stripe customer id, plan and subscription status.
What we never store: card content of any kind; member names, usernames, email addresses, avatars or bios; Trello API tokens or any other credential (your token is used within each request and never written to storage or logs).
4. Who Can See What
You see the merges and splits you ran. A Trello workspace admin — verified live against Trello, never assumed — can see the workspace's job history and receipts. Receipts carry board and list names and operation outcomes; they never carry card content. Running, executing or undoing a merge requires admin rights on both boards involved, verified against Trello at the time of the request.
5. How Long We Keep It
| Data | Retention |
|---|---|
| Plans never executed | 7 days (and executable for only 24 hours) |
| Executed plans, job receipts, and undo records (card ids included) | 365 days — a year of change-management history, then pruned |
| Webhook idempotency records | 30 days |
| Short-lived caches (entitlement, membership decisions) | 5 minutes |
| Billing records (Stripe customer id, plan, status) | retained — Stripe is the system of record, and deleting the local copy would misreport what the workspace is entitled to |
These periods are enforced automatically by a nightly job. Trello does not notify Power-Ups when they are removed from a board, so removal is not an event we can act on — but nothing further is written after removal, and the schedule above applies from that point: everything except the billing record is gone within 365 days of its creation.
6. How Deletion Works
- Self-service, immediate: a Trello workspace admin opens the Power-Up and uses the data deletion action, which erases every plan, job, receipt and undo record we hold for that workspace. The request must echo the workspace id as confirmation, so a mis-click cannot destroy data. Billing records are retained as described above; cancel the subscription in the billing portal to end that relationship.
- Automatic, per member: we poll Trello's member privacy endpoint nightly and honour account-deleted, account-updated, token-revoked and token-expired events by removing that member's identifier from every record that holds it.
- Automatic, time-based: the retention schedule in section 5.
- On request: email [email protected] and we will run the workspace purge for you.
7. Payments
Subscriptions are processed by Stripe. Card details are entered on Stripe's hosted checkout page and managed in Stripe's customer portal — they never reach us and we never see them. We store only the Stripe customer id, plan and subscription status needed to know what your workspace is entitled to. Undoing a merge is deliberately never gated on an active subscription: a lapsed plan can always put a board back the way it was.
8. Cookies, Analytics & Tracking
The Power-Up sets no cookies and uses no analytics, advertising or tracking of any kind. There is no analytics provider, no advertising provider, and no sub-processor beyond the two named in section 10. No customer data is sold, shared, or used for training.
9. Security
- All traffic is HTTPS with HSTS (one-year max-age, including subdomains). Data at rest is encrypted by Cloudflare D1 and KV.
- Every request is authenticated with the Trello-signed token for this specific Power-Up, verified server-side against Trello's public keys and pinned to this Power-Up's own id — a token issued for a different Power-Up is rejected.
- Your Trello REST token is additionally checked to belong to you, used within the request, and never stored or logged.
- Merging, splitting and undoing require admin rights on both boards involved, verified live against Trello; billing and data deletion require workspace admin.
- Destructive actions sit behind a typed confirmation (the source board's name), enforced on the server — and closing a source board only ever happens because someone explicitly chose it.
- The Power-Up iframe is served with a Content-Security-Policy containing no unsafe-inline, unsafe-eval or unsafe-hashes, and can only be framed by trello.com.
- CSV exports neutralise spreadsheet formula injection, so a hostile list name cannot execute when an admin opens the audit export.
10. Third Parties We Rely On
- Cloudflare (Workers, D1, KV) — application hosting and data storage.
- Stripe — payment processing.
No other sub-processor is used.
11. Your Rights
The only personal data we hold is your Trello member id on records of actions you took. You can have it removed at any time: through a Trello account deletion or token revocation (honoured automatically, nightly), through your workspace admin running the data deletion action, or by emailing us. Where GDPR or similar regulations apply, requests for access, rectification or erasure can be sent to [email protected] and are honoured without charge.
12. Changes to This Policy
If we change what the Power-Up stores or how long it keeps it, we will update this page and its effective date before the change ships. The Power-Up's storage behaviour and this page are maintained together; if they ever disagree, we treat that as a bug and fix it.
13. Contact
Questions about this policy or your data: [email protected], or open a ticket in the support portal. Support and usage documentation lives on the Board Merge & Split support page.