Privacy Policy

Effective date: May 1, 2026  ·  Last updated: August 29, 2026

1. Who We Are

Covenant Works Operating System is a product of Covenant Works LLC, owned and operated by John Sydnor, Harlem, Georgia.

Contact for privacy questions: support@covenantworks.app

2. The Short Version — Your Data Architecture

This app uses an architecture designed to keep your business data yours:

• Your business data (jobs, customers, invoices, inventory, expenses) is stored in our Firebase infrastructure (Google Cloud) in a dedicated, per-business secured space. Firestore Security Rules ensure that only members of that business can read or write its records, according to their role (owner, admin, member, or viewer). Covenant Works LLC does not access your business data in the normal course of operating the Service. We keep automated daily backups of this data (retained up to 30 days) so we can restore it if something goes wrong; backups are deleted when you delete your account.
• Account data (email, subscription tier, aggregate usage statistics) is stored in our Firebase project to provide, manage, and improve the Service.
• Payment data is handled entirely by Stripe. We never see or store your card number.

3. What We Collect

Data	Purpose	Stored where
Email address	Account creation, login, billing notices	Our Firebase Authentication + Firestore
Subscription status and tier	Controlling which features you can access	Our Firebase Firestore (users collection)
Stripe customer ID	Linking your account to your subscription	Our Firebase Firestore (stripe collection)
Your business data	Running your business management tools	Our Firebase Firestore, isolated to your account — only you can read or write your own records
AI prompts and inputs	Generating AI responses via Claude API	Sent to Anthropic — see their privacy policy
Product search queries (Inventory Find)	Looking up live Google Shopping prices	Sent to SerpAPI — see their privacy policy
In-app feedback submissions	Improving the product during beta	Our Firebase Firestore (feedback collection)
Aggregate usage statistics	Understanding which features are used (tab visit counts, action counts, session frequency) — never linked to individual records	Our Firebase Firestore (user_meta collection)
Business-tier beta interest submissions (email, one-line business description, optional product opinion)	Reviewing applications to the Business-tier beta program. Submitted via the public form at /business/; an account is not required to submit.	Our Firebase Firestore (business_beta_interest collection) — retained 12 months, then deleted

4. What We Do Not Collect

• We do not collect payment card information (Stripe handles this)
• We do not read your business records, customer names, or financial data in the normal course of operating the Service (see Legal process below)
• We do not use cookies for advertising or cross-site tracking
• We do not sell, rent, or trade your data to third parties
• We do not build individual behavioral profiles — usage statistics are aggregate counts only (e.g., "this tab was visited 12 times," not what you did there)
• We do not operate a cross-business search of names, phone numbers, job notes, or other shop contents. We cannot look up “everyone who ever invoiced this person.”

5. Third-Party Services

The Service uses the following third-party providers. Each has its own privacy policy:

• Google Firebase — Authentication, hosting, database infrastructure. Google, as the infrastructure provider, may receive legal process directed at Google independently of us. Firebase Privacy
• Stripe — Payment processing and subscription management. Stripe Privacy
• Anthropic (Claude API) — AI-generated content (chat, listings, quotes). Inputs are sent to Anthropic to generate a response and, under Anthropic's commercial terms, are not used to train their models. Anthropic Privacy
• Recraft — vector design generation and image vectorization in Design Studio. Recraft Privacy
• SerpAPI — live Google Shopping results for Inventory price search. Your search words are sent to SerpAPI to retrieve current listings. SerpAPI Privacy
• Brevo (Sendinblue) — Transactional email delivery (welcome, billing, and security notices to your account email; invoice payment links you send to customers; design-proof response notices to you and, when the job has their email, a confirmation to the customer). Brevo Privacy

6. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Process subscription payments and communicate billing information
• Control access to features based on your subscription tier
• Respond to support requests
• Send service-related emails (billing, major updates, security notices)
• Improve the Service based on aggregated, anonymous usage patterns

We do not send marketing emails without your consent. You can opt out of any non-essential communications at any time.

7. Data Retention

Account data (email, subscription status) is retained for as long as your account is active. If you close your account, we delete your account data, your business data, and our backups of it within 30 days of your request.

You own your business data and can export a full copy at any time using the in-app Export feature. We recommend exporting a backup before closing your account, because deletion is permanent and cannot be undone.

Business-tier beta interest submissions are retained for up to 12 months, then deleted. To request earlier deletion of a submission you made via the /business/ landing page form, email support@covenantworks.app with the email address you used. No account is required.

8. Security

We use industry-standard security practices including Firebase Authentication, Firestore Security Rules that enforce per-business data isolation, and HTTPS for all data transmission. However, no system is perfectly secure. We encourage you to use a strong, unique password that you do not reuse on other sites, and to invite teammates with their own logins rather than sharing credentials.

9. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it promptly.

10. Your Rights

You have the right to:

• Access — Request a copy of the account data we hold about you
• Correction — Request correction of inaccurate data
• Deletion — Request deletion of your account and associated data
• Portability — Export your business data at any time via the in-app Export feature

To exercise any of these rights, email support@covenantworks.app. We will respond within 30 days.

11. Legal Process

We do not sell data, volunteer shop records, or run lookups across businesses. If we are legally compelled, we produce only what a valid instrument specifically names, and only if we actually store it.

Informal requests (email, phone, a lawyer’s letter that is not a court order) are refused. We will not search all businesses for a name, phone number, address, or keyword. We will not produce “all records,” “any and all data,” or “related accounts” without each account identified.

Valid process must be served on us (original or certified copy to support@covenantworks.app and our registered agent) and must include all of the following:

• The issuing court or statutory authority, case caption, case number, date, and signature
• The type of process (for example a criminal warrant, a court order, or a subscriber-information subpoena)
• The target account identified by login email and/or our internal user id and/or business id — a name and city alone is not enough
• A time window (start and end dates)
• The categories of records sought, not a blanket demand. We distinguish subscriber identity (email, account dates, which business the login belongs to) from business contents (jobs, customers, invoices, files, financial records). Contents require a warrant in a criminal matter or a court order in a civil matter — not a subpoena issued only by opposing counsel

We then produce only the named categories for the named account and dates. We notify the account owner unless a court or other lawful gag forbids it, or notice would create a documented risk of death or serious harm.

We do not hold payment card numbers. AI prompts are sent to Anthropic (and some design images to Recraft) to generate a response; we do not keep a chat archive in our database. Inventory search words go to SerpAPI. Those providers have their own legal-process channels. Stripe holds payment details we never see.

This section is our public standard. It does not let us ignore a valid warrant or court order for records we hold. It does mean overbroad or informal demands are rejected.

12. Changes to This Policy

We may update this policy as the Service evolves. We will notify you by email or in-app notice before material changes take effect. The date at the top of this page reflects the most recent update.

13. Contact

Privacy questions or requests: support@covenantworks.app
Covenant Works LLC · Harlem, Georgia

---

© 2026 Covenant Works LLC · Harlem, Georgia · Veteran-Owned Small Business

← Terms of Service    ← Back to app