209. Connect Workspace Privacy Policy

Effective October 20, 2026. Operated by David Sicairos. This policy describes the Workspace application, whose member dashboard is called Workstation; it does not describe unrelated newsletters or third-party websites.

Information accessed and collected

When you use Google sign-in, Google supplies account identity information to Supabase authentication. This can include your Google account identifier, email address, name and profile image as supplied by Google. Account and session information is used to identify you and maintain sign-in. If you choose email and password registration instead, those credentials are submitted to Supabase authentication.

Workspace content includes information you enter or save: daily plans, schedule blocks, tasks, goals, reflections, reviewed lessons, weekly-review notes, creator drafts and preferences. Do not enter information you do not want processed by the service.

How information is used

Account identity information authenticates you and associates your account with your planning records. Saved workspace information is used to load and update your selected days and produce in-app reviews. Google account identity information is not needed to populate the synthetic example records.

The browser's Google sign-in request specifies no extra Google API scopes. Gmail access, Google Drive access and Google Calendar synchronization are not features of this workspace. Review the actual Google consent screen before authorizing access.

Storage and service providers

Supabase provides authentication and the account-backed database. Saving a day sends its planning content, journal and reviewed lesson to the Supabase backend; retrieving records uses the signed-in account identifier. The client verifies the current account before and after its database operations. This describes client behavior, not a guarantee that all backend security controls have been independently audited.

Supabase session information can be persisted in browser storage by its authentication client. The site also stores your theme preference locally. The synthetic demo adapter stores its sample planning records in memory. Older device records may remain in browser storage and have a separate explicit local-export control.

GitHub Pages serves the website. Google processes your Google authentication. Supabase processes authentication and saved workspace content. The Supabase browser library is loaded from jsDelivr, which receives the network request for that library. Hosting and infrastructure providers receive the connection information needed to serve their requests, such as IP address and browser request metadata.

Sharing and user-directed exports

Information is transmitted to the providers described above to supply the application. The application's creator-draft interface does not automatically publish drafts, and its reflection interface does not automatically send reflections to AI. Exporting records creates a file containing private text without application-level encryption; you control where you store or share that file. Other destinations you open have their own policies.

Protection of information

The configured website and authentication/database connections use HTTPS. The account-backed adapter checks the signed-in account and associates database queries with its user identifier. Protect your device and account; do not share passwords, session tokens, recovery links or exported private records. No system can guarantee absolute security.

Retention and deletion requests

The workspace client implements no automatic expiry for saved account records. Signing out does not delete saved cloud records. You can replace editable content and save the revised day; this is not a promise that all historical copies or backups are immediately erased.

To request account deletion, removal of saved workspace records, or clarification of provider backup retention, contact David Sicairos through his published LinkedIn profile and identify the application as 209. Connect Workspace. Do not send passwords, tokens or journal text. Account ownership must be verified before an account-specific request can be acted on. The application currently provides no self-service account-deletion button or guaranteed automatic deletion schedule.

Your choices

You may decline Google sign-in, use the available email sign-in method, or try the synthetic demo. You can review and revoke Google access through your Google Account's third-party connections controls. Revoking Google access does not by itself delete existing workspace records. Sign out on shared devices and clear local site storage when appropriate; clearing browser storage does not delete cloud records.

Contact and updates

Developer and privacy contact: David Sicairos, through LinkedIn. Material changes will be reflected in this policy with an updated effective date.