Privacy Policy

Operators HQ is operated from Canada. For the personal information described on this page, we are the organization accountable for it: the “controller” in GDPR and UK GDPR terms, and the accountable organization under Canada's PIPEDA. We also apply the Australian Privacy Principles for members in Australia.

Questions, requests, or complaints: support@operatorshq.app.

• Account: your email address, username, and anything you add to your profile: display name, bio, avatar, timezone, and your chosen track.
• Content: posts, comments, and receipts you publish, and messages you send to the AI concierge.
• Activity: Reps, ranks, streaks, lesson and quiz progress, Daily Ops completions, and reactions. This is the product, not surveillance: it exists so your rank reflects your work.
• Referral attribution: if you joined through an invite link, the code that brought you here, so the inviter gets credit.
• Device and log basics: IP address, browser type, and timestamps in standard server logs, used for security and keeping the service up.
• Optional newsletter: if you choose to subscribe, the email provider collects your email address, optional first name, consent record, form source, and engagement needed to deliver and operate the list. Newsletter signup is separate from membership.

No location tracking, no contact scraping, no purchased email lists, and no behavioral advertising profiles.

If you choose a remote avatar URL, other members' browsers request that image directly from its HTTPS host. That host can receive normal connection details such as IP address and browser type. Operators HQ sends no page referrer with avatar requests. Leave the field empty if you do not want a third-party avatar host involved.

• Running the service: accounts, sign-in, showing your content and progress to you and (where you post publicly inside the community) to other members.
• Gamification: calculating Reps, ranks, streaks, and leaderboard standing.
• Safety and moderation: enforcing the community rules, reviewing reports, and keeping fabricated receipts out.
• Service email: account messages and important service notices. Marketing email is separate: it requires your express opt-in, is off by default, and every message has a working unsubscribe (we follow Canada's CASL because we send from Canada).
• Optional newsletter: delivering the lessons or updates you asked for, recording consent, handling replies, and honoring unsubscribes and suppression.

• Contract: running the service you signed up for, including accounts, content, progress, and referral credit.
• Legitimate interests: security, fraud and abuse prevention, moderation, and keeping the service reliable.
• Consent: marketing email only. You can withdraw it at any time and nothing else about your membership changes.

• Supabase: hosting, authentication, and our database.
• Anthropic: powers the AI concierge. Only the messages you send to the concierge are shared with Anthropic, and only to generate replies. Under Anthropic's API terms, those messages are not used to train their models.
• Kit: if the optional newsletter is enabled, Kit hosts its form, confirmation, delivery, unsubscribe, suppression, and consent records. The signup form names the sender and the messages a subscriber requested before information is submitted.
• Payment processor: none today, because nothing is paid during the founding era. If paid tiers launch, we will name the processor here before taking a single payment.

We do not sell personal data. We do not run ads. There are no data brokers, no analytics resellers, and no exceptions.

For the life of your account. Delete your account and your personal data is deleted with it: profile, posts, comments, receipts, progress, streaks, Reps history, referrals, notifications, and concierge conversations.

Two narrow exceptions: moderation and audit records may be retained with your identity removed (so the record of an action survives, but it no longer points at you), and we keep anything the law requires us to keep, for only as long as it requires.

Newsletter records are separate from an Operators HQ account. Unsubscribing stops marketing messages and keeps the minimum suppression record needed to honor that choice. You can also ask us to delete the newsletter record. Deleting an app account does not silently resubscribe, unsubscribe, or erase a separate newsletter record.

Everyone, regardless of where you live: you can access, correct, export, and delete your personal information.

The how, without a paper chase: data export and account deletion are self-serve in Settings. No email required, no waiting period theater, no retention dark patterns. If anything there does not work, write to support@operatorshq.app and we will do it manually.

• EU and UK members additionally have the rights to restrict or object to processing, to data portability, to withdraw consent at any time, and to lodge a complaint with your supervisory authority.
• Canadian members may complain to the Office of the Privacy Commissioner of Canada (OPC).
• Australian members have access and correction rights under the Australian Privacy Principles and may complain to the OAIC.

Operators HQ is operated from Canada. Authentication and application data are hosted by Supabase in its East US (Ohio), United States region. Where data crosses borders, we rely on our processors' safeguards, including standard contractual clauses or equivalent mechanisms where the law requires them.

Operators HQ is for people 16 and older. We do not knowingly collect personal information from anyone under 16, and if we learn an account belongs to someone under 16 we will delete it.

Come to us first at support@operatorshq.app and we will deal with it directly. You also always have the right to go to a regulator: the Office of the Privacy Commissioner of Canada, your EU or UK supervisory authority, or the OAIC in Australia.

When this policy changes, we update it here and revise the date at the top. If a change is material, we will tell you inside the service or by email before it takes effect, not after.