Privacy Policy

Site Diary app · Version 2026-10-03 · Last updated 3 October 2026

Summary: we collect only what is needed to run the app for you. We do not sell your data, use it for targeted advertising, or share it except with service providers needed to operate the app. You can export your data or permanently delete your account at any time in Settings.

Who we are

The app is operated by Mousa Yousef Alkhatib and Partners, the controller of your account data. Contact: info@alkhatibconstructs.com.

Data we collect

Account data (name, company name, email, a one-way hash of your password, date of consent); business data you enter (projects, daily logs, photos, purchases, suppliers, receipt numbers, subcontractors, workers' names, numbers, wages and attendance, client payments); technical data (IP address and browser type in short-lived server logs, one essential session cookie); when you use an AI feature: your question with a summary of the relevant project data, your log notes, invoice items or the receipt photo you choose, processed in real time by Cloudflare Workers AI, not stored by us and not used to train models; if you choose Sign in with Google or Apple: your name, email and account identifier from that provider (with Apple's "Hide My Email" we only receive a relay address; we never receive your password or other account data); subscription and payment records (plan and period; amount, currency, date and method of each payment, and the receipt or reference number; we never store card or bank account numbers); one-time email verification codes (deleted after use or within 15 minutes). We do not collect location or contacts, and we use no ad trackers or analytics.

Legal basis

Performance of our contract with you, our legitimate interest in security, and the consent you give at sign-up, which you can withdraw by deleting your account.

Data about your workers and clients

For personal data of other people you enter, your company is the controller and we process it only on your behalf to provide the service. You are responsible for having a lawful basis to record it.

Sharing

We never sell or rent data. Processors: Cloudflare, Inc. (hosting, database, photo storage, security, and Workers AI for the in-app AI features); Resend (verification and password-reset emails only); Google and Apple (only if you choose to sign in with them, to confirm your identity); Google Fonts (font delivery, which may expose your IP address to Google). Data may be processed outside your country, including the United States, under appropriate safeguards such as Standard Contractual Clauses. We may disclose data when required by law.

Advertising

The free plan currently shows only in-house messages, with no third-party ad networks and no tracking. Before adding any third-party ad network we will update this policy and ask for consent where required. The paid plan has no ads.

Notifications and support

Notifications: if you turn them on, we store the subscription address your browser or phone gives its push service (Google, Apple, Mozilla or Microsoft), with your time zone, app language and chosen reminder times. Notification content is encrypted end-to-end from our server to your device; the push service cannot read it. The subscription is deleted when you turn notifications off, sign out or delete your account. Support: chats with the support assistant are processed in real time by Cloudflare Workers AI and not stored, unless you attach them to a ticket. Tickets (title, description, device type, app language and plan, and the chat if attached) are stored and copied to our support email, and deleted with your account.

Retention and deletion

We keep your data while your account exists. Deleting your account (Settings → Delete account) immediately erases all your data and photos from our database; technical backups are overwritten within 30 days. Exception: payment records (amount, date, method, reference, company name and email) are kept after deletion for as long as accounting and tax law requires, and used only for that purpose. You may also request deletion by email; we act within 30 days.

Security

HTTPS everywhere, PBKDF2 password hashing, per-company data isolation, HttpOnly session cookie, and login rate limiting. If a breach affects your data we will notify you and authorities as required by law.

Your rights

Access, rectification, erasure, portability, restriction, objection and withdrawal of consent. Export and deletion are available directly in Settings. You may complain to your data protection authority (in Malta: the Information and Data Protection Commissioner, IDPC).

Cookies

One essential cookie, sid, keeps you signed in for 30 days. No tracking or advertising cookies.

Children

The app is intended for businesses and is not directed at anyone under 16.

Changes

We will notify you in the app or by email before material changes take effect.