Privacy · updated 18 August 2026
What it never sees.
Built and operated by Jake Hodges. Every claim on this page describes what the code actually does — each one was checked by reading the source, and the check is written into this page’s own HTML for anyone who wants to re-run it rather than take it on faith.
- Your recordThe tasks, notes, meetings, contacts, deals and decisions you tell Claude about. That is the product — it exists to hold this, and it holds nothing else about you that you did not put there.
- Who you are, from GoogleYour email address, display name, profile picture URL, and — if you use a Workspace account — the domain it belongs to. That is the whole list.
- A passwordThere is no password field anywhere in StratOps. Sign-in happens at Google, and you never type a credential into anything StratOps serves.
- Your Google account, beyond your nameIt asks Google for three things —
openid,email,profile— and nothing else. It cannot read your mail, calendar, files or contacts, because it never asked for permission and would be refused if it tried. Google returns an access token alongside your identity, and StratOps deliberately never reads it. - Secrets, including yoursAccess tokens, refresh tokens, authorization codes and connector secrets are stored only as SHA-256 hashes. A complete copy of the database contains nothing that can be presented back to StratOps as you.
- Your IP addressSign-in events record a hash of the address combined with a salt that changes every day — enough to notice a burst of failed attempts within a day, and not enough to follow anybody across two. The address itself is never written down.
- Anything, in a logThere is not one logging statement in the source. No token, no record and no address has ever reached a log line, because there are no log lines.
Two companies touch it, and you can name them both.
A Cloudflare Worker and a D1 database, in an account owned personally by Jake Hodges. Cloudflare is the only third party that touches your data, as the host. Google sees your sign-in, because Google is who you sign in with.
Nothing is sold, shared, brokered, or used to train a model. There is no analytics script, no advertising pixel, and no third-party request of any kind — this page loads no external font, no CDN and no tracker, which you can confirm from your own network tab in about four seconds.
0
Log statements in the source
0
External requests on this page
- Your recordUntil you ask for it to be removed.
- Access tokensOne hour.
- Refresh tokensThirty days.
- Sign-in eventsKept as an audit trail. They never contain a token, a code or a secret.
Ask, and a person does it.
There is no self-serve export or delete button yet, and it would be dishonest to imply otherwise — this is listed among the things that do not exist on the how it works page too. Both are being built. Until then, ask and it is done by hand, quickly.
Disconnecting the connector revokes that connection and nothing else. It does not delete your record, and it does not touch any other device.
jake@aifrontdesk.com
A person reads it.
StratOps has one user today. When that changes, this page changes with it, and the date at the top is how you will know.