PRIVACY — 31 AUGUST 2026

Your records live on your own device. Signing in syncs them to your own account. The app counts which features get used — never what your records say. Nothing is sold, rented, or used to build an advertising profile of you.

An estate does not gossip.

The public pages at majordomocal.com — the landing page and these documents — collect nothing about you. No signup form, no analytics cookies, no advertising pixels, no third-party trackers. Visits are counted in aggregate by Vercel Web Analytics, which sets no cookies and stores no personal data.

What you enter in the app — shifts, workouts, study, projects, money — is stored locally in your browser, on your own device. If you never sign in, none of it ever reaches us. The one-file export in Settings is yours to keep wherever you choose.

Signing in with Google is optional; it exists so your devices can share one estate. If you sign in, we hold your email address and Google account identifier, and your synced records, stored with our database provider (Supabase). Sync carries your records and a few display preferences; it does not carry this device’s consent or analytics settings.

After you agree at the door, the app sends anonymous usage counts to PostHog, hosted in the European Union: named events such as “a workout was logged” or “the Ledger was opened”, with a random device identifier, a session identifier, and the time. Never the contents — no amounts, no titles, no notes, no body stats, no health numbers, no record text of any kind.

The identifier and any unsent counts live in your browser’s storage and are created only after you agree. If you sign in, the random identifier is linked to your account identifier so your own devices count as one person; your email address is not sent. You can switch analytics off at any time in Settings, under THE FINE PRINT, and the app honors your browser’s Global Privacy Control signal automatically.

These counts exist to show which parts of the app are used and kept. They are not shared, sold, or joined to anything else.

Supabase holds accounts and synced records. PostHog (EU) holds the usage counts. Vercel hosts the app and takes the aggregate page counts. Google provides sign-in.

Market prices and exchange rates (Twelve Data, Frankfurter) are fetched directly from your device — for Twelve Data, with your own API key — so those requests travel from you to them under their policies, and we never see them.

Local records stay until you delete them, or your browser does. Synced records stay until you ask: write to majorcal@majordomocal.com from the address you signed in with, and whatever the sync holds is deleted — without argument and without a retention offer. Usage counts are pseudonymous and kept only while they are useful for understanding how the app is used.

No advertising and no ad networks. No selling or renting of data. No cross-site tracking. No profiling for anyone else’s benefit. The app asks for no device permission it does not need.

Majordomo is not for children under 16, and we do not knowingly hold their data. If you believe someone under 16 is using it, write to majorcal@majordomocal.com.

If this policy changes materially, the app shows its door again and asks you to re-accept before continuing; this page always carries the current version.

Majordomo is operated by the operator of majordomocal.com, an individual based in Israel. You can always ask what is held about you, ask for a copy of it, or ask for its deletion: majorcal@majordomocal.com.