What StratOps stores, and what it never sees.

Last updated 18 August 2026. StratOps is built and operated by Jacob Hodges. Every claim on this page describes what the code does, and the source is public reasoning rather than a template.

What it stores

Your record. The tasks, notes, meetings, contacts, deals, decisions and everything else you tell Claude about. That is the product: it exists to hold this, and it holds nothing else about you that you did not put there.

Who you are, from Google. When you sign in, StratOps keeps your email address, display name, profile picture URL, and — if you use a Google Workspace account — the domain it belongs to. That is the whole list.

What it never sees

A password. There is no password field anywhere in StratOps. Sign-in happens at Google, and you never type a credential into anything StratOps serves.

Your Google account, beyond your name. StratOps asks Google for three things — openid, email, profile — and nothing else. It cannot read your mail, your calendar, your files or your contacts, because it never asked for permission to and would be refused if it tried. Google returns an access token along with your identity, and StratOps deliberately never reads it.

Secrets, even yours. Access tokens, refresh tokens, authorization codes and connector secrets are stored only as SHA-256 hashes. A complete copy of the database contains nothing that can be presented back to StratOps as you.

Your IP address. Sign-in events record a hash of the address combined with a salt that changes every day. That is enough to notice a burst of failed attempts within a day and not enough to follow anybody across two. The address itself is never written down.

Anything, in a log. There is not one logging statement in the source. No token, no record, no address has ever reached a log line, because there are no log lines.

Where it lives

On Cloudflare — a Worker and a D1 database, in an account owned personally by Jacob Hodges. Cloudflare is the only third party that touches your data, as the host. Google sees your sign-in, because Google is who you sign in with.

Nothing is sold, shared, brokered or used to train a model. There is no analytics script, no advertising pixel, and no third-party request of any kind — the marketing page you came from loads no external font, no CDN and no tracker.

How long it is kept

Your record is kept until you ask for it to be removed. Access tokens expire in an hour and refresh tokens in thirty days. Sign-in events are kept as an audit trail, and they never contain a token, a code or a secret.

Deleting it, and getting it back

Ask, and it is done by hand, by a person, quickly. There is no self-serve export or delete button yet, and it would be dishonest to imply otherwise — the main page lists this among the things that do not exist. Both are being built.

Disconnecting the connector revokes that connection and nothing else. It does not delete your record, and it does not touch any other device.

Who to ask

jake@aifrontdesk.com. A person reads it.

StratOps has one user today. When that changes, this page changes with it, and the date at the top is how you will know.