Introduction
This Privacy Policy explains how Off-Hours Owner (“Off-Hours Owner,” “we,” “us,” or “our”) collects, uses, and protects information when you use the Off-Hours Owner web app, including when you add it to your phone’s home screen (the “App”).
Off-Hours Owner is a free planner and logger for a side business you build after hours. It is designed to keep your data on your own device. An account is optional, and You never need an account to use any feature of the App.
By using the App, you agree to this policy and to our Terms of Use. If you do not agree, please do not use the App.
Information we collect
Information you enter on your device. Your businesses, time logs, money entries, weekly plans, free blocks, a running timer, settings, and (if you set one) a salted hash of your PIN are stored in this browser’s localStorage under the keys oho.v1 and oho.v1.preimport. The App does not use IndexedDB for your log. Unless you turn on cloud backup, this information stays on your device and is not sent to us.
Information you provide if you create an account. If you create an account, we collect your email address, a copy of your app data so we can back it up and sync it, and, if you choose a password, the password in hashed form (we never see or store it in plain text). You can also sign in with a one-time code or link sent to your email. If you choose Continue with Google, Google shares your name, email address, and profile picture with us; we use only your email address to identify your account, and we don’t receive your Google password or access to your Google data.
Information collected automatically. When you load the App, our web host receives ordinary request information that every website receives, such as your IP address, browser type, the files requested, and the time of the request. If you use an account, our database and sign-in provider also receives request information (such as your IP address) when the App talks to it, keeps sign-in records (such as when you last signed in), and stores sync details with your backup: a random device ID, the App version, and the time of each save.
What we don’t collect. The App has no analytics, no advertising, and no third-party fonts, scripts, cookies, or tracking pixels. All of the App’s code, including the sign-in code, is served from the App’s own site. We do not collect your location, contacts, photos, or payment information.
Optional free account and cloud backup
Once you sign in, the App automatically saves a copy of your app data to the cloud whenever it changes and when you open the App, so you can get it back on a new phone or after clearing your browser.
What is stored in the cloud: your email address, sign-in records, and your app data: businesses, time logs, money entries, plans, free blocks, a running timer, and App settings. Your PIN and PIN hash are never sent. The cloud also keeps up to 10 earlier copies of your app data so a bad sync can be undone.
On your device, signing in also stores a sign-in token in localStorage (key sb-hsvykrqpmhbijxytdvsc-auth-token) and sync details such as a random device ID and the time of the last sync (keys oho.v1.cloud and oho.v1.nudge). If both your device and the cloud changed, the App may keep the version it did not use under oho.v1.preconflict so you can undo.
The App may ask your browser to keep its storage from being cleared automatically. A service worker also caches the App’s own files on your device so it works offline. That cache is the App itself, not your entries.
How we use information
We use information only to: provide the App and its features; create and secure your account and send sign-in, account-confirmation, and password-reset emails; store, back up, sync, and restore your data at your request; keep the service working, secure, and free of abuse; respond to your questions and requests; and comply with the law.
We do not read your entries except when needed to run, secure, or fix the service, or when you ask us to help with your account. We do not use your data to build advertising profiles, and we do not use it to train AI models.
Where a law requires a legal basis for processing, we rely on providing the service you asked for (performing our agreement with you), our legitimate interest in keeping the App secure and working, your consent where you give it (for example, by turning on cloud backup), and compliance with legal obligations.
We do not sell or share your personal information
We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). We do not show ads and we do not use targeted advertising. We have not sold or shared personal information in the past 12 months.
We disclose information only to the service providers listed below so they can run the App for us, when you direct us to, or when required by law (for example, a valid subpoena or court order), to protect the rights, safety, or property of our users, us, or others, or as part of a business transfer such as a merger or the formation of a company to run the App, in which case this policy will continue to protect your information.
Service providers
We use a small number of service providers that process information on our behalf under their own privacy and security terms:
Supabase: database and sign-in (authentication) for the optional account and cloud backup. Your cloud data is stored in its United States (Ohio, us-east-2) region.
Resend: delivers the App’s account emails (sign-in codes and links, account confirmation, and password reset). It receives your email address and the message it delivers.
Google: if you choose Continue with Google, Google confirms who you are and shares your name, email address, and profile picture with us. Google’s own privacy policy applies to your Google account.
Netlify: hosts the App’s website and receives the ordinary request information described above.
Beehiiv: hosts the Off-Hours Owner newsletter and founding waitlist signup page. Beehiiv receives information only if you open that page and choose to sign up (see “Founding waitlist” below).
Founding waitlist
Paid plans are not on sale and the App charges nothing. If you tap “Join the founding waitlist” on the Plans screen, it opens the Off-Hours Owner newsletter signup page, hosted by Beehiiv, in a new tab. Anything you type there, such as your email address, goes to Beehiiv under its own privacy policy, not to the App. The waitlist is separate from the App’s optional account: the App never sends your entries or your account email to Beehiiv. You can unsubscribe from any newsletter email at any time.
Data retention
On your device: your data stays until you delete it in the App or clear this site’s data in your browser.
In the cloud: we keep your account and cloud data until you delete your account. Delete my account and cloud data removes your account, your email address, and every cloud copy, including the earlier copies, right away. Copies can remain in our providers’ own system backups and logs for a limited period until those are replaced in their normal cycle. Sign-in email records and hosting request logs are kept by our providers for limited periods under their own retention practices.
We may keep limited information longer if the law requires it or to resolve a dispute or enforce our terms.
Security
Cloud data is encrypted in transit (HTTPS/TLS) and encrypted at rest by Supabase. Access rules on the database (row-level security) let each signed-in account read and change only its own copy. You can sign in with a one-time code or link, a password (stored only as a salted hash by our sign-in provider), or Google. The App sends a strict content security policy so it loads code only from its own site.
The optional 4-digit PIN is a privacy screen for casual eyes. The App stores a salted hash of the PIN, not the PIN itself. The PIN does not encrypt your data: someone with access to your device, its backups, or the browser storage could still read your entries. The PIN stays on your device and is never part of a cloud copy or backup file. If you forget it, the only way back in is to delete the data on your device and restore a backup file or sign in to your cloud backup.
No method of storage or transmission is 100% secure, so we cannot guarantee absolute security. If we learn of a security breach that affects your personal information, we will notify you as required by law.
Your rights and choices
Use the App without an account. Everything works the same if you never sign in, and nothing you log leaves your device.
Access and export. You can export a JSON backup or a CSV of your log at any time in the App, and restore from a file. Importing a file first auto-saves your current data so you can undo.
Correct. You can edit or remove any entry, business, or setting in the App, and changes sync to your cloud copy.
Delete. To delete data on your device, use the App’s option to delete all data on this device; this clears your log and the pre-import copy and signs you out, but leaves your cloud copy until you delete your account. To delete your cloud data, go to More, then Account & cloud backup, then Delete my account and cloud data. Signing out stops the backup and leaves your data on your device. Without a cloud backup or a backup file, we cannot recover data after it has been deleted, and we cannot recover cloud data after you delete your account.
US state privacy rights. Depending on where you live, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with consumer privacy laws, you may have the right to know what personal information we hold about you, to access and get a copy of it, to correct it, to delete it, and to opt out of its sale, sharing, targeted advertising, or profiling. We do not sell or share personal information, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects.
How to make a request. Most requests can be completed yourself in the App. You can also email us at hello@offhoursowner.com with the subject line “Privacy request.” We may need to verify your identity, usually by confirming the request from the email address on your account. You may use an authorized agent where the law allows, and we may ask for proof of their authority. We will respond within 45 days, and if we need more time where the law allows (up to another 45 days), we will tell you why. If we deny your request, you may appeal by replying to our decision with the subject line “Privacy appeal,” and we will respond within the time the law requires.
We will not discriminate against you for exercising any of these rights.
Children’s privacy
The App is intended for adults 18 and over. We do not knowingly collect personal information from children under 13, consistent with the Children’s Online Privacy Protection Act (COPPA), or from anyone under 18. If we learn that we have collected personal information from a child, we will delete it. If you believe a child has given us information, please contact us at hello@offhoursowner.com.
International users
The App is operated from the United States, and cloud data is processed and stored in the United States. If you use the App from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those where you live.
Do Not Track and Global Privacy Control
Because the App does not track you across sites, does not sell or share personal information, and does not use targeted advertising, there is nothing for a Do Not Track or Global Privacy Control (GPC) signal to turn off. We treat a GPC signal as a valid request to opt out of sale and sharing, which matches what we already do for everyone.
A note on figures and your employer
Figures in the App come from what you log. They are not financial, tax, or legal advice, and they are not taxable profit or bookkeeping records. Check your employment agreement for side-work and IP rules before you build on the side, and use your own phone rather than a work phone, laptop, Wi-Fi/VPN, or a device your employer manages.
Changes to this policy
We may update this policy from time to time. When we do, we will post the updated policy on this page and change the “Last updated” date at the top. If we make a material change, we will also give notice in the App or by email to account holders before it takes effect. Your continued use of the App after an update takes effect means you accept the updated policy.
Contact
Off-Hours Owner. Email: hello@offhoursowner.com. For privacy requests, please use the subject line “Privacy request.”
Questions or feedback? Email hello@offhoursowner.com or message @OffHoursOwner on X.