Local-first means your workspace stays yours.

Optional merchant contact record and company product emails

Aetheris Sun LLC is responsible for this contact record. In Settings → Account, you can separately request that your own name, email, preferred language and contact choices be saved in our private Cloudflare D1 service. We also retain an opaque contact ID, your device-submitted workspace Support ID, platform, notice version, timestamps, revision and a history of saved choices. Your Support ID is not proof of account ownership. This form does not upload your appointment clients, verify a mailbox, sign you in, merge accounts or change RevenueCat entitlements. Saving only on your device does not submit this cloud contact record.

Cloudflare processes the record for us; authorized company operators can review it. Unlike encrypted workspace packages, these contact fields are readable by our authorized service and operators. They are not placed in GitHub or public website assets. Provider infrastructure may process data internationally; available privacy rights and required transfer safeguards depend on your jurisdiction. Contact us for questions about international processing.

Product-marketing permission is a separate, initially unchecked choice. It covers Aetheris Sun LLC using your name, email and language to recommend SlotSure and its other merchant-business apps, including launches, updates and offers. It does not cover unnamed affiliates, sale of contacts, third-party advertising, SMS or WhatsApp promotion. Refusing or withdrawing does not affect app access, purchases or essential account/service messages. Existing local profiles and ambassador preferences are not silently imported as permission.

We retain your requested record to provide contact-preference management. Marketing relies on a separate affirmative permission and any further confirmation required before sending. Emails submitted here are self-reported and unverified: a saved choice is not proof that the submitter controls that mailbox. This release does not send automatic marketing or verification emails. Future manual campaigns require a fresh eligibility and jurisdiction review, appropriate sender disclosures and an unsubscribe method; the recorded checkbox alone is not a worldwide compliance certification.

You can withdraw in the app, use the no-login email opt-out page, or email contact@aetherissun.com. We suppress the address from future product-marketing selections. To prevent abuse, the public page never reveals whether an address is registered. We do not automatically reactivate a suppressed address. If an earlier exported message is already being processed, contact support; operators must recheck suppression immediately before sending.

The authorized device can update or delete its cloud contact record. Deletion removes the active name, email and linked choice history; a one-way email hash, withdrawal date and reason remain to prevent accidental re-enrollment. This hash is pseudonymous, not anonymous. Request support for access, correction, export, deletion, objections or withdrawal if the device is lost. We verify ownership before disclosing or changing protected records. Contact deletion does not cancel a store subscription or delete separate billing records. Cloudflare backups may temporarily retain deleted data.

We retain active contact records until you delete them or a retention review finds they are no longer needed. Operators review dormant records before export and at least annually; this is an operational obligation, not an automatic deletion timer. Minimal suppression records remain while needed to honor opt-outs. Hourly abuse-control buckets use a salted network-address hash, expire after at most two hours and are cleaned by the scheduled service; cleanup can be delayed by an outage. Do not submit another person's address.

1. Information stored on your device

You may enter or import business records including:

• Client names, contact details, relationship notes, contact permissions, waitlist preferences, and response history.
• Appointments, services, prices, providers, resources, cancellations, and no-show records.
• Deposit requests, booking codes, policy summaries, customer payment claims, merchant verification status, and saved processor links. The app does not store card numbers, processor passwords, balances, bank accounts, or complete transaction histories.
• Recovery cases, candidate rankings, outreach drafts, confirmed outreach evidence, replies, holds, replacement bookings, outcomes, and revenue calculations.
• Business preferences, message templates, optional booking links, organization and device identifiers, and locally generated open-slot assets.

Local storage remains the working copy even when sync is enabled. Device-wrapped sync credentials are stored separately from the business database. The recovery key is shown to the organization owner and is not recoverable by Aetheris Sun LLC.

2. Sharing, billing, and connected-service records

Links and files you choose to share

Exporting a file, using System Share, opening SMS, WhatsApp, Email or Phone, or sharing a GuardLink, receipt, booking QR code, or open-slot asset hands selected information to your chosen app or recipient. The communication app may receive the draft before you press Send. SlotSure does not send an automatic message or verify its delivery. Review the recipient and draft first; the selected service's privacy practices apply.

A legacy complete Manual GuardLink or local receipt stores customer-facing details in the part of the URL after #. These details are encoded, not encrypted. They can include the customer display name, merchant, service, appointment time, amount, policy, booking reference, payment link and merchant reply destinations; a receipt also includes the merchant's recorded payment status. Anyone with the complete link can read or forward it. A local receipt is a merchant snapshot, not independent proof of payment. Standard page requests do not send the fragment to the static host, but the recipient, the page's code, and the apps handling the link can read it. Do not include sensitive notes in public-facing fields.

When the optional short-link service is enabled, preparing a shareable customer page can create a shorter link using our existing Cloudflare service. The device encrypts the customer-page contents with a fresh AES-256-GCM key before upload. Cloudflare stores only the encrypted envelope, initialization vector, random identifier and expiry; the decryption key stays in the shared URL fragment and is not sent in our API requests. The receiving page downloads the envelope and decrypts it locally. Anyone with the complete link can still view and forward the details: this is not recipient identity verification. QR codes contain the same complete link and are generated on-device.

Encrypted shared-link envelopes are retained for up to one year from creation. Expired envelopes cannot be retrieved and scheduled cleanup removes them; provider backups or cleanup outages may retain encrypted copies temporarily. Retention does not extend the appointment's payment deadline, verify payment, or change subscription rights. Short-link requests also process ordinary network metadata and a salted hourly address hash for abuse control; those rate-limit buckets expire within two hours. This service does not upload the full client book. If preparation fails, SlotSure clearly offers the legacy complete link and a retry. Existing complete links remain supported. Keep all customer links private; changing or deleting a local booking cannot retract a previously shared snapshot or copies held by recipients. Contact support with the link identifier if an encrypted envelope needs removal.

Subscriptions, cancellation, and refund records

When you check, buy, restore, cancel, manage, or request help with a subscription, SlotSure provides RevenueCat a stable, custom workspace App User ID. It is randomly generated but is not anonymous: it links subscription records to the workspace and may be associated with store or web transactions. RevenueCat and the applicable store or configured web billing provider process purchase history, product, price, currency, renewal and expiration dates, transaction and entitlement status, checkout email, invoices, cancellation, refund and technical request information. Receipts can trigger later status checks to keep access accurate. Native SDK advertising-identifier collection and optional diagnostics are disabled; this does not disable necessary billing requests or RevenueCat's subscription analytics. SlotSure does not set client names, phone numbers, or appointment details as RevenueCat customer attributes.

A refund-support email prepared by SlotSure includes the workspace Support ID and purchase channel, plus information you choose to add such as state or country, invoice reference, and reason. Do not include client records, full card numbers, passwords, or recovery keys. Refund decisions may use subscription dates, plan, transaction status, cancellation and refund history, and aggregate plan-usage counters; we do not need to inspect client names or appointment content to review ordinary eligibility.

Existing cloud workspaces

Cloud data controls use your existing organization/device identifiers and authentication credentials to list or revoke devices, rotate a recovery credential, or delete the cloud copy. Previously uploaded protected-appointment packages are encrypted on the device with AES-GCM. They can include protected appointments, deposit requests, related history, saved payment links, usage totals and the canonical billing ID. The service does not receive the raw workspace encryption key. Full client-book records are excluded from that projection.

Encryption does not cover all service metadata. Organization and billing IDs, device IDs and user-chosen device labels, platform, role, revisions, timestamps, credential hashes and abuse-control records are processed separately. Use a device label such as “Front desk” instead of personal or client information. New sync, joining, invitations and automatic uploads remain unavailable in this build.

Existing connected-payment records

Existing connected GuardLinks can retrieve a limited appointment/payment-status record using the link token. That operational record can contain merchant display and reply contact details, service, time, amount, policy, booking and processor references, acceptance evidence and payment/refund status. It is not end-to-end encrypted like a workspace backup. Processor access tokens, where retained, use server-side encryption so the authorized payment service can use them; they are not stored as client-side API keys. Disconnecting a processor does not delete its transaction history. New automatic checkout and OAuth connections remain unavailable in this build.

For manual payment, the customer chooses to open the merchant's external payment page. Card and bank details are entered with the payment provider, not into SlotSure. Signed processor events for existing integrations may contain additional payer or transaction fields; failed-event recovery can temporarily retain the event under server-side encryption. SlotSure does not take custody of the merchant's deposit.

Email accounts and optional account recovery

Free local use and imports do not require registration or email verification. An optional contact email is not a verified account. Email verification is required for paid upgrades, referral-reward participation and access to an existing account. Supabase handles merchant email verification codes and login sessions; Brevo delivers these transactional emails. Ordinary sign-in uses email codes. The dedicated review entry sends an App password directly to Supabase, which manages the credential. SlotSure does not retain that password in workspace data, logs or Cloudflare. Do not provide your mailbox password. Cloudflare validates the verified Supabase user and active session before accessing the account's records. A server-issued opaque billing identifier links that account to RevenueCat. Signing in again on a new device does not create a new subscription, cancel billing or change your rewards.

Automatic account recovery backup is optional and off until you explicitly enable it. It uploads an encrypted full workspace, including customer contact details, to Cloudflare. The recovery key is protected with a separate server secret. This service-assisted recovery allows a verified account to restore on a new device; it is not encryption that only the customer can unlock. This full-workspace backup is separate from the limited, device-key-encrypted team projection described above. Team recovery keys are not included.

Automatic backups run while the application is open and connected. The app cannot back up edits made after it is closed or while offline. Conflicting uploads stop rather than overwrite another device's backup. Deleting the cloud backup removes its active payload and protected recovery key and stops uploads. Provider backups may retain deleted records temporarily. Account deletion requires a fresh email verification code and removes SlotSure account access and the active account recovery backup. If the same sign-in also owns another company product’s license, the shared authentication identity and that product’s records are retained; SlotSure account access and its active recovery backup are still removed. Deletion does not cancel store subscriptions or delete separate team workspaces, merchant contact records, payment ledgers or records that must be retained; use the corresponding controls and original billing provider. Export a local backup before deletion.

3. Device permissions

Optional notification permission enables on-device reply-check reminders. The operating system may display reminder text on the lock screen according to your settings. Android also uses network-state, billing, wake-lock and boot-receive permissions supplied by its billing and local-reminder libraries. These are not permission to read your SMS or contacts. File import/export uses files you select and the app's private cache; encrypted backup cleanup reads file timestamps inside that cache. SlotSure does not request access to your contact book, location, microphone or camera.

4. Hosting, analytics, and tracking

Loading the web app, a public customer page, or a support page sends ordinary network information such as IP address, browser information and requested path to our hosting provider. Service requests may also create security, diagnostic and abuse-control records. These are not advertising profiles. SlotSure has no advertising SDK, cross-app tracking, general product-analytics SDK, remote AI model, automatic SMS provider, or remote calendar connection in this release. RevenueCat subscription analytics is distinct from general product analytics.

Our application logging is limited to operational event categories and, where needed, opaque event references and retry counts. Credentials, recovery keys, message contents, full request bodies and raw exception messages must not be included in application logs. Infrastructure providers may process network metadata under their own retention and security practices.

Optional business referral rewards and ambassador profile

The referral program remains unavailable until its release checks pass. When you explicitly save an invitation, the app stores only its public code and a timestamp on your device, eligible for use for up to 30 days. You can remove it in Referral rewards. A link may also include the public referral code in its query string, which can appear in ordinary hosting logs. We do not use device fingerprinting or read your contacts to recover referrals across app installs.

An organization owner may separately register a SlotSure ambassador profile. The profile stores the owner's submitted display name and email, app locale, participation status, consent version, source product, enrollment and update dates, and a separate yes-or-no preference for news about future Aetheris Sun business products. These records are stored in the protected Cloudflare D1 service associated with the verified organization—not in GitHub, a public spreadsheet, the encrypted appointment workspace, or another merchant's records. Agreeing to referral terms does not subscribe you to future-product marketing; that choice is optional and can be withdrawn independently. The profile does not include appointment-customer contacts.

When the program is enabled, authenticated referral actions process organization and billing identifiers, an owner-verification reference, a public referral code, attribution time, minimal qualifying subscription transaction identifiers and status, reward state, and refund/reversal evidence. This operational ledger is not the encrypted appointment workspace. Billing identifiers are also held separately by the server to verify organization subscriptions. The ledger does not need your client list, appointments, messages, card numbers, bank details, or another merchant's contact details. A referrer sees reward status and an opaque reward reference, not the referred merchant's purchase details.

You can withdraw ambassador participation in the app; this changes the profile to withdrawn, removes the future-product preference, and retains a minimal consent/withdrawal receipt needed to honor the choice and resolve disputes. Referral records remain while needed to deliver or correct rewards, prevent duplicate claims, handle refunds, or meet applicable retention requirements. Deleting a local workspace or encrypted cloud copy does not erase the separate subscription/referral ledger or cancel a subscription. Contact contact@aetherissun.com to request access, correction, or deletion; we explain any records we must retain. Referral sharing uses your chosen operating-system channel, only after you initiate it. See the referral terms.

5. Privacy choices, retention, and deletion

Local records remain until you delete them in Settings → Privacy and legal, clear the app's storage, or uninstall the app. The in-app deletion control removes clients, appointments, deposit requests, imports, recovery cases, and evidence events from the device. Plan entitlement and a local quota ledger remain to preserve purchase and usage limits. This ledger retains monthly protection and recovery counts, buffer timestamps, and opaque booking/case IDs for deduplication; it does not contain client names, contact details, payment links, or amounts. It is separate from business backups and sync packages, which may still include their ordinary usage totals and business records. The ledger remains on this device until this site's or app's storage is cleared; clearing business records alone does not remove it.

Disconnecting a device removes that device's wrapped sync credential but does not delete the organization cloud copy because other authorized devices may still use it. An organization owner can choose Settings → Cloud data controls → Delete cloud copy (Team and sync in an accepted Connected Suite release) to delete the active encrypted organization package, invitations and registered-device records while preserving local business data. This is not a deletion of all service records: separate billing bindings, payment, referral, fraud-prevention and audit records may remain. Provider backups may retain deleted records temporarily.

Depending on where you live and whether an applicable consumer privacy law covers Aetheris Sun LLC, you may have rights to know or access, correct, delete, or obtain a portable copy of certain personal information, and to appeal a denied request. SlotSure does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, so there is no sale or targeted-advertising opt-out needed for the current release. We do not discriminate for exercising an applicable privacy right.

To request access, correction, deletion, portability, or an appeal concerning service records, or assistance with RevenueCat or store records, email contact@aetherissun.com with the SlotSure Support ID shown in Settings and, if relevant, a store order identifier. This works without an app login. We may ask for limited ownership verification, may deny requests we cannot safely verify, and will explain any records retained for subscription management, refunds, disputes, tax, accounting, security or applicable requirements. Never send client records, card details, a recovery key, or a backup password. An authorized agent may submit a request where law permits, subject to proof of authority. Deletion does not cancel a subscription; use the original store or web subscription-management flow.

Service records are retained while needed for those purposes; there is no blanket automatic erasure period for the separate operational ledgers. Failed payment-event payloads have a seven-day retry expiry and are cleared on successful recovery or expiry processing; a processing outage can delay cleanup. Billing providers retain transaction, tax, fraud, invoice, cancellation and refund records under their own legal obligations. Exported files, messages and forwarded links are controlled by their recipients and are not recalled by local or cloud deletion.

If you create an encrypted backup, you control its saved copies and retention. The app uses a private cache for native sharing and attempts cleanup, which may be delayed while the app is closed. Aetheris Sun LLC cannot recover a lost password for a user-exported backup or a lost team workspace encryption key. Separately enabled account recovery backups use the service-assisted process described above.

6. Security

The ordinary local business database is not password-encrypted by SlotSure. It relies on the browser/app sandbox and your device's security. Password-based AES-256-GCM encryption applies to user-created backup files, not the live database. New shared-link envelopes use a separate randomly generated encryption key held in the complete link, as described above; legacy complete links are encoded, not encrypted. Existing encrypted cloud packages derive encryption material on the device; locally saved sync credentials are wrapped using a non-exportable device key. Production service connections use HTTPS.

Android app cloud backup and device-to-device transfer are disabled in the app's backup rules. SlotSure does not currently implement a matching iOS-wide system-backup exclusion: device or computer backups may retain app data under your Apple/device settings. Clearing local records cannot erase an earlier system backup. Protect your device, review system backup settings, and keep keys and backup passwords separate from exported files. No storage or security method is completely secure.

7. Merchant responsibilities

SlotSure is business workflow software. The merchant using it is responsible for having an appropriate legal basis and permission to store client information and contact clients, for honoring opt-outs and quiet-hour rules, and for complying with applicable privacy, marketing, consumer-protection, and record-retention laws.

8. Children

SlotSure is intended for business operators and is not directed to children under 13. Do not use the service to collect children's data unless you are legally authorized and have implemented all required safeguards.

9. Changes

We may update this policy as the product changes. The effective date at the top identifies the current version. Material changes to connected data handling will be disclosed before or when the new feature becomes available.

10. Contact

Privacy questions, deletion assistance, and product support: contact@aetherissun.com.