Canonical page: https://priv-life.com/privacy

# Priv Life Privacy Policy

**Effective date:** September 3, 2026
**Last updated:** October 18, 2026. Section 13 also notes that the tab-lifetime step markers now include Budget's two-step verification screen, so we can tell how many new accounts are stopped by it; it is the same kind of marker as the sign-up one beside it and holds no more than that the step happened. Section 13 further describes two things added for advertising measurement, both of the same kind as what was already there and neither of them an identifier: the `utm_source` from an advertising link is kept beside the campaign tag, for the same 30 days and under the same rules, so an ad whose address lost our own `?c=` tag can still be counted to the service it was shown on rather than counted as nothing; and our advertising landing pages keep tab-lifetime markers for how far a visit got on the page — opened, scrolled, button clicked, left quickly — so each of those counts once per visit. What reaches our analytics is still only a count per page per day, there is still no third-party pixel or advertising cookie of any kind, and nothing is shared with the advertising platforms. (October 17, 2026.) Section 13 describes our own first-party counting in full. When you arrive on one of our own tagged links, that tag is kept in your browser's local storage for 30 days so we can tell which of our own links led to a sign-up; it holds the tag and the date and nothing else, it is never transmitted with your requests, it is never shared, and it is not joined to your account. The same section now lists every entry the apps keep in a browser for counting — the visit marker, the returning-browser bit, the sign-up and milestone markers, and the campaign tag — where it previously lumped the markers in with preferences, and it states plainly that the only cookies on Priv Life are the ones that sign you in. That list is checked against the code by a test, so a new entry cannot ship undescribed. Nothing in section 6 changes: still no advertising, no profiles, no third-party analytics, and no data sold or shared. (October 3, 2026.) Section 5D.4 now covers a choice a league can make: listing team rosters on its public team pages, as first name and last initial, full names, or full names with email — with two rules that hold whatever the league picks: a child appears at most as a first name and last initial, and a child's contact details never appear. The default remains no roster at all. (October 2: Teams became Priv Life Sports, and 5D.5 added league player records — positions and an admin-entered rating, administrators only, never public, in your export, erased on leave-with-erasure.) We publish these rules before each feature ships, so they exist before any of that data does. Section 5D remains the first and only place a child's information can appear on Priv Life: as a dependent profile a guardian manages, per section 12.
**Operator:** PrivLife LLC, a Delaware limited liability company, Ocala, Florida, United States
**Contact:** support@priv-life.com

At Priv Life, you are not our product. Our apps are. This policy explains what each Priv Life app stores, why, who else touches it, and how you get it back or make it go away. It covers every app under priv-life.com: Budget, Vote, Residency Tracker, and any app we add later. Where an app needs its own rules, it has its own section below.

## 1. Who we are

Priv Life is built and run by PrivLife LLC, a one-person company in the United States. There is no sales team, no analytics team, and no advertising business. The only person with access to production systems is the operator, and this policy is written in that light.

## 2. The short version

- We store the data you need the apps to work, and nothing collected for its own sake.
- We will not sell or share your data without your permission. The only exception is the vendors we need to run the service, listed in the sub-processors table below, and they may use it only to provide that service to us.
- We never share it with advertisers, never build a profile of our own about you, and never show it to anyone you did not choose. To be exact about the word: the apps hold records *you* or *your organization* created and can see — a roster entry, a player profile, an employment record — and those are the product. What does not exist is a profile Priv Life keeps about you for its own purposes, assembled across organizations or sold to anybody.
- Your bank login never reaches us. Plaid handles that, and we hold only an encrypted token that lets us read transactions.
- You can export your data, delete parts of it, or delete your whole account at any time.

## 3. Sign-in and identity (all apps)

We use Clerk to handle sign-in. When you create a Priv Life account, Clerk stores your email address, your name if you give one, your password hash or the identity provider you chose (for example Google), and session records. Clerk's handling is governed by its own privacy policy at https://clerk.com/legal/privacy.

Each Priv Life app stores your Clerk user id so it can tell your data from everyone else's. Vote also caches your name and email so an organization's roster can be displayed without a lookup on every row. Budget stores your email only if you have chosen to provide it. Each app also records the hour your account was last used (updated at most once an hour), which we read only as a total ("how many accounts were active this week"), never per person; see section 7.

One Priv Life account works across every app. A "welcome seen" flag is kept in your Clerk account metadata so the welcome message appears once, not once per app.

Sessions in Budget end after 30 minutes of inactivity, as they do in the other apps that can see or move money: My Priv Life (your bank connections and your subscription), Members (an organization's subscription), Invoice and Giving. In every other app a session ends after 24 hours of inactivity, because what is on those screens is a roster or a schedule rather than your money. Being active in any Priv Life app counts as being active in all of them, and signing out ends your whole session — so if you leave a money app open, the shorter limit is the one that applies.

## 4. Priv Life Budget

Budget is a personal budgeting tool for individuals and households. It is not for organizations.

### 4.1 What Budget stores

| Data | Where it comes from | Why we keep it |
| --- | --- | --- |
| Linked bank connections: institution name and id, a Plaid item id, a sync cursor, the last sync time, and an encrypted Plaid access token | Plaid, when you link a bank | To import your transactions and refresh balances |
| Accounts: name, official name, last four digits, type and subtype, current and available balance, currency | Plaid, or entered by you for accounts you keep by hand | To show balances and net worth |
| Transactions: date, amount, description, merchant name, pending flag, Plaid's category guess, and the Plaid transaction id | Plaid, entered by you, or imported from a CSV file you upload | To show spending and income and to track budgets |
| Your own additions: categories, subcategories, two custom dimensions and their values, budgets per month, notes on transactions, transfer pairings | You | To organize and report on your money the way you want |
| Manual assets and debts: name, kind, value, notes, the date you last valued it | You | To include property, vehicles and private loans in net worth |
| Retirement plan: birth year, target age, starting balance and spending, growth and inflation rates, per-year overrides and notes | You | To run the retirement projection |
| Timestamps on every record | Automatic | To show when a balance was last updated and to keep records consistent |

Budget does not store your bank username or password, your full account number, your card number, or your Social Security number. Plaid does not give us those, and we do not ask you for them.

### 4.2 How Plaid works with Budget

When you link a bank, Plaid Link opens inside the app. You enter your bank credentials into Plaid, not into Priv Life. Plaid returns a short-lived public token; our server exchanges it for a permanent access token and stores that token encrypted with AES-256-GCM. The token never reaches your browser and is never written to logs.

We use Plaid's Transactions product only. When you link a bank we ask Plaid for up to two years of history. After that, Plaid notifies our server when new transactions are available, and we fetch them. You can also trigger a sync yourself.

Plaid's collection and handling of your data is governed by Plaid's End User Privacy Policy at https://plaid.com/legal/#end-user-privacy-policy. By linking a bank through Priv Life you also agree to that policy. You can review and revoke Plaid connections through Plaid Portal at https://my.plaid.com.

### 4.3 CSV import and export

You can export the transactions you see to a CSV file, and import a CSV from a bank or from an earlier export. Imported files are parsed in your browser. Only the rows you choose to import are sent to our server, and the file itself is never uploaded or stored.

### 4.4 Shared categories

An administrator can create categories that every Budget user can select. Those are category names only. No one, including the administrator, can see another user's transactions, balances, or budgets through the app.

## 5. Priv Life Vote

Vote runs elections for organizations such as volunteer ambulance corps, fire companies and clubs.

### 5.1 What Vote stores

| Data | Where it comes from | Why we keep it |
| --- | --- | --- |
| Your Clerk user id, name and email | Clerk | To show you on an organization's roster and turnout list |
| Organizations: name, tagline, color, emblem, invite code, allowed email domains, required sign-in provider, roster-only setting | The organization's admins | To brand and control who may join |
| Roster entries: email and optional name of expected members, and which account claimed each | The organization's admins | To let admins pre-load who belongs and see who has not yet joined |
| Memberships: which organizations you belong to and your role | You joining, or an admin | To decide what you may see and do |
| Elections, questions and options | The organization's admins | To run the vote |
| A record that you voted in a given election | Cast automatically when you vote, or entered by an admin for a returned paper ballot | To show turnout and to prevent voting twice |
| Ballots: the choices made, with no link to who made them | Cast automatically when you vote, or entered by an admin from a paper ballot | To count the results |

### 5.2 How your ballot stays secret

Every vote writes two records in one database transaction. The first says that you voted in this election. It has no timestamp, and its id is random rather than sequential. The second is the ballot itself: the choices, with no user id, no timestamp, and a random id. Nothing stored can join the two back together.

Results are counted only after an election closes. Organization admins can see who has voted and who has not. They cannot see how anyone voted, and neither can we.

This design defeats every honest path: the app, the API, the admins, and the data itself. It is not a cryptographic voting system. With a very small number of voters, a public tally alone can narrow down how people voted, and no system avoids that. A hostile database operator could in principle try to correlate rows by their physical storage order. We are the only database operator, and we do not do this.

### 5.3 Organization admins

An organization's admins control its roster, its members, and its elections. They see the names and emails of members and roster entries. Ask your organization who its admins are. Admins are bound by these terms not to use member data for anything other than running the organization's elections.

## 5A. Priv Life Residency Tracker

Residency Tracker records which US state you were in on each day, so you can count days per state for tax residency. It is a personal app: nobody else can see your records, including any organization you belong to.

### 5A.1 What Residency Tracker stores

| Data | Where it comes from | Why we keep it |
| --- | --- | --- |
| Your Clerk user id, name and email | Clerk | To keep your records apart from everyone else's |
| Day records: a date, a state code, and whether you entered it by hand or with a check-in | You | To count days per state |
| Check-ins: the time, the date, the state, and how accurate your device said the location was | You, when you tap "Check in today" | To keep a dated record of where you checked in |
| Coordinates on a check-in, rounded to about 110 meters | You, only if you turn on "Keep coordinates as evidence" | So you have supporting evidence if a tax authority asks where you were |
| Your setting for keeping coordinates | You | To know whether to store coordinates |

### 5A.2 How location works

Residency Tracker never reads your location in the background and never checks in on its own. A check-in happens only when you tap the button and your browser asks your permission.

Your browser works out which state you are in on your own device, using a map of state boundaries that ships with the app. By default only the state, the time, and the accuracy figure are sent to us. Your coordinates are sent only if you have turned on "Keep coordinates as evidence", and we round them to about 110 meters before storing them. If that setting is off, we discard any coordinates we receive.

You can remove every stored coordinate at any time from Settings, and turn the setting off so no more are kept.

### 5A.3 Not tax advice

Day counts are a record, not a tax opinion. States count days and decide residency differently. Confirm your situation with a tax professional.

## 5B. Priv Life Shifts (formerly Time)

Shifts is shift scheduling and time tracking for an organization's crew: who is needed, who signed up, and who actually worked. Unlike Budget and Residency Tracker it is not a personal app — what you record in it is your organization's record, and its administrators and managers can see it. The app was called Time until September 2026, when the business time-tracking app took that name; only the name changed, and section 5I covers the business app.

### 5B.1 What Shifts stores

| Data | Where it comes from | Why we keep it |
| --- | --- | --- |
| Your organization's name, slug, colors and emblem | An administrator | To identify the organization and brand its screens |
| Your member record: name, email, a member ID, job roles, and whether you are active | An administrator, or you when you are added by email | To put you on the schedule and the timeclock |
| Your Clerk user id, if you have an account | Clerk, when you sign in | To link your member record to your sign-in |
| Shifts you signed up for, and shifts assigned to you | You and your managers | To build and show the schedule |
| Clock-in and clock-out times, and the shift they belong to | You, at the timeclock or in the app | To record hours worked |
| Corrections to a time entry, with who made them and what they were before | A manager | So an hours record can be audited |

### 5B.2 Who can see it

Administrators and managers of your organization can see your member record, your shifts and your hours. Other members can see who is signed up for a shift, because a schedule with the names removed is not a schedule. Nobody outside your organization can see any of it, and no other organization on Priv Life can.

### 5B.3 The station timeclock

A manager can register a shared screen at your station as a timeclock. On that screen a member signs in with a member ID rather than a Priv Life account, because a shared device should not hold anyone's login. The device's registration is stored in that browser and can be revoked by a manager at any time. A member session on a shared screen ends by itself after a few minutes of nobody touching it.

### 5B.4 Leaving

An administrator can deactivate or remove your member record. Hours you worked stay on the organization's record, because they are its record of work done and may be tied to payroll or grant reporting.

## 5C. Priv Life Members

Members is how an organization keeps its roster: who belongs, what kind of membership they hold, what committees they sit on, which certifications they hold and when those expire, whether they are in good standing, and dues if the organization collects any.

It is the clearest case of something that is true across every organization app, so it is worth stating plainly: **an organization's record of you belongs to that organization, not to us and not to your Priv Life account.**

### 5C.1 What an organization's record holds

| Data | Where it comes from | Why it is kept |
| --- | --- | --- |
| Your name as the organization records it, and contact details | An administrator, or you | To have a roster |
| Custom fields the organization invented — shirt size, badge number, anything | An administrator, or you where they allow it | Because every organization tracks something nobody anticipated |
| Membership: type, status, the dates it ran, and any office you held | An administrator | To know who belongs, and to answer who held office when |
| Certifications: name, number, issuer, issue and expiry dates, and who verified them | An administrator, or you | To know who is current and who is about to expire |
| Hours credited to you for a month or quarter | An administrator, or Priv Life Time | To work out good standing where the organization counts hours |
| Charges and payments, if the organization collects dues | An administrator, or a card payment you made | To know what is owed and what was paid |
| Announcements sent to you, and whether they were delivered | The organization | So the organization can see what it sent |
| An activity log of changes to your record, with what they were before | Administrators and the system | So changes to a person's record can be audited |

### 5C.2 What an organization never learns about you

An organization sees what it entered about you and what you chose to share with it. It does not see:

- the other organizations you belong to, on Priv Life or anywhere else
- which other Priv Life apps you use
- your other email addresses
- when you last signed in, or how often
- anything about your Priv Life subscription

When your account links to an organization's record of you — because an administrator listed an email address you have verified — we copy nothing from your account into their record. Your name there stays the name they typed. You are shown what they hold before anything else.

### 5C.3 Who inside the organization sees what

Every field, including the built-in ones, has a visibility: administrators only, your own committees, all members, or nobody but you and the organization's owners. **The default for every field is administrators only.** A member directory exists only if the organization turns one on, and a detail appears in it only when the organization has opened that field to members *and* you have chosen to show it. Both, never either.

Some fields are marked sensitive — dates of birth, addresses, certification numbers. Those can never be shown above administrators, whatever else is configured, and every time somebody reads one it is recorded. You can see that record on your own page.

### 5C.4 What we never do in Members

- No open or click tracking on anything an organization sends. No pixels, no rewritten links. Nobody, including us, can tell an organization who read its email.
- No "last active", no engagement scores, no member health scores, no churn predictions. The activity log holds facts — joined, paid, renewed, held office — and never behavior.
- No advertising, no profiling, and no selling or sharing any of it.

### 5C.5 Announcements and notices

An organization's announcements can be turned off, per organization, with one click from the footer of any of them and without signing in.

Notices about your own membership are different: dues receipts and reminders, certification expiry reminders, and decisions on a request to join. These are the organization doing business with you rather than talking at you, and turning off announcements does not stop them. An organization can switch the whole category off for everyone; an individual cannot decline to be told that their certification expired.

### 5C.6 Leaving an organization

"Leave" unlinks your Priv Life account from the organization's record, ends your membership and any committee seats with that day's date, withdraws every directory choice, and stops your membership card working. It happens immediately.

By default the organization keeps its historical record of you — that you were a member, when, and any office you held — because it may need that for its own books and for elections it has already run.

You can also ask for your information to be deleted. **That request is honored by the system rather than left to the organization to action.** Your contact details, custom field values, certifications, hours and directory entries are removed, and the organization's owners are told it happened. Payment records survive with the amount, date and method, because the organization's books have to balance — but your name comes off them.

### 5C.7 Membership cards

If your organization issues digital membership cards, yours carries a code that anyone can scan without signing in. The page it opens shows four things: the organization, your name as the organization records it, your membership type, and whether your membership is active and in good standing at that moment. Nothing else — no contact details, no photograph, no other organization, nothing about your account. The code is yours to reset at any time, which is what to do if you lose the device it was on.

## 5D. Priv Life Sports (formerly Teams)

Sports runs an organization's teams and leagues: rosters, seasons and divisions, practices and games, availability, scores and standings, registration, waivers, and the league's own player records described in 5D.5. Roster and schedule records follow the Members rules in section 5C — they are the organization's records, held the same way, shown the same way. The app was called Teams until October 2026; only the name changed.

Sports is the one place Priv Life touches information about children, so this section is mostly about that.

### 5D.1 Dependents

Children do not have Priv Life accounts, sign-ins, or contact details. Section 12 has always said Priv Life is not for anyone under 18, and Sports does not change that. A child exists in Sports only as a **dependent**: a profile inside one organization, managed by a guardian, holding the minimum a league needs.

A dependent profile holds: name, birth date (leagues group by age; we treat it as sensitive — administrators only, and every read of it is recorded), which teams they are on and when, attendance and availability, waivers signed for them, and who their guardians are. That is the whole list. No email address, no phone number, no home address, no photograph, no account — the system refuses those fields on a dependent, rather than merely leaving them blank.

A dependent is never discoverable: not in any member directory, no membership card, not included in announcement mailings. A guardian is the contact for everything.

### 5D.2 Guardians and consent

Every dependent profile is linked to at least one guardian, who is a member of the same organization. Creating a dependent profile requires recording the guardian's consent at that moment — who consented, when, and the exact text they agreed to. The guardian signs waivers for the dependent, answers availability for them, and sees everything the organization holds about them.

If a guardian asks for a dependent's information to be deleted, the same rule as section 5C.6 applies: the request is honored by the system rather than left to the organization to action.

### 5D.3 Registration

An organization can share a public registration link. The page shows the organization's name, the form, and the waiver — and collects only what the form asks: the applicant's name, birth date for a minor, and the guardian's name and contact details. Nothing from a registration enters the roster until an organization administrator approves it, and a declined registration is deleted. Registering does not create a Priv Life account, and the page sets no cookies beyond what serving it requires.

### 5D.4 Scores, standings, and team pages

Game scores and standings are team facts, not personal ones. Sports records that a team played and how the game ended; it does not collect per-game statistics about any person.

A league can turn on a public page for each of its teams, and one for the league itself. By default those pages show team facts only: names and colors, league and division, schedule, results, standings — no roster, no player's name, nothing about any person.

A league can additionally choose to list team rosters on its public team pages, in one of three formats: first name and last initial, full name, or full name with email address. Two rules hold whatever the league picks: a child appears at most as a first name and a last initial, and a child's contact details never appear — a dependent profile has none to show (5D.1). Turning the roster off removes it immediately. The default is and remains off.

### 5D.5 League player records

A league can keep a player record for each person in it: the positions they play and, if the league uses one, a skill rating on the league's own scale, with a note. These exist for one purpose — drafting balanced teams — and they are the league administrators' judgment, not a measurement: Sports does not compute them, track performance, or feed game results into them.

Who sees them: league administrators only. A rating or note is never shown to other members, never on any public page, and never leaves the organization. What the organization holds about you — including these records — is in your own export, and if you leave with erasure (section 5C.6), your league player records are deleted with the rest. For a dependent, the record is part of the dependent profile: the guardian sees it on request like everything else held about their child, and the 5D.1 rules apply unchanged.


## 5E. Priv Life Home

Home is a personal app, like Budget and Residency Tracker: your records, behind your sign-in, shared with nobody. It keeps the memory of the things you maintain — the house, the cars, the equipment.

### 5E.1 What Home stores

| Data | Where it comes from | Why it is kept |
| --- | --- | --- |
| The things you add: a kind (home, vehicle, equipment), a name you chose, your notes, and whether you have retired it | You | So records have something to hang on |
| Maintenance schedules: task names and how often | You | So the app can tell you when work is due |
| Service entries: the date, who did the work as you typed it, what it cost, your note | You | The service history — the paper trail when something breaks or gets sold |
| Warranties: what is covered, by whom, until when, your note | You | So coverage is findable before it lapses |

The "who did the work" field is free text you typed — a company name, "me", whatever you wrote. It is your private record of your own affairs; we do not verify it, link it to anyone, or treat it as anything but your note.

### 5E.2 Who can see it

You. Home has no sharing, no organizations, and no directory. Nobody else on Priv Life can see that an asset, a schedule, a service entry or a warranty exists.

### 5E.3 Reminders

The Due page in the app is the reminder: it is computed from your own schedule every time you open it. Home sends no email and no notifications, because no email provider is connected for personal apps — and this policy will say so until that is wrong. If reminders by email are added, they will be opt-in and this section will change first.

### 5E.4 Leaving

Export downloads your service history as a CSV file. "Delete my Home data" removes every Home record immediately — assets, schedules, history, warranties — and deleting your Priv Life account does the same. Nothing is retained.

## 5F. Priv Life CRM

CRM is an organization app: a business or organization on Priv Life keeps records of the outside parties it works with — customers, clients, prospects, vendors. If your details are in an organization's CRM, that record is the organization's, not ours and not Priv Life's to use; we host it, encrypted, and do nothing else with it.

### 5F.1 What an organization's CRM holds

Contacts (name, email, phone, job title, address, notes, custom details the organization defines), companies, opportunities (a deal's title, value, stage and outcome), notes its staff write, and reminders staff set for themselves. Every change is attributed and time-stamped in the organization's own activity log.

### 5F.2 Who can see it

Only people the organization has granted CRM access — by default its owners, administrators and managers, never its whole membership or staff list. Reminders are personal to the person who set them; nobody browses another person's reminder list. Different organizations on Priv Life can never see each other's customer records.

### 5F.3 What we never do with CRM data

We do not read, mine, sell or cross-reference customer records; we do not build profiles from them; we do not use one organization's customer list to inform anything shown to another. Aggregate operational counts (how many requests the service handled) are the only thing we measure, and they contain no customer data.

### 5F.4 If you are in someone's CRM

The organization is responsible for the records it keeps about you, the way it would be for its own address book or spreadsheet. Questions or removal requests about such a record go to that organization; when it deletes the record, or deletes itself, the data is gone from our systems (organization deletion runs after a fourteen-day hold). If an organization exports its data, its CRM records are included — they are its records.

## 5G. Priv Life Schedule

Schedule is an organization app: a business or organization takes appointment bookings, on a public page that requires no account. Booking creates or updates a customer record in that organization's CRM, so section 5F's stance applies to everything a booking stores: the record is the organization's, we host it encrypted, and we do nothing else with it.

### 5G.1 What a booking stores

What you typed on the booking page: your name, email, phone if you gave one, and your answers to the organization's own intake questions — plus the appointment itself (what, when, with whom, its price and status). Staff availability and appointment histories are the organization's operational records.

### 5G.2 Who can see it

The staff member you booked with and the people the organization has given schedule or CRM access. Your booking is never visible to the organization's general membership, to other organizations, or to other customers.

### 5G.3 Emails, cancel links, and calendar feeds

Your confirmation and any reminder go to the email you gave, from the organization, only about your appointment — there is nothing to subscribe to and nothing to unsubscribe from, and if the organization has no email provider connected the booking page says so and gives you your links on screen instead. Your cancel link works without any sign-in; anyone holding it can see and cancel that one appointment, so treat it like a ticket. Staff calendar feed URLs are private capability links that show that staff member's appointments to whoever holds them; they can be rotated in the app at any time.

### 5G.4 Canceling and leaving

Cancel from your link until the organization's cutoff; after that, contact them directly. A canceled appointment stays in the organization's records as canceled — that history is theirs, like a paper appointment book. Questions or removal requests about your customer record go to the organization (section 5F.4).

## 5H. Priv Life Projects

Projects is an organization app: projects, tasks, checklists, comments and attached files are the organization's operational records. They are visible to the organization's members (the board is shared on purpose), never visible outside the organization, and never read, mined or profiled by us. A project may link to a customer record in the organization's own CRM, in which case section 5F's stance applies to that record. Attached files ride the document storage described elsewhere in this policy: private to the organization, downloadable by its members, deleted when the task, project owner or organization deletes them. Organization export includes projects and tasks; organization deletion purges them.

A project may also carry a **plan** and **estimates**: the work broken into phases and tasks, the job roles that do it and for how long, materials, and the priced versions cut from all that. These are the organization's commercial records. Their shape — what the work is, who does it, how many hours — is visible to the organization's members like the board. The money is narrower: prices to the people who estimate, and costs, margins and what a subcontractor charges only to those the organization has granted that, because a cost rate is derived from what people are paid. An approved estimate version is never rewritten, only superseded by a later one, and the superseded version stays readable — that is deliberate, so a number the organization once stood behind can still be accounted for. A proposal sent to a customer is an estimate document under section 5K. We never read, mine or profile any of it, and our own analytics never see a project, a client, an amount or an hour. Organization export includes plans, seats, estimate versions and their lines; organization deletion purges them.

A plan that is sold becomes a **contract**, and scope that moves afterwards becomes a **change order**. Both are the organization’s commercial records, held and exported like the estimate they came from.

**If you are signing one.** The link a business sends you works without any sign-in and shows that one document — the contract or the change order it names, and nothing else about the business, the project or anyone else’s work. Anyone holding the link can read that document, so treat it like the contract itself. Signing means typing your name: we deliberately do not accept a one-click link, because a mail scanner following links in your inbox must never be able to sign anything in your name. When you sign, we record **the name you typed, the time, and the IP address the signature came from**, because that is what a signature is, and we keep them as the business’s record of the agreement. That address is used for nothing else — not analytics, not location, not profiling, not linked to any other activity — and it appears nowhere in the app except the business’s own export of its own records. Accepting a change order moves what the business says you have agreed to; declining one records that you declined, and both answers stay on the record rather than being overwritten. Questions about a contract go to the business that sent it.

## 5I. Priv Life Time (business time tracking)

Time is an organization app for tracking work hours (it is not the shift-scheduling app, Shifts, which section 5B covers). A time entry is what the person wrote down: a date, minutes, optionally a project and a note, and whether it is billable. Entries are visible to the person who logged them and to the organization's managers — never outside the organization, and never read or mined by us. There is no activity monitoring behind it: no screenshots, no idle tracking, no location. Hourly rates are compensation-adjacent, so they are visible only to managers and to the person themself. Timesheet approvals and returns are recorded in the organization's activity log with who decided and when; nobody, managers included, edits an approved week without returning it first, on the record. Organization export includes time entries; organization deletion purges them.

## 5J. Priv Life Events

Events is an organization app for public events with registration. Registering stores what you typed — your name, email, party size, and answers to the host's own questions — and creates a customer record the host organization controls (section 5F's stance applies). Your registration is visible to the event's organizers and never to other attendees; there is no public attendee list. Your confirmation and one reminder go to the email you gave, about your registration only — there is nothing to subscribe to. The cancel link in your confirmation works without any sign-in and frees your seats; anyone holding it can see and cancel that one registration, so treat it like a ticket. Check-in at the door records that you arrived, in the organization's own records. Questions or removal requests about a registration go to the host organization; organization export includes registrations, and organization deletion purges them.

## 5K. Priv Life Invoice

Invoice is an organization app for estimates, invoices, payments and expenses. An invoice holds what the business wrote on it — the customer (a record in the business's own CRM, so section 5F's stance applies), line items, dates, notes — and the payments recorded against it. Invoices, payments and expenses are visible only to people the business has given Invoice access; they are never member-wide, never visible outside the business, and never read, mined or profiled by us.

**If you are paying an invoice.** The pay link a business sends you works without any sign-in and shows that one document; anyone holding the link can view it, so treat it like the invoice itself. Paying by card hands you to Stripe Checkout, run by Stripe on the business's own Stripe account. Priv Life never sees, receives or stores your card number: Stripe tells us only that the invoice was paid, how much, and a reference so the payment is recorded once. Stripe's handling of your card is governed by Stripe's privacy policy. If an invoice is overdue, the business's customer email receives one reminder about that invoice — nothing to subscribe to.

**Money flow.** Priv Life does not hold, route or take a fee from payments. They are direct charges on the business's own Stripe account, which pays Stripe's processing fees and receives the payout. Refunds and disputes are between you, the business and Stripe; within Priv Life, corrections appear as credit lines and reversing entries, never by deleting what was recorded.

Receipts and attachments ride the document storage described elsewhere in this policy, visible only to people with Invoice access. Organization export includes invoices, line items, payments and expenses; organization deletion purges them.

## 5L. Priv Life Employees

Employees is an organization app that holds a business's employment records: who works there (employees and 1099 contractors), job roles, start and end dates, compensation history, onboarding checklists, emergency contacts, and — at termination — the retention dates employment law attaches to those records.

### 5L.1 The record belongs to the employer; you can always see yours

An employment record is the business's record of its own relationship with you, like a personnel file in a drawer. If you link a Priv Life account (by the verified email your employer put on the roster), you can always read your own file — your role, your own compensation history, your onboarding status — and keep your own emergency contacts current. You cannot see anyone else's compensation, and nobody outside the people your employer gave employee-management access can see yours.

### 5L.2 No surveillance

Employees contains no location tracking, no geofenced or photo-verified clock-ins, no screenshots, no idle or keystroke monitoring, and no analysis of how anyone works. We do not build these features. The app records what the employer enters and what you enter about yourself.

### 5L.3 Compensation stays narrow

Salaries and rates are visible to the people the business has given employee-management access, and to each person about themselves. Where other parts of Priv Life price work (estimates, rate cards), they see derived billing rates — never anyone's pay.

### 5L.4 Leaving, and what remains

When employment ends, the record is frozen, not erased: employers are legally required to retain parts of it (for example, I-9 forms and pay records carry federal retention periods, which the app marks on the file). Leaving the organization on Priv Life does not delete an employment record, because it is the employer's legal record of work actually performed. Organization deletion purges employment records with everything else, and organization export includes them.

### 5L.5 What we never learn

We never read, mine, sell or profile employment data. Our operational metrics count organizations and employees in aggregate — never names, pay, hours or anything about an identifiable person.

## 5M. Priv Life People

People is a personal app, like Budget, Home and Residency Tracker: your records, behind your sign-in, shared with nobody. It keeps what you want to remember about the people in your life — how you met, what they are going through, whose birthday is next, and when you last spoke.

### 5M.1 What People stores

| Data | Where it comes from | Why it is kept |
| --- | --- | --- |
| The people you add: the name you call them, how they relate to you, your tags, email addresses and phone numbers you typed, how you met, roughly where they are | You | So there is somebody for the rest to hang on |
| Notes: what you wrote, and the date it happened on | You | The point of the app — the detail you will want next time |
| Dates: birthdays and anniversaries, with or without a year | You | So the app can tell you one is coming |
| Reminders: a title, a due date, how often it repeats, and the date you last marked it done | You | So keeping in touch is a rhythm rather than a guilt |

### 5M.2 These are notes about other people

Everything in People is your own private record of your own relationships, typed by you. It is worth being exact about what that means:

- We never contact anybody you add. They receive no email, no invitation and no notification, and they are never told they are in your list.
- A person in your list is not a Priv Life account and is never matched to one. If somebody you added happens to use Priv Life, nothing connects the two records — not an email address, not a name.
- Your notes are never shown to any organization you belong to, and never to the other Priv Life apps. People does not read your Members roster, your CRM contacts or your Budget records, and none of them can read this.
- Nothing you write is used to suggest people, build a graph, or train anything.

Because these are your notes about identifiable people, treat them the way you would a private journal: write what you need, and remember that whoever can unlock your account can read them.

### 5M.3 Voice notes and AI

Both are off. Notes are typed. Dictated notes are planned through a third-party transcription service, and nothing will be sent to it until you switch that on yourself — at which point this policy will name the processor, in section 7, before the feature ships. No model reads your notes today, and none is used to summarize or recall them.

### 5M.4 Reminders

The waiting list in the app is the reminder: it is computed from your own dates and reminders every time you open it, which is why an upcoming birthday appears the moment you add it. People sends no email and no notifications, because no email provider is connected for personal apps — and this policy will say so until that is wrong. If reminders by email are added, they will be opt-in and this section will change first.

### 5M.5 Leaving

Export downloads everything: one JSON file with each person, their notes, their dates and their reminders nested inside, or CSV files for a spreadsheet. "Delete everything in People" removes every record in the app immediately — people, notes, dates and reminders — and deleting your Priv Life account does the same. Nothing is retained, and nothing was ever shared with anybody to ask back.

## 6. What we never do


- We do not sell your data, rent it, or trade it.
- We do not use your data for advertising, and we show no ads.
- We do not mine your data to build profiles, train models, or infer things about you.
- We do not share your data with anyone you did not choose, other than the service providers below who are needed to run the apps.
- We do not read your data except to fix a problem you have reported or to keep the service running, and then only as much as the problem requires.

## 7. Service providers

The following providers process data on our behalf. Each is used only for the purpose listed.

| Provider | What it does | What it sees |
| --- | --- | --- |
| Plaid Inc. | Connects to your bank and delivers transactions | Your bank credentials (entered directly with Plaid), account and transaction data |
| Clerk Inc. | Sign-in and session management | Your email, name, sign-in method, and session records |
| Google Cloud (Cloud Run, Cloud SQL, Secret Manager, Cloud Logging) | Runs our servers and database in the United States | Everything the apps store, encrypted at rest by Google |
| Firebase Hosting (Google) | Serves the web pages | Your IP address and request logs in the ordinary course of serving pages |
| GitHub | Hosts our source code | No user data. Code only |
| Fontshare (Indian Type Foundry) | Serves the Satoshi typeface | Your IP address and browser details when the font loads |

We have no other processors today. Two are named here in advance because they are part of how Members is meant to work and this table should not be the last thing to change when they arrive:

| Provider | What it will do | What it will see | Status |
| --- | --- | --- | --- |
| An email provider (Resend or Amazon SES) | Deliver an organization's announcements and the notices about your own membership | The recipient address and the message itself | **Not connected yet.** Until it is, Members records what an organization sent and delivers nothing |
| Stripe Inc. | Card payment of invoices (and later dues and tickets), as direct charges on the organization's own Stripe account | The payer, the amount, and card details entered directly with Stripe Checkout | **Test mode (September 2026); live once Stripe activates the platform.** Priv Life never holds the funds and never sees a card number |

Neither is in use, and this policy will say so until it is wrong. Whichever email provider is chosen, it will be used to deliver messages and for nothing else: no open tracking, no click tracking, no pixels, and no rewritten links. We do not use third-party analytics, tracking pixels, session recording, cross-site tracking, behavior profiles, or advertising scripts.

We do count aggregate usage from our own servers: how many requests each app served and how many failed, by route and day, and how many accounts were active in the last day, week and month. To produce the active-account count, each app records the hour your account was last used. These counts contain no user ids and no per-person history, they are stored in our own database, and they are only ever read as totals by the operator.

## 8. Where data lives

Our servers and database run in Google Cloud's us-central1 region in the United States. If you use Priv Life from outside the United States, your data is transferred to and stored there.

## 9. How long we keep data, and how to delete it

**Budget, disconnecting a bank.** When you remove a bank you choose one of two things. "Disconnect, keep history" destroys the stored Plaid token, tells Plaid to forget the connection, and keeps the imported transactions so your categories and notes on them survive. "Delete everything" does the same and also deletes the bank's accounts and every transaction imported from it.

**Budget, manual data.** Transactions you entered or imported, manual accounts, assets, categories, budgets and the retirement plan can be deleted individually in the app.

**Vote.** Organization admins can delete elections, including open and closed ones, and can remove members and roster entries. Ballots belong to the election and go with it.

**Residency Tracker.** Your day records and check-ins stay until you delete them. You can clear individual days on the calendar, remove every stored coordinate, or delete all of your Residency Tracker data from Settings; deletion is immediate. You can export any year as a CSV file first. Keep your own copy for as long as a tax authority might ask: we do not keep deleted records for you.

**Deleting your account.** Email support@priv-life.com from the address on your account. We delete your Clerk account and every record tied to your user id in the personal apps — Budget and Residency Tracker — within 30 days, and confirm when it is done.

**Deleting your account, and organizations.** Records an organization keeps about you in Vote, Time or Members are that organization's records, not yours, and deleting your account does not delete them. What it does do, in every organization, is unlink your account from their record of you, end your current memberships and committee seats, and withdraw every directory choice. Each organization then keeps or deletes its own record under its own obligations. You can go further in Members before you delete your account: "Leave" on your own page offers to have your information deleted from that organization, and that request is honored by the system rather than left to the organization to action. In Vote, the record that you voted in a past election has your user id removed from it rather than being deleted: what is left is a row saying one unnamed person voted, which names nobody and cannot be connected back to you. We keep the row because a closed election's turnout was counted from it, and deleting it would make a certified result disagree with a later reading of the same election. The anonymous ballot stays for the same reason, and because it was never linked to you in the first place.

**Backups.** Our database is backed up automatically by Google Cloud SQL. Backups are retained for 7 days and then expire, so deleted data leaves backups within that window.

**Logs.** Server logs record request paths, status codes, timings, and error messages. They do not record transaction contents, balances, or tokens. Logs are retained for 30 days.

## 10. Security

- Bank credentials never reach us. Plaid tokens are encrypted at rest with AES-256-GCM using a key held in Google Secret Manager, separate from the database.
- All traffic uses HTTPS. Our servers are reached only through Firebase Hosting and Cloud Run, both of which enforce TLS.
- Every API request must carry a valid Clerk session, and every database query is scoped to the signed-in user's id. Identity is never taken from the request body.
- Plaid's notifications to our server are verified by signature before they are acted on.
- Secrets live in Google Secret Manager, not in code or in deployment settings. Our source repository is configured to refuse secret files.
- Google encrypts the database and its backups at rest.
- Administrative consoles (Google Cloud, Clerk, Plaid, GitHub, Firebase) are protected with multi-factor authentication.

No system is perfectly secure. If we learn of a breach affecting your data we will tell you by email within 72 hours of confirming it, say what was affected, and say what we are doing about it.

## 11. Your rights

You can, at any time:

- **See** everything the apps hold about you, by using the apps, or by asking us for a copy.
- **Export** your Budget transactions with the Export CSV button, and ask us for an export of anything else.
- **Correct** anything you entered, in the app.
- **Delete** individual records in the app, or your whole account by email.
- **Revoke** a bank connection in the app or through Plaid Portal.

We honor these rights for everyone, wherever you live. If you are in a jurisdiction with specific privacy laws, such as California, the European Union or the United Kingdom, those rights apply too and you can exercise them the same way. We do not discriminate against anyone for exercising them.

## 12. Children

Priv Life is not for anyone under 18. Nobody under 18 can hold an account, and we do not knowingly collect data from children through one. If you believe a child has created an account, email us and we will delete it.

The one place a child's information can appear is as a dependent profile in Priv Life Sports (formerly Teams) — created by their guardian, inside one organization, under the rules in section 5D: minimum data, no contact details, no account, never discoverable, consent recorded. This design keeps children out of every path where an account's obligations would apply, instead of layering child-specific handling onto accounts.


## 13. Cookies and local storage

We set only what sign-in, the apps, and our own counting need. The only cookies on Priv Life are the ones that sign you in. There are no advertising cookies, no analytics cookies, and no third-party cookies — nothing listed here is shared with anyone or readable by another site.

**Sign-in.** Clerk's session cookies, which are what keep you signed in.

**What you have chosen.** A small amount of browser storage for preferences, such as whether Budget's net worth figures are hidden.

**Our own counting.** We measure how the apps are used with our own servers and no third-party analytics (section 6). Making those counts honest rather than inflated needs a few small things kept in your browser's own storage, which — unlike a cookie — is never transmitted anywhere. Our pages read it and send us a count; it is not attached to requests and it does not appear in our server logs.

- a marker, lasting as long as the tab is open, so one visit counts once an hour instead of once per page you open;
- a yes-or-no flag recording that this browser has been here before, so a first visit can be told from a return. It is a single bit, not an identifier;
- markers lasting as long as the tab is open, recording that this tab has reached a step we count — a sign-up or sign-in screen shown, an account finished, Budget's two-step verification screen shown or completed, or an organization set something up — so each step counts once however many attempts it takes. They record that the step happened, not who took it;
- when you arrive through one of our own campaign links — an ad or a flyer with a `?c=` tag on the address — that tag and the date, kept for **30 days**. It is how we learn which of our own links brought somebody who later signed up, which is the only way a one-person company can tell whether its advertising works at all. If your browser blocks storage that outlasts the tab, the tag is kept for the tab instead: the same tag, for less time.
- a marker, lasting as long as the tab is open, recording that we have already counted a click on an advertising link, so one press of one ad counts once rather than once per Priv Life page it leads through;
- markers lasting as long as the tab is open, recording how far this tab got on one of our advertising landing pages — that the page was opened, that it was scrolled, that a button or an answer was opened, that it was left quickly — so each of those counts once per visit rather than once per scroll. They record that it happened on that page, not who did it, and there is no record of where on the page you were or how long you stayed beyond a single "still here after thirty seconds" marker.

The campaign entry holds the tag, the date it was stored, and — when the link that brought you carried one — the `utm_source` on that address, which names the site or service the link was shown on and nothing narrower. That is all of it: no identifier, no account, nothing about you, and no record of what you did. It is never sent to an advertiser or any other company — we have no arrangement with one that could receive it. It cannot be used to recognize you on another site, because no other site can read it, and it is not joined to your account or to anything else we hold. After 30 days it stops counting and is discarded.

What we learn from it stays a count. The campaign tag reaches our analytics only as "one sign-up, this app, this campaign, this day", alongside everybody else's, and the landing-page markers only as "this many visits to this page got this far". There is no row anywhere that says a particular person came from a particular ad, or that a particular person scrolled a page. Section 6 still holds in full.

Clearing your browser's site data removes all of this, and the apps work the same without it — the counts simply get less accurate. If you would rather not be counted this way at all, blocking site data for priv-life.com is enough, or write to us at support@priv-life.com.

## 14. Changes to this policy

When we change this policy we update the effective date at the top, and the note beside it says what changed and why. For a change that affects what we collect or share, we tell you before it takes effect — by email to the address on your account, in the app, or both.

## 15. Contact

PrivLife LLC
8625 SW 5th Pl Road, Ocala, FL 34481
support@priv-life.com