Trello is a kanban-style project management app operated by Trello, Inc., a wholly-owned subsidiary of publicly traded Atlassian Corporation (Nasdaq: TEAM) since its 2017 acquisition. It runs under Atlassian's unified privacy policy, which describes collection of account information, board content (processed in a processor role for customers), device and connection data, and IP-derived approximate location. Atlassian and its advertising and analytics partners use cookies, web beacons, and pixels, including targeting cookies whose browsing-habit data is shared with adtech providers; the policy's US state-law table lists identifiers, geolocation data, and inferences as categories whose disclosure to third-party advertising providers may constitute 'sales' or 'sharing,' with opt-outs including Global Privacy Control honored where required. Boards set to Public are viewable by anyone with the link. In January 2024, a threat actor abused an unauthenticated public API endpoint to link about 15.1 million accounts' email addresses to public profile data; Atlassian reported no systems breach and hardened the endpoint. Atlassian publishes an annual transparency report covering government data requests, including Trello since 2017.
TRACK RECORD
1 BREACH
[2024-01-16] · BREACH
Have I Been Pwned lists a breach record for Trello: "Trello".
Approximately 15,111,945 accounts affected, per HIBP.
Trello's Apple App Store privacy label declares data collected and linked to user identity — including email address, name, user ID, device ID, product-interaction usage data, and diagnostics — with declared purposes including "Developer's Advertising or Marketing" and Analytics. The label does not declare any "Data Used to Track You" category (cross-app/cross-site tracking).
Atlassian's privacy policy, which governs Trello, states that the company collects device and connection information including operating system, browser type, IP address, referring/exit URLs, device identifiers, and crash data, and uses IP address to approximate the user's location. Content posted in Atlassian products is processed "in the role of a processor or service provider" on behalf of customers.
Atlassian publicly announced its agreement to acquire Trello in a January 9, 2017 blog post by its co-founder, so the change of ownership was disclosed openly at the time.
Trello, Inc. (United States) is listed as a wholly-owned subsidiary of Atlassian Corporation in Exhibit 21.1 of Atlassian's fiscal-2025 Form 10-K filed with the SEC. Atlassian Corporation trades publicly on Nasdaq as TEAM, making the ownership chain a matter of public regulatory record.
Atlassian's transparency report states that it scrutinizes government requests for user data for legal validity, notifies the customer unless prohibited by law, and responds as narrowly as possible; its US response tables have included Trello user data requests since 2017.
Trello boards can be set to "Public" visibility, in which case, per Atlassian's documentation, the board's contents are viewable by anyone on the internet with the link, though public boards are not indexed by search engines. Boards can also be Private, Workspace-visible, or Organization-visible.
Atlassian's US state-law disclosure table lists identifiers (name, email address, unique IDs, IP address), geolocation data, and inferences as categories whose disclosure to recipients including "Third Party Advertising Providers" may be considered "sales" or "sharing" for cross-context behavioral advertising under US state laws. The policy offers opt-outs and honors Global Privacy Control signals where required.
Atlassian publishes an annual transparency report covering government requests for user data and content-removal requests, with Trello user data included since the 2017 report; for 2025 it reported responding to US requests (13 with some user content, 16 with non-content data, 2 objections with no data disclosed) and zero US national security requests.
Have I Been Pwned's breach catalog lists the "Trello" incident (trello.com), breach date 2024-01-16, affecting approximately 15,111,945 accounts. Data classes exposed per HIBP: Email addresses, Names, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
In January 2024 a threat actor offered data on 15,115,516 Trello members on a hacking forum, built by querying a publicly accessible Trello REST API endpoint with a pre-existing list of email addresses to link non-public email addresses to public profile data. Atlassian said it found no evidence of unauthorized access to Trello systems, attributing the data to scraping/enumeration of public profiles.
In July 2024 the full set of 15,115,516 scraped Trello profiles, including the linked email addresses, was released on a hacking forum for a nominal fee. Atlassian confirmed it had changed the API in January 2024 so unauthenticated users can no longer request another user's public information by email address.
Atlassian's Cookies & Tracking Notice discloses targeting/advertising cookies that record browsing habits and share that information with advertising technology service providers and advertisers, plus Google Analytics cookies, social media cookies, web beacons, and email open/click tracking. Strictly-necessary cookies cannot be opted out of.
Atlassian's privacy policy states that Atlassian and third-party advertising and analytics partners use cookies, web beacons, device identifiers, and pixels on its services, including to recognize users across different services and devices.