Privacy, in plain language

• Your account: your name, email address, account type (personal or business), timezone, and a hashed version of your password. We never see or store the password itself.
• What you add: tasks and their history, streaks, bills, income and payouts, workouts and plans, alarms, notes, and preferences like theme or currency.
• Business accounts: your business profile, staff names and roles, staff PINs (hashed), services, paystubs, gift certificates, bills and business tasks.
• Check-in records (business accounts): when a business uses Check-in, the people who check in at its front desk give their name, phone number, email address, the month and day of their birthday, and a signature drawn on the tablet. We also keep their visits, the services they chose, their points, and which kinds of message they agreed to receive. This belongs to that business — po6tive stores it on their behalf, and the business decides what is sent and to whom. We do not sell it and we never use it for our own marketing.
• Security records: your active sign-ins, recent sign-in attempts, and a short log of security events such as sign-ins, password changes and two-step sign-in changes. These help us keep your account safe.

Only to run po6tive for you: showing your data on your devices, keeping you signed in, sending the emails you ask for, and protecting accounts from abuse. We don’t build advertising profiles, we don’t sell or rent your data, and we don’t use it for anything unrelated to the app.

po6tive runs on a small set of trusted providers. They process data only to provide their service to us.

• Turso hosts our database, where your account and everything you add is stored. Connections to it are encrypted in transit.
• Vercel hosts the po6tive app and the servers that run it.
• Resend delivers our emails.
• Cloudflare provides our domain and DNS.
• IDrive e2 stores custom alarm sounds, if you upload one.

To you, only account emails you trigger: confirming your email address, resetting your password, and PIN reset codes. We don’t send you marketing email.

Business accounts can send their own clients appointment reminders and offers through Check-in. Those are the business’s messages, written and sent by them — po6tive only delivers them, and only to clients who agreed at the kiosk. If you receive one and want it to stop, ask the business that sent it.

One essential cookie keeps you signed in, plus two tiny helper cookies that remember whether you chose “Keep me signed in”. Preferences such as your theme are saved on your device so the app looks right instantly. There are no advertising or tracking cookies.

• Passwords are hashed with bcrypt. PINs and one-time codes are hashed too.
• Email links expire on their own: 24 hours to confirm your email, 1 hour to reset a password, and each works once.
• You can turn on two-step sign-in with an authenticator app, and lock money and business owner tools behind a PIN.
• Sign-in attempts are rate limited, and an account pauses sign-in for a while after repeated wrong passwords.

• Edit or remove anything you’ve added, right in the app, whenever you like.
• Delete your whole account from Settings → Account → Delete account. It happens right away. If you can’t sign in, use po6tive.com/account/delete.
• Remove some of your data without closing your account at po6tive.com/account/manage.

We keep your data for as long as your account exists. When you delete your account, it’s removed from our live database immediately, security records included. Backups roll off within 90 days.

po6tive isn’t meant for children under 13, and we don’t knowingly collect their information.

If we change this policy in a meaningful way, we’ll update this page and the date at the top, and let you know in the app when it matters.

Email po6tive@gmail.com. A real person reads every message.