PRIVACY

Your records live on your own device. Signing in syncs them to your own account, and — if you ask for it — brings you a line before each of your watches. The app counts which features get used — never what your records say. Once you have agreed at the door, the Meta Pixel measures whether an advertisement brought you here — three named actions, never a record. Nothing is sold or rented, and nothing about your records ever reaches Meta.

If you write to us, your message and your address are kept so we can answer you.

An estate does not gossip.

Majordomo, at majordomocal.com, is operated by the operator of majordomocal.com — an individual based in Israel — who is the controller of every piece of data this page describes. Write to majorcal@majordomocal.com for anything on this page: to ask what is held about you, to get a copy of it, to have it deleted, or to withdraw a consent you gave.

The public pages at majordomocal.com — the landing page, the contact page and these documents — set no cookies of their own. Visits are counted in aggregate by Vercel Web Analytics, which sets no cookies and stores no personal data. The one form on them is the contact form, described under “Writing to us” below; nothing else on these pages asks you for anything.

The one third party that can learn of a visit is Meta, through the Meta Pixel described below — and only after you have accepted at the app’s door. Nothing from Meta loads before that, on the landing page included, so a visit that never reaches the door is never reported to Meta.

What you enter in the app — shifts, workouts, study, projects, money — is stored locally in your browser, on your own device. If you never sign in, none of it ever reaches us. The one-file export in Settings is yours to keep wherever you choose.

Signing in is optional; it exists so your devices can share one estate. There are two doors, and you choose: Google, or a one-time code sent to an email address you type. Either way we hold your email address — and, where you used Google, the account identifier Google gives us — together with your synced records, stored with our database provider (Supabase).

We send you two kinds of email and no others. The sign-in code, when you have just asked for one. And, only if you turn it on, a short line before each of your watches — the hour it begins and a link back into the app, drawn from the shifts already on your own calendar and worked out on your own device. No newsletter, no announcements, nothing you did not ask for.

The line before a watch is switched on by asking for it where we ask for your address, and off again in Settings under GUIDANCE, or by the unsubscribe link at the foot of every one of those letters. Switching it off stops what is already queued as well as what comes next. If any of this changes, this page will say so first, and the app will show you its door again.

Sync carries your records and a few display preferences; it does not carry this device’s consent or analytics settings.

After you agree at the door, the app sends anonymous usage counts to PostHog, hosted in the European Union: named events such as “a workout was logged” or “the Ledger was opened”, with a random device identifier, a session identifier, the time and, when an advertisement brought you here, the campaign label on that link — a name for the advertisement, never anything about you. Never the contents — no amounts, no titles, no notes, no body stats, no health numbers, no record text of any kind.

The identifier and any unsent counts live in your browser’s storage and are created only after you agree. If you sign in, the random identifier is linked to your account identifier so your own devices count as one person; your email address is not sent. You can switch analytics off at any time in Settings, under THE FINE PRINT — the “Share usage counts” switch, which also stops the Meta Pixel — and the app honors your browser’s Global Privacy Control signal automatically.

These counts exist to show which parts of the app are used and kept. They are not shared, sold, or joined to anything else.

Majordomo advertises on Instagram and Facebook. To learn whether those advertisements work, the site uses the Meta Pixel, a measurement tool operated by Meta Platforms, Inc. (Meta Platforms Ireland Limited for people in the European Economic Area, the United Kingdom and Switzerland). Its purpose is advertising measurement and attribution — telling Meta that a person who was shown an advertisement went on to arrive here, press GET STARTED, or finish the first-time setup — and nothing else.

It loads only after you press AGREE & ENTER at the app’s door, and never before. Until you have accepted, no Meta script runs and no Meta cookie is set — on the landing page as much as in the app.

Once it is running, the pixel reports three named actions — arriving on the landing page, pressing GET STARTED, and finishing the first-time setup — together with what any web request carries: your IP address, your browser and device details, the page address and the site you came from. It stores a random identifier in a cookie on this site so that it can recognise the same browser again. If you use Facebook or Instagram, Meta can connect those reports to your account there and combine them with what it already knows about you. We never send Meta your name, email address, phone number, or account identifier, and Meta’s “automatic advanced matching” is switched off.

Those reports go to Meta’s servers in the United States. That is a transfer of your data out of Israel and out of the European Economic Area, and by accepting at the door you consent to it. What Meta does with the data from there, and for how long, is governed by Meta’s own privacy policy.

Your browser’s Global Privacy Control signal is honoured and suppresses the pixel outright: with the signal raised, it does not load at all, whatever you accepted at the door.

Refusing changes nothing in the app except this measurement. No feature is withheld, nothing else changes, and you are not asked again. You can withdraw at any time in Settings, under THE FINE PRINT: turning off “Share usage counts” stops the Meta Pixel and the usage counts together, from that moment on. What Meta was sent before that stays with Meta, under its policy.

The contact page at majordomocal.com/contact, and the same form inside the app under Settings, send us a message. We keep what you write, the address you gave, the subject you chose, and the time — so that we can answer you and so that a later exchange about the same matter makes sense. You are given a short reference. If you send it from inside the app while signed in, a copy of the receipt goes to your account’s address; an address typed into a form is written to only when we answer you.

If you send it from inside the app while signed in, the address used is your account’s own rather than one typed into a box, and you may choose to enclose facts about your device and the version you are running — your browser, screen size, time zone, which preset and wings are in use, whether you are signed in and synced, how much space your records occupy and how many of each kind there are. That list is shown to you before you send, and it never includes anything a record says.

Each message is read once by an automated assistant provided by Anthropic (United States), which classifies it — how urgent it is, whether it needs a person — and drafts a reply for us to edit. Anthropic does not use it to train models and deletes it within thirty days. Replies and receipts are delivered by Resend (United States). Nobody else sees it.

None of this is required of you. The mailbox below reaches the same person, and a message sent to it is treated exactly the same way — including a request to have your records deleted, which is honoured whichever route it arrives by.

Supabase holds accounts and synced records, and sends the sign-in code when you use the email door. PostHog (EU) holds the usage counts. Meta Platforms (United States) receives the advertising measurements described above. Anthropic (United States) sorts messages sent to us, and Resend (United States) delivers our outgoing email — the answers to what you write, and the line before a watch if you have asked for one. Vercel hosts the app and takes the aggregate page counts. Google provides the other sign-in door.

No market data is fetched by anyone. The app does not price the investments you record — you enter what you hold and what you paid, and nothing goes to a stock-market data provider on your behalf or from your device. The provider named in the previous version of this policy is gone, and no other has replaced it.

Exchange rates are the one exception, and only when you change the currency your ledger is kept in: your device asks Frankfurter for that one pair of currencies, and is told nothing else about you.

Local records stay until you delete them, or your browser does. Synced records stay until you ask: write to majorcal@majordomocal.com from the address you signed in with, and whatever the sync holds is deleted — without argument and without a retention offer. Any letters still queued for you go with it. Usage counts are pseudonymous and kept only while they are useful for understanding how the app is used.

Messages you send us are kept while the matter is open, and for a while after it closes so that a follow-up can be understood. Ask and yours are deleted, along with the address you sent them from: write to majorcal@majordomocal.com, or use the contact page.

What the Meta Pixel reported is held by Meta, not by us, under Meta’s own retention rules. Meta’s privacy policy explains how to review and clear it — “your activity off Meta technologies”, in your Facebook or Instagram settings.

No selling or renting of data. No advertisements inside the app. No advertising tool anywhere on the site beyond the single Meta Pixel described above, and none of it ever sees your records. No profiling of you by us, for anyone’s benefit. The app asks for no device permission it does not need.

Majordomo is not for children under 16, and we do not knowingly hold their data. If you believe someone under 16 is using it, write to majorcal@majordomocal.com.

If this policy changes materially, the app shows its door again and asks you to re-accept before continuing; this page always carries the current version, with its date below.

This version, of 22 September 2026, RETIRES a third party rather than adding one. The app used to fetch share prices for the investments you record, through a market-data provider; it no longer prices them at all, so that provider is gone from this page and from the app. It also sends less in one place: the receipt for a message you write to us now goes only to the address of the account you sent it from, and never to an address typed into a form. Nothing new is asked of you, which is why you have not been asked to accept this page again. The version it amends, of 12 September 2026, is the one you agreed to, and the versions before it stay readable, word for word: 7 September 2026 at majordomocal.com/privacy/2026-09-07, 5 September 2026 at majordomocal.com/privacy/2026-09-05, and 31 August 2026 at majordomocal.com/privacy/2026-08-31.

Questions, requests, and anything this page did not answer: majorcal@majordomocal.com, or the form at majordomocal.com/contact.