Privacy policy
Hatcher HQ ("HQ") is a private web app for the Hatcher family and the businesses they own. It records what they own, what is due and who may see each part. It is run by Chace Hatcher ("we"). Only people we invite can sign in. This policy says what HQ collects, why, and what you can ask us to do.
What HQ collects
- Your sign-in. Your email address, name and role in HQ. Passwords and authenticator codes are handled by Amazon Cognito; HQ never sees or stores your password.
- Security records. When and how you signed in, a fingerprint of your browser (a hash of its user-agent) to spot new devices, and your IP address in security logs.
- The family's records. What the people using HQ enter: entities, ownership, values, dates and to-dos, notes and documents. Every change is kept in an append-only history with who made it and why.
Sign in with Google
If you choose "Continue with Google", HQ asks Google only for the openid and email scopes. From Google HQ uses your email address and whether Google verified it, your Google account ID, when you signed in to Google, and how (for example, password and 2-step verification). HQ uses this only to sign you in, and only when that Google sign-in used 2-step verification. HQ keeps a one-way hash of your Google account ID, to recognise the same account next time, and a record of the sign-in (who, when and the methods Google reported). It does not keep your Google ID token or any Google access token, and it does not read your Gmail, Drive, Calendar or contacts through Google sign-in.
Accounts you connect
- Google accounts (Settings). The Owner may connect a Google account read-only. HQ stores an encrypted refresh token and the account's email address. Today HQ uses it only to check the connection works; it does not read mail, files or calendar entries.
- QuickBooks Online. The Owner may connect a QuickBooks company. HQ's access is read-only, and HQ can only fetch accounting reports and summaries: profit and loss by month, sales by customer by month, receivables by age with counts of open invoices, and cash on hand. It keeps those totals and customer names with their totals, not individual invoices or transactions. HQ cannot create, change or delete anything in QuickBooks, and cannot move money.
- Tokens for connected accounts are encrypted (AES-256-GCM, keys protected by AWS KMS), are never written to logs or history, and are deleted when you disconnect. You can disconnect any account at any time in Settings; you can also disconnect HQ from inside QuickBooks or your Google account.
How it is used
Only to run HQ for the family and the people we invite: showing each person what their role allows, reminding them of what is due, and keeping records accurate. Jarvis, HQ's assistant, can read records in HQ to summarise them and suggest changes; it runs on Anthropic's Claude service. HQ does not send sign-ins to Jarvis for analysis, and never your Google account ID, which HQ does not keep. The sign-in record in History (who, when, the methods Google reported) is readable by the Owner and Jarvis, like the rest of History.
Sharing
We do not sell, rent or share your data, and we do not use it for advertising. It is stored and processed by the services HQ runs on: Amazon Web Services (hosting, database and sign-in, in the United States), Google and Intuit (only for the connections and sign-in above), and Anthropic (Jarvis). We would disclose data only if the law required it.
Security
HQ is served only over HTTPS. Data is encrypted at rest. Every sign-in needs a second factor: an authenticator app with your HQ password, or 2-step verification on Google. Access inside HQ is limited by role, both in the app and in the database.
Keeping and deleting your data
We keep records while HQ is in use. Ask us and we will delete your sign-in, your linked Google account and the data about you that can be deleted, and tell you what remains. HQ's history is append-only so that past changes can be checked, so entries that record a change may stay. HQ's application logs are kept for 90 days and database backups for 14 days. You can disconnect a connected account in Settings at any time, and ask us to unlink your Google sign-in.
Contact
Questions or requests: hatcher.chace@gmail.com. If this policy changes, the new version will be posted here with a new date.