Privacy
Privacy policy
Last updated 5 November 2026
Who we are
Baro is a product of Altevant, operated by Azure Advisory Group LLC, 8 The Green STE B, Dover, DE 19901, United States ("Baro", "we", "us"). This policy covers:
- our website, raisethebaro.com;
- the Baro app at app.raisethebaro.com and your company's workspace at <company>.raisethebaro.com;
- the Jira data a company connects to Baro.
Baro is a tool for businesses. A company signs up, connects its own Jira and invites its team. For that company's Jira data, we act on the company's behalf and follow its instructions; the company decides what to connect and who can see it.
What we collect
| Kind | What exactly | Where it comes from |
|---|---|---|
| Your account | Your name, work email address, the user ID our sign-in provider gives you, when your email was verified, and your role in the workspace | You, when you sign up or accept an invitation |
| Your password | We never see or store it. Our sign-in provider, Clerk, handles it. | You, through Clerk |
| Your workspace | Company name and subdomain, the teams you set up, and their settings (targets, refresh schedule, saved snapshots) | You and your teammates |
| Invitations | The invited person's email address, who sent the invitation, and when it expires | The teammate who sends it |
| Your Jira connection | Your Jira site's address and ID, and the access tokens Jira issues to Baro, stored encrypted. If you connect with an API token instead, that token and the Jira account email it belongs to, both encrypted; the email is never shown. | You, when you connect Jira |
| Jira data (read-only) | Boards, sprints (name and dates), and issues (key, type, status, labels, components, story points, dates, status history). People on those issues are stored only as a key scrambled with your workspace's own secret, so a ticket's history can be grouped. That key can't be turned back into a Jira account. Ticket titles aren't stored: Baro fetches them from Jira when you choose to show them. | Your company's Jira |
| Website form | What you type into the form on raisethebaro.com, such as your email address | You |
| Feedback from the app | What you write in "Send feedback" (in the app's account menu), its topic and your workspace's subdomain. If you tick the boxes, also the name of the page you were on with your browser and operating system (as your browser reports them), and your sign-in email so we can reply. It goes straight to our inbox and isn't stored in Baro. Never any Jira data. | You |
| Technical logs | IP address, the page or API path requested, and the time, kept in our hosting provider's logs. Secrets are removed from logs. | Your browser |
What we do not collect
- No write access to Jira. Baro only reads. It never creates, edits or deletes anything in your Jira.
- No ticket text. We don't store ticket titles, descriptions, comments or sprint goals. Titles are fetched from Jira only when you choose to show them, and aren't saved.
- No identifiers for the people in your Jira. No names, email addresses, avatars or Jira account IDs. A scrambled key, unique to your workspace, tells us two changes were made by the same person without revealing who.
- No individual scoring. Baro's dashboards show team-level numbers, never a ranking of people.
- No advertising or analytics trackers, in the app or on the website.
- No payment details. Baro doesn't take payments yet.
We don't sell personal information, share it for advertising, or use it to train AI models.
How we use it
| Purpose | What it involves | Legal basis (EU and UK) |
|---|---|---|
| Provide Baro | Read your Jira, work out team metrics, show your dashboards and keep their history | Our contract with your company; for Jira data, your company's instructions |
| Sign you in and keep your account safe | Sign-in, including a code emailed when you sign in on a new device | Our contract |
| Send account emails | Sign-up and sign-in codes, sent through Clerk | Our contract |
| Help when something breaks | Look at logs and the relevant workspace data when you ask for support or a sync fails | Our legitimate interest in running a reliable service |
| Prevent abuse | Detect and block suspicious sign-ins and misuse | Our legitimate interest in security |
| Answer you | Reply to messages sent through the website form, and to feedback sent from the app when you ask for a reply | Your request |
Where it is stored and who processes it
The Baro app and its database run in the United States, in Ohio. These providers handle data on our behalf, each only for the job listed:
| Provider | What it does for Baro | Data it handles |
|---|---|---|
| Render | Runs the Baro app, and hosts the website and the public demo | Everything the app processes, plus request and visit logs |
| Neon | Hosts Baro's database | Everything in "What we collect", except passwords, the website form and feedback from the app |
| Clerk | Sign-up and sign-in | Your name, email address, password (hashed), sign-in sessions and the devices you sign in from |
| Optional "Continue with Google" sign-in | Your name and email address from your Google account, only if you choose it | |
| Atlassian | Your Jira, which you authorize Baro to read | The access Baro is granted; the Jira data itself is yours |
| Web3Forms | Delivers the website form and feedback from the app to our inbox | What you type into the form or the feedback box, and what you choose to include with it |
| Google Fonts | Serves the website's fonts | Your IP address when your browser loads them |
If you're outside the United States, your data is transferred there. Where the law requires it, we rely on the providers' standard contractual clauses for those transfers.
How long we keep it
| Data | Kept for |
|---|---|
| Your account and your workspace | As long as the workspace exists |
| Jira data and metric history | As long as the workspace exists; the history over time is what Baro shows you |
| Stored copies of Jira responses, kept so a past sync can be recalculated | 90 days |
| Jira access tokens | Until you disconnect Jira, which deletes them at once |
| Invitations | Until they expire, are accepted or are revoked; the record stays with the workspace |
| Technical logs | A limited period set by our hosting provider |
Deleting your data. Email connect@altevant.com from the address on the account. We delete the workspace and everything in it (users, teams, Jira data, history, tokens) within 30 days. Deleting a workspace removes all of its data together; nothing is kept behind. To leave a workspace without deleting it, ask that workspace's admin or us.
How we protect it
- Encrypted in transit. Every page and API call uses HTTPS.
- Jira tokens encrypted at rest with AES-256-GCM before they are stored.
- One company's data is walled off from another's inside the database itself, by row-level security. A request for one workspace can't read another workspace's rows.
- Read-only access to Jira, the smallest set of permissions Baro needs.
- No passwords on our side. Clerk handles them, and confirms a new device with an emailed code.
- Secrets kept out of logs. Tokens and keys are removed before anything is written to a log.
No system is perfectly secure. If a breach affects your personal information, we'll tell you, and the authorities where required, without undue delay.
Your choices and rights
You can ask us to:
- see the personal information we hold about you, and get a copy;
- correct anything that's wrong;
- delete it, or delete your whole workspace;
- stop or limit a particular use of it, where the law gives you that right.
Email connect@altevant.com. We reply within 30 days and may ask you to confirm it's really you.
For data that came from your company's Jira, your company decides how it's used, so we may pass your request to your workspace's admin. Disconnecting Jira in Settings stops all reading at once.
If you're in the EU or UK and unhappy with how we've handled your data, you can complain to your local data protection authority. California residents: we don't sell or share personal information, as those words are defined in the CCPA.
Cookies
Baro uses only what it needs to work:
- Sign-in cookies from Clerk keep you signed in across your workspace's pages.
- Your browser's local storage remembers display choices on your own device, such as the order of dashboard cards and which ones you've hidden. It never leaves your browser.
There are no advertising or analytics cookies, in the app or on the website. The website loads its fonts from Google Fonts, which sees your IP address.
Changes and contact
If this policy changes, we'll update the date at the top. For a significant change, we'll also email account holders before it takes effect.
Baro isn't meant for children and we don't knowingly collect their data.
Contact: connect@altevant.com ยท Azure Advisory Group LLC, 8 The Green STE B, Dover, DE 19901, United States