What we collect

You can use the whole workspace without signing in. Everything you enter — components, costs, units, balances, scenarios — is stored in your own browser’s local storage unless you explicitly ask to generate a board packet or workbook.

The exceptions are the board packet and the spreadsheet. Generating either sends the plan to our server, because the software that renders them is far too large to run in a browser. It is used to build the file, handed back to you, and stored nowhere.

After signing in, choose Save to my account to store the plan on our servers, so it survives a change of computer and a change of treasurer. That explicit save is the point of an account: in a five-unit building the plan outliving its author is the difference between a reserve fund and a folder nobody can open.

Firebase Authentication verifies the emailed sign-in link, and Cloud Firestore stores account-backed plan and membership data. Everyone you invite to the association can see and edit its plan. Owners can also invite and remove people, rename the association, and manage billing. There is no password to lose, and the link works once and then expires.

No analytics or trackers are currently installed: no advertising pixels, session recording, fingerprinting, or embedded tools that follow you to other sites.

• Your email address, plus authentication and session metadata including timestamps and hashed tokens, to sign you in and send receipts.
• Membership roles and invitation addresses, so associations can share plans with the roles their owners select.
• Association plans, components, units, scenarios, and assumptions, when you explicitly save a plan to an account.
• Card details held by Stripe, our payment processor; we never see or store card numbers. We locally mirror customer and subscription identifiers and status.
• Bounded rate-limit records or identifiers derived from IP address, recipient email, or user ID for exports, sign-in, and invitation sends.

Self-service export provides complete plan-and-scenario JSON, plus component and current-forecast CSV, on every plan including the free one. It does not include account, authentication, membership, invitation, or billing metadata.

To delete a browser-stored plan, clear this site’s data in your browser. To delete an account-stored plan, an owner can delete the association after the live-subscription condition below is satisfied. That removes its plans, components, units, scenarios, and memberships. Deleting an association does not delete your user account, email, authentication, or session records. Membership removal only removes your access without touching the plan the rest of the board relies on. The last owner cannot leave until they make someone else an owner or delete the association.

One condition: an association with a live subscription cannot be deleted until the subscription is cancelled, because removing it would leave a card being charged with nothing left to cancel it from. Cancelling normally runs to the end of the term you have already paid for. Export stays available throughout, on every plan.

There is no self-service account deletion. Direct account-deletion requests can use the configured support channel described below.

The service is for association boards and is not directed at children.

For privacy or data questions, use the support channel provided by your Willowspan deployment. No public contact address is configured here. If we change anything material here, the change will be dated.