Effective date: August 13, 2026
1. Who We Are
Find and Replace + Banned Term Watch ("the Power-Up") is a Trello Power-Up operated by Macon Apps, a trade name of Investor Direction LLC, an Ohio (USA) entity. The service runs on Cloudflare (Workers, D1, KV). This policy covers the Power-Up only; our company privacy policy covers the rest of the site.
2. What the Power-Up Accesses
The Power-Up works entirely through your own Trello authorization. When you authorize it (read and write), it reads card titles, card descriptions and checklist items on the boards you point it at, and — when you run a rewrite — edits those same fields under your own Trello permissions. It cannot change anything you could not change by hand, and a card you cannot edit is reported as refused rather than modified.
Board and workspace membership is read with Trello's member=false option,
which returns member identifiers and roles only — names, usernames, email addresses,
avatars and bios are never requested from the Trello API, so they never enter the service
at all.
3. What We Store
Most of what the Power-Up touches is read, matched in memory, and discarded within the same request. It stores a small, deliberate set of data outside Trello, because preview and undo are impossible without it:
- Match snippets — roughly 30 characters of card text on either side of each match, so the results list and the before/after preview can show you what you are about to change. Kept 7 days.
- The undo journal — the complete before and after text of every field a rewrite changed, including full card descriptions. This exists so undo can restore a field exactly, and so a field a colleague edited afterwards is detected and left alone rather than overwritten. Kept 7 days, after which undo for that job is no longer offered.
- Your search and replacement strings, including saved and watched terms — user-authored text, kept with the records they belong to (see the schedule below).
- Identifiers and bookkeeping — card, board and checklist ids, card short links, board titles, match counts and job statuses, which make up receipts and progress reporting.
- Trello member ids on the rows recording who ran a search or rewrite or saved a term. These are pseudonymous but re-identifiable through Trello, so we treat them as personal data (see section 11).
- Billing records — your workspace's Stripe customer id, plan, seat count and subscription status.
What we never store: member names, usernames, email addresses, avatars or bios; Trello API tokens or any other credential (your token is used within each request and never written to storage or logs); card comments, attachments, custom fields or labels; and no card content beyond the two items above.
4. Who Can See What
Search results and their snippets are visible to the member who ran the search and, for a single-board search, to members of that board. Rewrite receipts are scoped the same way. A workspace admin can see the workspace's rewrite history. The banned-term watch list and its alerts are visible to subscribed members of the workspace, but an alert carries references only — which card, which field, which term — and the card itself is fetched live under the viewer's own Trello permissions, so a member who cannot open a board sees nothing beyond an identifier.
5. How Long We Keep It
| Data | Retention |
|---|---|
| Card text — match snippets | 7 days |
| Card text — undo journal (complete before/after values) | 7 days |
| Search worklists, board titles, match counts | 30 days |
| Rewrite plans never executed | 7 days |
| Rewrite plans executed | the card list inside them is deleted the moment the job starts; the remaining record is deleted with its job |
| Job receipts (identifiers, counts, statuses — no card text) | 365 days |
| Watch alerts | 90 days once dismissed; 365 days if never dismissed |
| Webhook idempotency records | 30 days |
| Saved terms and watched boards | while the workspace is subscribed, then 90 days after the subscription ends |
| Billing records (Stripe customer id, plan, seats, status) | retained — Stripe is the system of record, and deleting the local copy would misreport what the workspace is entitled to |
These periods are enforced automatically by a nightly job. Trello does not notify Power-Ups when they are removed from a board, so removal is not an event we can act on — but nothing further is written after removal, and the schedule above applies from that point: all card content is gone within 7 days, and everything except the billing record within 365 days.
6. How Deletion Works
- Self-service, immediate: a Trello workspace admin opens the Power-Up and uses the data deletion action, which erases every record we hold for that workspace. The request must echo the workspace id as confirmation, so a mis-click cannot destroy data. Billing records are retained as described above; cancel the subscription in the billing portal to end that relationship.
- Automatic, per member: we poll Trello's member privacy endpoint nightly and honour account-deleted, account-updated, token-revoked and token-expired events by removing that member's identifier from every record that holds it.
- Automatic, time-based: the retention schedule in section 5.
- On request: email [email protected] and we will run the workspace purge for you.
7. Payments
Subscriptions are processed by Stripe. Card details are entered on Stripe's hosted checkout page and managed in Stripe's customer portal — they never reach us and we never see them. We store only the Stripe customer id, plan, seat count and subscription status needed to know what your workspace is entitled to.
8. Cookies, Analytics & Tracking
The Power-Up sets no cookies and uses no analytics, advertising or tracking of any kind. There is no analytics provider, no advertising provider, and no sub-processor beyond the two named in section 10. No customer data is sold, shared, or used for training.
9. Security
- All traffic is HTTPS with HSTS (one-year max-age, including subdomains). Data at rest is encrypted by Cloudflare D1 and KV.
- Every request is authenticated with the Trello-signed token for this specific Power-Up, verified server-side against Trello's public keys and pinned to this Power-Up's own id — a token issued for a different Power-Up is rejected.
- Your Trello REST token is additionally checked to belong to you, used within the request, and never stored or logged.
- Billing, data deletion and workspace-wide rewrites additionally require Trello workspace admin, verified live against Trello.
- The Power-Up iframe is served with a Content-Security-Policy containing no unsafe-inline, unsafe-eval or unsafe-hashes, and can only be framed by trello.com.
10. Third Parties We Rely On
- Cloudflare (Workers, D1, KV) — application hosting and data storage.
- Stripe — payment processing.
No other sub-processor is used.
11. Your Rights
The only personal data we hold is your Trello member id on records of actions you took. You can have it removed at any time: through a Trello account deletion or token revocation (honoured automatically, nightly), through your workspace admin running the data deletion action, or by emailing us. Where GDPR or similar regulations apply, requests for access, rectification or erasure can be sent to [email protected] and are honoured without charge.
12. Changes to This Policy
If we change what the Power-Up stores or how long it keeps it, we will update this page and its effective date before the change ships. The Power-Up's storage behaviour and this page are maintained together; if they ever disagree, we treat that as a bug and fix it.
13. Contact
Questions about this policy or your data: [email protected], or open a ticket in the support portal. Support and usage documentation lives on the Find and Replace support page.