Privacy Policy
Last updated 26 October 2026 · Shifting Atoms, Sweden
Who we are
Pitwall is a team coordination app made by Shifting Atoms, based in Sweden. This policy explains what personal data Pitwall handles, why, and the choices you have. If you have a question about it, write to [email protected].
Pitwall is used by organisations. For the content a team puts into its workspace, the organisation that runs the workspace decides what goes in and who can see it, and we process that content on its behalf. For account data, security and the running of the service, Shifting Atoms is the controller.
What we collect
Your account
- Your name and email address, and the identifier our sign-in provider gives your account.
- Your timezone, role, employment type and weekly target hours, as set in your workspace.
- Your preferences, such as notification settings and favourite projects.
What you and your team create
- Availability schedules, meetings and who attends them.
- Projects, tasks, pages, diagrams, journal entries and comments.
- Files and images you upload, such as attachments and your organisation's logo.
- A record of activity in the workspace, used for history, notifications and restoring earlier versions.
Connections you choose to make
- If you connect Google Calendar: the details described in the next section.
- If you connect an AI assistant to Pitwall: a record of that connection and the access you approved.
Technical data
Our servers log requests, including IP address, browser type and the time of each request, to keep the service secure and to fix faults. Pitwall stores your sign-in session and a few display preferences (theme, language, timezone view) in your browser. We do not use advertising or analytics cookies, and we do not track you across other sites.
Google user data
Connecting Google Calendar is optional. You connect it from Settings, and Google asks for your permission first. Pitwall requests two permissions:
- See your email address (
userinfo.email), so Pitwall can show which Google account is connected. - View and edit events on your calendars (
calendar.events), so that when you organise a meeting in Pitwall, it can create the event on your primary calendar with a Google Meet link and invite the attendees, update it when the meeting changes, and cancel it when the meeting is deleted.
Pitwall only creates, changes and deletes the events for meetings booked in Pitwall. It does not read, copy or store your other calendar events. To do this, Pitwall sends Google the meeting's title, time and attendees' email addresses, and keeps the event's ID and Meet link with the meeting.
We store the access Google grants us (an OAuth refresh token) encrypted, along with the connected account's email address and the permissions granted. Google user data is used only to provide this feature. We do not sell it, use it for advertising, use it to train AI models, or share it with anyone else except as needed to provide the feature, for security, or to comply with the law. No one at Shifting Atoms reads it unless you ask us to for support, or it is needed for security or legal reasons.
Pitwall's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting Google Calendar in Settings deletes the stored token and the connected email address straight away. To also revoke Pitwall's access on Google's side, remove it at myaccount.google.com/permissions. Events already created stay on the calendars they were sent to.
How we use your data
- To run Pitwall: sign you in, show your team's work, and schedule meetings. (Legal basis: performing our contract with you or your organisation.)
- To send the emails you've asked for, such as invitations and notifications, which you can turn off in Settings. (Contract.)
- To keep the service secure, prevent abuse and fix problems. (Our legitimate interest in running a safe, working service.)
- To connect the services you choose, such as Google Calendar. (Your consent, which you can withdraw by disconnecting.)
- To meet legal obligations. (Legal obligation.)
We do not sell personal data and we do not use it for advertising.
International transfers
Some of our providers process data outside the European Economic Area, including in the United States. Where they do, the transfer is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
We keep your data while your account or your organisation's workspace is active. Pages moved to Trash are deleted permanently after 30 days. When an account or workspace is closed, or you ask us to delete your data, we delete it within 30 days, except where the law requires us to keep it. Backups are overwritten within a further 90 days.
Your rights
Under the GDPR you can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent at any time. Write to [email protected]. If your data is in an organisation's workspace, we may refer your request to that organisation, since it controls that content.
You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or to the data protection authority where you live.
Security
Data is encrypted in transit. Access tokens for connected services are encrypted at rest, and access to production systems is limited to the people who run Pitwall. No system is perfectly secure, but we work to protect your data and will tell you and the authorities about a breach where the law requires it.
Children
Pitwall is for work and is not meant for anyone under 16.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change is significant, we'll tell you in the app or by email before it takes effect. See also our Terms of Service.