Privacy and data controls

Recognition tools hold a record of who thanked whom, for what and when. That’s personal, so Pointd Pal gives each person control over their own record.

Controls for every member

Send these to the bot in a direct message, or mention it in a channel:

• opt out removes you from Pointd Pal. Nobody can give you points, you can’t give any, and you’re left off leaderboards and digests. opt in brings you back. There’s also a toggle on the App Home tab.
• export me sends you a file with your profile and every recognition you gave or received, with dates, reasons and links.
• erase me deletes your recognitions and clears your profile, after you confirm with a button.
• mute stops the DMs Pointd Pal starts on its own: offers to add a reason, thanks suggestions and, for admins, notices about redemptions and billing. Replies to something you asked for still arrive. unmute turns them back on, and the App Home tab has a toggle too.
• feedback <your note> sends a note to the people who build Pointd Pal, without your name. To let them reply, use Send feedback on the App Home tab and tick the box.

Answers always arrive in a private message. If you ask in a channel, the bot only tells you “I’ve sent you a DM”, so nobody else learns what you asked for.

How Pointd Pal handles your workspace’s data

• Encrypted tokens: Slack access tokens are encrypted at rest, with keys we rotate, and Pointd Pal supports Slack’s token rotation.
• Who can open the admin panel: the platform’s own admins, plus anyone an admin grants access to under Settings, Admins. Every grant and removal goes in the audit log, and a workspace can’t remove its last way in.
• Admins in control: admins can export or erase one person’s data from the People page, export the workspace’s recognitions and people as CSV on Pro, and delete all of the workspace’s data from the Data page, within a day.
• Uninstall means delete: when a workspace removes Pointd Pal, its data is deleted 30 days later.
• Encrypted backups: the database is backed up every night to Backblaze B2, encrypted before it leaves our servers. Backups expire within 12 months.
• Few third parties: data is processed by Slack, Neon (database), Backblaze (encrypted backups) and Stripe (billing, for paid plans). The full list is on the subprocessors page. There are no chart services, price lookups or ad trackers.
• Security reports: email security@pointdpal.com. Privacy requests go to privacy@pointdpal.com.
• No surprises in public: negative points, bottom leaderboards and posting every point to a channel are all off unless a workspace turns them on.