Privacy policy

Last updated: July 20, 2026

FeatureJet (“we”, “us”) provides hosted feedback boards at featurejet.com and customer subdomains. This policy explains what we collect, why, and the choices you have. It applies to board owners (our customers) and to voters who participate on boards.

Data controller

The data controller under GDPR, and the business under CCPA, for the personal data described in this policy is Visiting Cardinals LLC, a single-member limited liability company organized under the laws of the State of Michigan, USA. This policy is governed by the laws of the State of Michigan, USA. Send privacy requests or legal notices about this policy to Visiting Cardinals LLC, 2842 Prairie View Rd, Ann Arbor, MI 48108, USA, or to hello@featurejet.com.

What we collect

Board owners: your email address, a password hash (we never store the password itself), your organization name, board content, and billing status. Payments are processed by Stripe; we never see or store card numbers.

Voters: your email address (used for verification and the notifications you request), the posts, votes, and comments you submit, and coarse technical data (IP address for rate limiting and abuse prevention). Your email is visible to the owner of the board you participate on, and to no one else. It is never displayed publicly.

How we use it

To operate the service: authenticating you, rendering boards, counting votes, sending magic links, shipped notifications, password resets, and — only if you opted in — board update emails. Every marketing-style email contains a one-click unsubscribe that is honored immediately and enforced by our email platform's suppression list.

Analytics

We use self-hosted, cookieless Umami analytics on our marketing pages and boards. It records page views without cross-site tracking, advertising identifiers, or sale of data.

Session replay (marketing site only)

On our marketing pages at featurejet.com we also run self-hosted session replay, which records how visitors move through a page so we can find and fix confusing ones. The recordings stay on our own servers — no third party receives them — and anything typed into a form field is masked before it is recorded. Session replay never runs on customer boards, the dashboard, or sign-in pages: it does not record board owners managing their boards or voters participating on them.

Sharing

We share data only with the processors required to run FeatureJet: Stripe (payments), Postmark (email delivery), our hosting provider, and Anthropic (AI drafting). We do not sell personal data, run ads, or share data with brokers. We may disclose information if legally required.

The Anthropic case is narrow and worth stating plainly. FeatureJet has two optional drafting features for board owners: a shipped announcement and a reply to a request. They run only when a board admin clicks Draft. When that happens, the request's title and body and up to five visible comments — text written by voters — are sent to Anthropic's Claude API to generate the draft. We strip obvious email addresses, phone numbers, and street addresses first, but that is a best-effort filter, not a guarantee: the remaining text is sent as written. Nothing is sent unless an admin clicks the button, and voter email addresses, account records, and billing data are never included. Anthropic's Commercial Terms of Service state that “Anthropic may not train models on Customer Content from Services,” and Anthropic states that it deletes API inputs and outputs within 30 days of receipt or generation, subject to limited exceptions it describes (for example, retention needed to enforce its usage policy or to comply with law).

Retention and deletion

Board content is retained while the owning account exists. If a subscription lapses, boards become read-only but are not deleted. To delete your account, a board, or a voter profile (including votes and comments), email hello@featurejet.com and we will complete the deletion within 30 days.

Security

Passwords are hashed with PBKDF2, sessions are HTTP-only cookies, traffic is TLS-encrypted, and voter actions are verified by signed tokens. No internet service can promise perfection; we promise prompt disclosure if an incident affects your data.

Your rights

You may request a copy, correction, or deletion of your personal data at any time via hello@featurejet.com. If you are in the EU/EEA or UK, these requests are handled under GDPR; if in California, under CCPA.

Changes

We will post any changes to this policy here and update the date above. Material changes will be announced by email to board owners.

Questions? Email hello@featurejet.com.