Standup Bot

Who we areStandupBot is operated by Maytes, an Australian software studio based in Sydney. When we say "we" on this page we mean Maytes; when we say "you" we mean the admin installing StandupBot and the teammates inside the workspace who post standups.

What we collectOnly the data we need to generate your daily standup and bill the workspace. Specifically:

Slack workspace and user IDs (names, avatars, channel IDs) — so we can post as the right bot user in the right channel.

Linear activity scoped to the standups you pick — issues, cycles, status transitions, and comments. We do not pull Linear comments outside of those standups.

AI synthesis inputs and outputs — the prompt we send to Anthropic and the standup we get back, retained so you can audit what the bot said on your behalf.

Billing usage metrics — token counts, per-workspace cents, number of standups posted.

Application logs — structured entries with a traceId, scrubbed of message bodies.

What we specifically do not collect:

Passwords — Slack OAuth is our only sign-in mechanism.

Payment card details — Stripe handles your card on their PCI-compliant vault; we only see a customer ID and invoice events.

How we use itWe use the data above for three things, and nothing else:

Generating your daily standup — pulling Linear activity, synthesizing a human-readable summary, and posting it to Slack.

Aggregating cost and usage analytics so you can see what StandupBot actually costs per workspace and per user.

Customer support — when you email us about a bug, we may read recent logs tagged with your workspace ID to reproduce it.

Where it livesStandupBot runs on a single Fly.io machine and stores data in Supabase Postgres in the ap-southeast-2 (Sydney) region. AI synthesis requests are sent to the Anthropic API in the US. Slack messages flow through the Slack API in the US. We do not operate a Redis cache, we do not store data in S3, and we do not shard per-tenant — every workspace is a row-level tenant inside the same Postgres cluster.

RetentionRaw Linear activity (the feed we pull to build each standup) is purged after 30 days by default. Workspace admins can shorten or extend this in workspace settings. Standup records — the human-readable summaries we've posted — are retained for the life of the workspace so you can search them. When you cancel, everything is deleted within 30 days unless you ask for an export first.

Your rightsYou can ask us to show you the data we hold on your workspace, delete all of it, or hand it back as a JSON export.

Email [email protected] — we reply within five business days.

SecurityOAuth tokens (Slack, Linear, Anthropic) are encrypted at rest with AES-GCM using a key we rotate quarterly. Each workspace gets its own JWT signing secret so a leak in one tenant cannot forge tokens for another. TLS is enforced on every inbound and outbound hop. No human at Maytes has a shared superuser database account — we connect with short-lived, per-engineer credentials tied to an audit log.

ChangesWhen we change this policy in a way that affects how your data is handled, we'll email workspace admins at least 14 days before the change takes effect. Cosmetic edits (typos, clarifications) go live without notice and are logged in our changelog.