Least privilege
CrewBeat is an admin-managed Zoom app. It never reads channel messages. The only text it sees is what people type into its own slash commands and cards. It requests the smallest set of scopes that make standups and celebrations work:
- Team Chat bot (
imchat:bot): send messages and cards to users and to channels the bot was added to, and receive slash commands and button clicks. - Users, read-only: names, email addresses and time zones of the people in your account, so prompts arrive at the right local time.
- Channel members, read-only: used only when a standup is set to "everyone in the channel", and to list the channels you can pick from.
Kudos and coffee pairings will add a meeting-creation scope when they ship, and will be requested only then.
What we store
- Your Zoom account id and the admin's OAuth tokens, encrypted at rest.
- Member names, emails, Zoom ids and time zones.
- Birthdays as month and day only. Birth years are never collected. Start dates with the year.
- Standup questions, answers and timestamps, so the dashboard can show history and participation.
- A log of messages the bot sent, for troubleshooting.
How it is protected
- Every request from Zoom is verified with an HMAC signature before it is processed.
- Tokens are encrypted with the application key; the chatbot token is refreshed hourly and never stored on disk.
- Traffic is TLS only, behind Cloudflare. Databases and queues are not reachable from the internet.
- Only the dashboard user who signed in with your Zoom account can see your account's data.
Uninstall and deletion
When an admin uninstalls CrewBeat, Zoom sends a deauthorization event. We immediately revoke and delete the account's tokens, pause standups and stop celebrations. Email hi@staticmaker.com to have all remaining data deleted.
Reporting a vulnerability
Email hi@staticmaker.com. We acknowledge reports within one business day.