Privacy Policy

Last updated: August 10, 2026

This Privacy Policy explains how Sartain Studios LLC ("we", "us", or "our") collects, uses, and protects information across our products (together, the "Services").

Our Services work in two very different ways, so this policy is split accordingly. Please read the section that applies to the product you are using.

The short version: our mobile apps do not collect personal information — they only show ads served by Google. Our website requires an account, so it does store your email, name, profile photo, and the business records you create. We never sell your personal information.

Part A — Our Mobile Apps

Applies to our free, ad-supported mobile applications, which do not require an account.

A1. Information We Collect

We do not collect personal information through our mobile apps. We do not ask for your name, email address, or phone number, we do not require an account, and we do not operate analytics or user profiles in these apps. Any content or settings you create stay on your device.

A2. Advertising

Our mobile apps display advertisements served by Google (Google AdMob). Google and its partners may use cookies, device identifiers (such as your advertising ID), and similar technologies to serve and measure ads, including ads based on your prior activity in other apps and websites.

This information is collected by Google, not by us. We do not receive personal information from Google's ad services — we only see aggregated, anonymous performance reporting such as total impressions and revenue. See Section C1 for details and opt-out links.

Part B — Our Website and Web App

Applies to sartainstudios.com and the account-based time tracking and invoicing application.

B1. Account Information

Using the web app requires an account. Depending on how you sign up, we collect and store:

Sign in with Google. When you choose Google sign-in, Google shares your email address, whether that email is verified, your name, your profile photo, and a unique Google account identifier. We store these so we can create and recognize your account. We do not receive your Google password, and we do not access your Gmail, Drive, contacts, or any other Google data.
Email and password. If you register with an email address and password, we store your email address and a one-way cryptographic hash of your password (BCrypt). We never store your password in a readable form and we cannot recover it for you — we can only help you reset it.
Profile. A display name, profile photo URL, your role and membership in any organization, and the dates your account was created and last updated.

B2. Information You Enter Into the App

The app exists to help you run your business, so it stores the records you create, including: organizations and their addresses, phone numbers, and email addresses; clients and their contact people, addresses, phone numbers, and email addresses; projects; billing contracts and rates; work sessions and time entries; and invoices, including PDF invoices generated from that information.

Some of this information describes other people, such as your clients and their contact persons, or teammates you invite by email. You are responsible for having a lawful basis to provide us that information, and for telling those people how their information is used. We process it only on your behalf, to operate the Services for you.

B3. Technical and Session Information

When you sign in, we issue a short-lived access token and a refresh token, and store them in your browser's local storage along with your user ID, display name, email, profile photo URL, and current organization. This is what keeps you signed in; clearing your browser storage or signing out removes it.

Like nearly all web services, our servers and hosting provider process standard technical data such as IP addresses and request logs in order to deliver the site, keep it secure, and diagnose errors.

B4. Emails We Send

We use your email address to send service messages that are necessary to operate your account, such as password reset links and organization invitations. Password reset links are time-limited and expire shortly after they are issued. These emails are delivered through a third-party email provider.

B5. Advertising on the Website

We may introduce Google-served advertising on our website and web app in the future. If and when we do, the practices described in Section C1 will apply here as well, and where consent is legally required you will be asked for it before personalized ads are shown.

Part C — Applies to All Services

C1. Google Advertising and Your Choices

Google's use of advertising information is governed by Google's own privacy policy. You can review it and control what you see using the links below:

On mobile devices you can also reset your advertising identifier or opt out of ad personalization in your device's privacy settings.

C2. How We Use Information

We use the information described above only to: create and secure your account; authenticate you and keep you signed in; provide the features you ask for, such as tracking time and generating invoices; send service emails such as password resets and invitations; keep the Services reliable and prevent abuse; and comply with legal obligations. We do not use your business records for advertising, and we do not use them to train machine learning models.

C3. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only with service providers who help us operate the Services, and only as needed for them to do so:

Google — for sign-in and for serving advertisements.
Our database and hosting providers — to store your data and run the Services.
Our email provider — to deliver password resets and invitations.

If you belong to an organization, your name, email, and work activity are visible to administrators and other members of that organization as needed for its operation. We may also disclose information if required by law, or in connection with a merger or sale of assets, in which case we will notify you.

C4. Security

We use reasonable technical and organizational safeguards, including encrypted connections (HTTPS/TLS), one-way BCrypt password hashing, short-lived access tokens, and restricted administrative access to our database.

As the platform operator, we retain limited infrastructure-level access necessary for maintenance, support, and reliability. We do not have access to your Google credentials, and passwords are never stored in recoverable form. Any operator access to production data is restricted to legitimate support needs and is subject to access controls and audit logging.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

C5. Data Retention and Deletion

We keep your account information and business records for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us at help@sartainstudios.com, and we will delete it within a reasonable period, except where we are required to retain certain records for legal, tax, or accounting purposes. Our mobile apps retain nothing, because they collect nothing.

C6. Your Privacy Rights

Depending on where you live, you may have the right to access, correct, export, restrict, or delete the personal information we hold about you, to object to certain processing, and to withdraw consent. To exercise any of these rights, email us at help@sartainstudios.com. We will not discriminate against you for exercising them.

For personal information collected by Google in its role as an advertising provider, requests should be directed to Google. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local supervisory authority.

C7. International Transfers

We are based in the United States, and the Services are operated using infrastructure located in the United States. If you access the Services from elsewhere, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

C8. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect information from children. Where required, ads shown to users we believe may be children are limited to non-personalized advertising. If you believe a child has provided us information, contact us and we will delete it.

C9. Third-Party Links

The Services may link to third-party websites, including sites reached by tapping an ad. We are not responsible for their privacy practices, and we encourage you to read their policies.

C10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above, and for material changes we will provide additional notice. Continued use of the Services after an update means you accept the revised policy.

C11. Contact Us

Questions about this Privacy Policy or your data? Email us at help@sartainstudios.com.