What is Personal Data and Why Does It Matter?

Trello is committed to compliance with the General Data Protection Regulation (GDPR).The regulation contains the most significant changes to European data privacy legislation in the last 20 years. It is designed to give EU citizens more control over their data and seeks to unify a number of existing privacy and security laws under one comprehensive law.

Because Trello provides access to a user's personal data via our API and platform, when a user makes a request to Trello to be forgotten, it is Trello's responsibility to pass that request along to third-party applications storing the data so that the applications can also respect the user's request.

Personal data (PD) is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data, such as these fields from Trello's API and Power-Ups platform: email, avatar, username, full name, and bio.

If your app stores any personal data, you'll need to read through this page to understand the requirements we've set out for you to be in compliance with our policies and practices regarding GDPR and users' right to be forgotten.

If your app doesn't store personal data, then all you need to do is register to let us know! You can skip ahead to the registration section.

Best Practices

Ideally, your application doesn't need to store PD. Instead, it should make requests to the API at time-of-need and use the response from the request to display the necessary data to the user. By using the data straight from the API, you won't be responsible for meeting compliance requirements for storing PD and you'll always have the most up-to-date information for the user.

Additionally, you should be refreshing user data frequently and at minimum every 30 days. This ensures that you always have the most up-to-date information about a user. Any data about the user that has changed or that you no longer have access to should be deleted.

PD Storage Compliance Requirements

If your public app stores personal data outside of Trello for more than 14 days, you must comply with the requirements outlined in this section.

Overview

There are three parts to complying with Trello's data storage policy. Simply put they are:

• Registration: Register whether or not your are storing PD.
• Polling: Poll at least every 14 days for Right to be Forgotten and Right to Rectification notifications
• Badging: We'll show users whether or not you are in compliance.

A more in-depth overview:

Registration: When creating/updating an app in the admin portal, you will be prompted to answer whether your app stores personal data or not. If it does store personal data, you must add a confidential OAuth 2.0 client or Trello Auth API key to your app.

Polling: When a Trello user requests their account to be deleted and forgotten or when they have updated their profile information, Trello will make that user's member ID available via an API. Apps should regularly poll for member IDs; when they detect an ID of a member for which they are persisting data any data associated with the user should be deleted. Apps that are registered as storing personal data are expected to poll the compliance API at least every 14 days to determine whether there are users whose data should be forgotten or whose member profile information should be updated.

Badging: When a user is shown information regarding the app, for instance, when a user is prompted to grant access to an app or enable a Power-Up, those apps that have polled regularly will include copy on the prompt indicating as much. Those who have not polled appropriately will be shown to not be in compliance with Trello's data policies.

Registration

In the app admin portal (https://trello.com/apps/admin) you will be prompted with the following:

1
2
3
4
Does your app store any Trello user personal data?

Personal data is any data that can be used directly or indirectly to identify a user such as a Trello user’s avatar, email, username, full name, bio, and locale.

You should select the box appropriate to what your app does. Failure to register whether an app stores personal data will result in the app being considered not in compliance.

If your app does store personal data, you must add a confidential OAuth 2.0 client or Trello Auth API key to your app. You will use either an OAuth 2.0 token or the Trello Auth API key's secret when polling.

Compliance Polling API

Public apps must poll the /1/plugins/{idPlugin}/compliance/memberPrivacy at least once every 14 days to remain in compliance.

There is a single compliance route for public apps that accepts a since and limit query parameter. It returns records that include IDs for Trello Members that have been deleted as well as notifications for members who have updated their profile. The routes return the records ascending by date and return a maximum of 1000 records.

Example OAuth 2.0 polling request

You will need your OAuth 2.0 client id and secret which you can find in the OAuth 2.0 tab of your app management page.

1. Request a token from https://auth.stg.atlassian.com/oauth/token.

   1
   2
   3
   4
   5
   6
   7
   8
   9
   curl 'https://auth.atlassian.com/oauth/token' \
   --header 'Content-Type: application/json' \
   --data '{
    "client_id":"4HXojxmatSLcrKdBrkANPJLskC2EMIEu",
    "client_secret": "ATOA8u3DdtYXwiQn_3CfRpoSxJ24l3GZb7EVET5JOv1doBTpFfNZl3DrdgNVTosBMp5RAD42BE1A",
    "grant_type": "client_credentials",
    "scope": "read:client.privacy"
   }'
   

2. Use that token to poll the compliance route at https://api.trello.com/1/plugins/{id}/compliance/memberPrivacy.

   1
   2
   3
   4
   5
   curl -G 'https://api.trello.com/1/plugins/5a3972294816f458a0451dd4/compliance/memberPrivacy' \
   --header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI...yMzQ1In0' \
   --data-urlencode 'limit=2' \
   --data-urlencode 'since=2018-10-22%2000:59:01Z'
   

Example Trello Auth polling request

You will need your Trello Auth API secret which you can find in the Trello Auth tab of your app management page.

Use your Trello Auth API secret to poll the compliance route at https://api.trello.com/1/plugins/{id}/compliance/memberPrivacy.

1
2
3
4
5
curl -G 'https://api.trello.com/1/plugins/5a3972294816f458a0451dd4/compliance/memberPrivacy' \
--data-urlencode 'secret=d818d7a1cb6d8c89210e1b02533f100ze6b372e50dd7a1cb0f3b49c48' \
--data-urlencode 'limit=2' \
--data-urlencode 'since=2018-10-22%2000:59:01Z' \

Example Compliance Polling API Response

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
[
  {
    "id": "5bce1f1a46e91b8d13738bf4",
    "date": "2018-11-11T21:19:57.671Z",
    "event": "accountDeleted",
    "authType": "oauth2"
  },
  {
    "id": "5be535b7362ce488fde19961",
    "date": "2018-11-11T21:21:00.795Z",
    "event": "accountDeleted",
    "authType": "trelloAuth"
  },
  {
    "id": "5b575b205f34f90c743e8e04",
    "date": "2019-04-04T21:48:36.811Z",
    "event": "tokenRevoked",
    "authType": "trelloAuth",
    "identifier": "Server Token"
  },
  {
    "id": "5b575b205f34f90c743e8e04",
    "date": "2019-04-05T02:03:32.520Z",
    "event": "accountUpdated",
    "authType": "trelloAuth",
    "alteredFields": ["bio"]
  },
  {
    "id": "5b575b205f34f90c743e8e04",
    "date": "2019-04-06T10:48:36.111Z",
    "event": "tokenExpired",
    "authType": "trelloAuth",
    "identifier": "Matt's App"
  }
]

There is a maximum of 1,000 records returned from the route. The since and limit params can be used to page through the results, if needed.

The response to the API includes the time at which the event took place. This date value can be used as the value for the since query parameter. This allows you to filter the response to a time-window smaller than 14 days. Any value greater than 14 days ago will be ignored and the last 14 days worth of data will be returned.

Please do not poll more frequently than once every 10 seconds or you will receive a 429 error response.

Paging Example

Let's imagine that we wanted to get only two records to process at a time, we would use both the since param and the limit param to page through the results. Our initial request would be:

1
2
curl https://api.trello.com/1/plugins/5a3972294816f458a0451dd4/compliance/memberPrivacy?limit=2

This gives us the two oldest records:

1
2
3
4
5
6
7
8
9
10
11
12
13
[
  {
    "id": "5bce1f1a46e91b8d13738bf4",
    "date": "2018-11-11T21:19:57.671Z",
    "event": "accountDeleted"
  },
  {
    "id": "5be535b7362ce488fde19961",
    "date": "2018-11-11T21:21:00.795Z",
    "event": "accountDeleted"
  }
]

We can use the date for the last result to get the next page of results:

1
2
curl https://api.trello.com/1/plugins/5a3972294816f458a0451dd4/compliance/memberPrivacy?limit=2&since=2018-11-11T21:21:00.795Z

And that will get us the next page of results:

1
2
3
4
5
6
7
8
9
10
11
12
13
[
  {
    "id": "5be535b7362ce488fde19961",
    "date": "2018-11-11T21:21:00.795Z",
    "event": "accountDeleted"
  },
  {
    "id": "5be8973b791d0d5cca9c789a",
    "date": "2018-11-11T21:27:02.904Z",
    "event": "accountDeleted"
  }
]

If you are paging through responses, you should de-duplicate records. In our example above, the record for member ID 5be535b7362ce488fde19961 occurs twice.

Events and Expected Actions

The following four event types are returned from the compliance polling route: accountDeleted, tokenRevoked, tokenExpired, and accountUpdated. As a developer, you should take specific actions in your systems based on the event types. Below we'll outline the purpose of the event and the action we expect you to take. The expected action is the same regardless of whether the event applies to a Trello Auth or an OAuth 2.0 user; see Distinguishing Trello Auth and OAuth 2.0 events for how to tell the two apart via the authType field.

Compliance Badging

When a user is shown information regarding an app, specifically when they are granting access to an app or adding a Power-Up to a board, Trello will include the following copy and information to indicate whether the app is in compliance with Trello's data privacy practices outlined on this page.

For those who have registered as storing personal data and are in compliance via polling, the user will be shown the following:

{App name} stores personal data and is in compliance with Trello's [data and privacy practices](https://help.trello.com/article/1118-trello-and-gdpr-our-commitment-to-data-privacy)

For those who have registered as not storing personal data, the user will be shown the following:

{App name} does not store personal data and is in compliance with Trello's [data and privacy practices](https://help.trello.com/article/1118-trello-and-gdpr-our-commitment-to-data-privacy)

For those who have registered as storing personal data but are not in compliance via polling, the user will be shown the following:

{App name} stores personal data and is not in compliance with Trello's [data and privacy practices](https://help.trello.com/article/1118-trello-and-gdpr-our-commitment-to-data-privacy)

Failure to register whether an app stores PD will result in the app being considered not in compliance. In this scenario, the user will be shown the following:

{App name} may store personal data and is not in compliance with Trello's [data and privacy practices](https://help.trello.com/article/1118-trello-and-gdpr-our-commitment-to-data-privacy)

The badge will be shown based on whether the lastPolled date for the app is within the past 14 days. You can check the lastPolled date for your app by making a request to the /1/plugins route. For example, the following request:

1
2
GET https://api.trello.com/1/plugins/{IdPlugin}/

Returns a JSON payload that includes the following object:

1
2
3
4
5
6
"compliance": {
  "lastPolled": {
    "memberPrivacy": "2019-01-14T16:44:31.083Z"
  }
}