Privacy policy

• What we collect: your Google account email (sign-in identity), shift events from a calendar feed you provide, and receipt emails you forward — including their attachments.
• Where it lives: data is stored on Cloudflare (D1 database and R2 storage) under the operator's account; forwarded email content is sent to Anthropic's API solely to extract expense data.
• Who sees it: only you. Accounts are fully separated; the operator does not read, sell, or share your data with anyone.
• Retention: forwarded emails are kept as submission evidence for as long as you have an account.
• Taking your records out: Settings → Your data → Export downloads everything you have recorded — hospitals, shifts, expenses, receipts and timesheets — as one file, with a link to every stored receipt and photo. It works whatever state your account is in.
• Deleting your account: Settings → Your data → Delete my account. You type your own email address to confirm, and your rows and your stored files are erased immediately and irreversibly. No email to the operator required.
• The one exception, stated plainly: the database is backed up nightly and those dated dumps are kept for 30 days. Records you delete are gone from the live database at once, but survive in the dumps until each one ages out — at most 30 days. Nothing reads them except a restore after a disaster. Receipt files and attachments are not in those backups; deleting your account removes them straight away.
• Contact: m.mirghorbani@gmail.com.

⚠️ Placeholder document. This is not final legal text — it states intent while the service is private and invite-only, and will be replaced before any broader availability.