Privacy — staging pilot notice

Not a final customer-facing privacy policy. This prototype is only for controlled testing on a new Cloudflare project.

Accounts use an Account ID, salted password verifier, one-time recovery verifier, and temporary authenticated sessions in Cloudflare D1. Daily task content is AES-GCM encrypted in the browser, stored locally in IndexedDB, and synchronized as ciphertext through Cloudflare Worker to D1. Account-level encryption keys are wrapped by a server-held secret. The service operator can technically recover account keys, so this is not a zero-knowledge system.

Browser storage and Cloudflare may process technical metadata. No Google Drive or Google OAuth services are used. Device PIN protects the application screen only; it is not an independent encryption factor.

Retention, deletion policy, processors, operator contact details, lawful basis and production privacy compliance must be completed and legally reviewed before commercial use.

Contact and business site: SoftTruf.