Privacy Policy

Another Adventure Studio Inc. (we) runs Working Attention. This policy explains what information we collect, why we use it, who receives it, how long we keep it, and what you can ask us to do with it.

Two things may surprise you, so we say them first. Apart from a few limits listed below, we keep information until someone deletes it. And while we do not sell personal information, we may sell de-identified data or train AI models on it. Data from a calendar you connect is the exception: we never sell it or train AI on it, in any form. The sections below give the detail.

This policy covers the Working Attention website and software. The SimCFO games and the older SimCFO website have their own privacy policy. Even so, sign-in is shared with those games and an older SimCFO system holds your user record, so both appear below.

Words we use

These words mean the same here as in our Terms of Service.

• Service means the Working Attention website, software and the messages it sends.
• Customer means the company or person that holds a workspace.
• Workspace means the shared space a Customer uses in the Service.
• Seat means one person's place in a workspace.
• Map means a workflow someone sets out in the Service.
• Authorized User means a person with a seat.
• Customer Data means what a Customer or its Authorized Users put into the Service, including text, imported files, transcripts and replies.
• AI Output means what the AI features of the Service produce.
• Calendar Data means what we get from a Google or Microsoft calendar a person connects, as Calendar connect describes. It belongs to that person. It is not Customer Data.
• Aggregated/De-Identified Data means aggregated, anonymized, de-identified or derived information, analyses, statistics, outputs, insights, datasets or other materials that come from personal information, usage information, Customer Data, AI Output or interactions with the Service, and that do not identify you, a Customer or any particular individual. It never includes Calendar Data or anything made from it.

Some features run only where we have switched them on. We mark those "where switched on". Seeing one named here does not mean it is on for you.

What we collect

• Your email address, user ID and password. The password goes to Firebase, which handles sign-in. If you sign in with Google, we also receive your Google account details, such as your name.
• Your seat details: the name shown for you, your role, your manager, your seat status and who invited you.
• Company details: the workspace name, the company website and what company research finds.
• Customer Data: whatever you type, import or dictate. This can include financial information, resumes, interview notes and notes about named employees.
• AI Output, plus your thumbs up or down and any reason you give for it.
• Live audio while you use a microphone, and the transcript that follows.
• Feedback you send us about the Service, including spoken feedback, which we save as text.
• A record of each email we send, and its full text.
• Technical information: web traffic that passes through Cloudflare, page analytics that Cloudflare records, and the errors, page addresses, timings and browser and device details your browser sends to Sentry.
• Items kept in your browser, listed under Cookies and browser storage.
• Billing details, where switched on: the payer's email address, the workspace ID, and records of subscriptions, payments and invoices. Card details are typed into Stripe's page. We hold no card details.
• Slack details, where switched on: Slack team, user and channel IDs, a bot token, messages, replies and clicks.
• Calendar Data, where switched on and only if you connect a calendar, as Calendar connect describes.

Why we use it

• To run the Service: sign you in, keep workspaces working and show each person what they may see.
• To run AI features, transcription and read aloud.
• To send invites, question nudges, digests and daily scans. Nudges, digests and scans go out on a schedule with no person involved.
• To find and fix errors and to measure speed.
• To improve what the Service gives you, by adding your saved feedback to later AI prompts.
• To improve the Service and build new features.
• To bill Customers, where billing is switched on.
• To protect the Service and to meet legal duties.
• To create Aggregated/De-Identified Data, and to use, disclose, license, sell or otherwise commercialize it for any lawful business purpose. That includes analytics, benchmarking, research, product development, marketing, training and evaluating AI models, and creating or selling datasets, reports and insights. None of this applies to Calendar Data.
• To run calendar features for the person who connected a calendar. Calendar Data is used for nothing else.

If GDPR or UK GDPR applies to you, our legal bases are:

• Contract, to provide the Service to you or to the Customer you work with.
• Legitimate interests, to secure, fix and improve the Service, to measure its speed, to create Aggregated/De-Identified Data and to run our business.
• Consent, where we ask for it. You can withdraw it at any time.
• Legal duty, where the law requires us to keep or share information.

Who gets it

The Service relies on the third-party services below, meaning separate systems it sends information to. Each one receives what the table shows.

The older SimCFO system

The Service depends on this system. Every sign-up and every signed-in page load reaches it, it holds the user record, and the Service will not load without it. That holds even if you never play a SimCFO game. Sign-in is shared too, because the Service and the games use the same Firebase project. This policy does not cover how the older system handles information after it arrives. The SimCFO privacy policy applies to that product and allows uses this policy does not, so read it too.

Sentry

Your browser sends Sentry errors, page addresses, the addresses of requests the browser makes, timings, and browser and device details such as language and time zone. Our setup is also configured so that Sentry can record the full text of AI prompts and AI Output, including anything typed or spoken into an AI feature. Treat that as something Sentry may receive. Our code does not add your name or email to these reports, but a page address, a prompt or an AI Output can hold personal information.

Names you might expect

Deepgram's speech model runs inside Cloudflare, and we do not call Deepgram directly. The open models from MiniMax and DeepSeek run on Fireworks, and we do not send data to those companies directly.

People in your workspace

Owners and admins manage seats. Anyone with an active seat can see the list of seats: name (or email if no name is set), role and user ID. People with access to workspace settings also see email addresses. Owners, admins and a person's managers can read replies that person types in the Service. Other access depends on how an item is shared. New tool entries start as private. Other items can be shared with the whole workspace or more narrowly. People can also see counts of what exists when the content is hidden from them. Nobody sees another person's calendar or Calendar Data.

Legal requests and business changes

We may disclose information if the law requires it, to answer a lawful request, to protect rights or safety, or as part of a sale or merger of our business.

Aggregated/De-Identified Data

We do not sell personal information. That promise does not limit what we do with Aggregated/De-Identified Data, including data that comes from Customer Data or from how people use the Service. We reserve the right to sell it, but we will not sell data that identifies you, a Customer or any particular individual. We never sell Calendar Data, and it is never part of Aggregated/De-Identified Data.

We do not try to re-identify Aggregated/De-Identified Data, except to test whether our de-identification meets legal requirements or where the law requires it. If we disclose or sell it to a third party, we require the recipient to keep and use it in de-identified form and not to try to re-identify it.

AI features

AI features send what you typed or saved in a tool to an AI provider. That can include information about other people, such as candidate resumes and notes on employees. There is no setting to turn AI off for a workspace.

Most prompts go to OpenAI or Fireworks first. If that fails or gives a bad result, the same prompt goes to Google. So such a prompt can reach two AI providers.

Some AI Output is saved or sent with no person checking it. AI pulls details out of voice notes and saves them. AI writes the wording of questions. When someone creates a workspace with a company email address, research starts by itself: the domain becomes the company website, and OpenAI searches the web for it. Addresses on our list of common free email domains do not start this.

You can also look up a company on our front page before you sign up. Cloudflare first checks that you are a person, then OpenAI searches the web for the website you typed. We keep the website and what the research found for about 14 days, and anyone who looks up the same website in the first 7 days sees that same result. We do not tie the lookup to you. If you sign up within 7 days, the result moves into your new workspace.

When you give a written reason for your thumbs up or down, we save it and add it to later AI prompts. Reasons from current owners and admins can also shape company research.

Training and keeping data

We may train and evaluate AI models on Aggregated/De-Identified Data. We do not train AI models of our own on Customer Data in a form that identifies you, a Customer or any particular individual. We never train or evaluate AI models on Calendar Data, in any form. We do not make one promise for all AI providers, because each has its own terms. This table shows what each one says. These are their statements, not ours, and they can change.

Voice

When you use a microphone, your browser streams the audio through our Cloudflare worker to Google for live transcription. Deepgram's model on Cloudflare Workers AI is the backup. We do not store audio. The worker holds up to 30 seconds of audio in memory while it transcribes. What Google keeps depends on its terms.

We save each transcript with who said it. Voice notes on a map are built to be added to, not rewritten. Dictated career journal entries and career notes can be edited or deleted, but a copy saved to your career experience stays. Voice notes can then go to AI, and the result is saved with no person checking it.

Unsaved words are words you have dictated but not yet saved. We hold them per person on Cloudflare, so a dropped session does not lose them. Saving them normally clears them. Words that are not saved are removed about 7 days after the last change, even if nobody opens them. Deleting an account does not remove them at once, so they can stay until then.

Read aloud sends text to DeepInfra, with OpenAI as backup. We do not store that audio either.

Email

We keep the full text of each email we send through Resend in our database for about 7 days after it is delivered, or about 30 days if delivery never finishes. That includes question text, digests and invite emails with their invite links. We also keep a log of each send: address, subject, kind and timing. That log has no time limit. Firebase sends password reset email itself, and we keep no copy of it.

Email through Resend currently comes from an address at notifications.workingattention.com, under the Working Attention name. Where reply by email is not switched on, a reply to our email does not reach the Service, though Resend may still receive it. To stop these emails, see People who answer by email or in Slack below.

Calendar connect

Where switched on, you can connect your own Google Calendar or Microsoft Outlook calendar. This is optional, and everything else in the Service works without it. Each person connects their own calendar, for their own use. Nobody can connect a calendar for someone else.

What we access

From Google, we ask for these permissions:

• openid and userinfo.email: your Google account ID and email address, so we know which account you connected.
• calendar.events.owned: events on the calendars you own. We use only your primary calendar.

From Microsoft, we ask for these permissions:

• offline_access: keeps the connection working without asking you to sign in each time.
• User.Read: your Microsoft account ID and email address (or sign-in name), so we know which account you connected.
• Calendars.ReadWrite: events on your calendars. We use only your default calendar.

When a feature needs your calendar, we read events for the days it asks about. For each event we read its title, start and end time, whether it is all day or cancelled, and whether it marks you busy. From Google we also read whether you declined it. We do not read event descriptions, locations, attachments, or who else is invited.

We also add events you confirm on screen, change them, and remove them. We never change or remove an event we did not add. A demo workspace can read your calendar but never adds anything to it.

How we use it

We use Calendar Data only for these features, and only for you:

• To suggest times that fit around your events, when you book something or move a meeting.
• To add the events you confirm, such as your rhythm of meetings or a call you booked.
• To let the Sunday Reset chat talk through your coming week. It sees the titles and times of that week's events.
• To list other events on the same day in a Meeting Briefing email you get. It shows up to six, each with its time and title.

What we store

• The connection: which service you connected, your account ID and email address there, the permissions you granted, and its status. Plus the sign-in tokens that let us reach your calendar, which we seal as described under How we protect it.
• For each event we added: its title, the calendar's ID for it, the workspace it came from and what in the Service it came from.

We do not store the events we read. We read them live each time a feature needs them, and drop them once it is done.

There are two exceptions:

• A Meeting Briefing email that lists your other events is kept like any email we send. See Email: we keep its full text about 7 days, and Resend holds a copy.
• Before we save a Sunday Reset reply, we swap each event title for the words "a connected event". That swap matches the title's own words. If the AI rewords a title, or repeats a one-word title in different capital letters, that wording can be saved. Your own messages are saved as you typed them.

Who sees it

Only you. Owners, admins, managers and everyone else in your workspace never see your calendar, your connection or Calendar Data. A workspace download leaves it out. Your own account download holds your connection, without its tokens, and the list of events we added.

Who receives it

We pass Calendar Data only to the services that run these features for you:

• Convex, our database, which holds your connection and the list of events we added.
• Cloudflare, which hosts the Service, so Calendar Data passes through it.
• Fireworks, which runs the AI in the Sunday Reset chat.
• TypeSafe, which checks a priority you name in the Sunday Reset against your coming week.
• Resend, which delivers your Meeting Briefing email.
• Sentry, only if an error report holds part of a page or prompt with your calendar in it. See Sentry.

The AI providers among them say they do not train on what we send (see Training and keeping data). Apart from these, we disclose Calendar Data only where the law requires it, or for security, such as looking into abuse. If our business is sold or merged, we pass it on only after asking you first.

What we never do with it

• We never sell Calendar Data, in any form.
• We never use Calendar Data, or anything made from it, to train or improve AI models. That holds even when it is aggregated or de-identified.
• Calendar Data is never part of Aggregated/De-Identified Data.
• We never use it for ads or marketing, and never give it to ad platforms, data brokers or information resellers.
• We never use it to judge credit or for lending.
• People who work for us do not read it, unless you ask us to while we help you, we need to for security, such as looking into a bug or abuse, or the law requires it.

Working Attention's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We hold data from Microsoft to the same rules, and we follow the Microsoft APIs Terms of Use.

How we protect it

We seal your calendar sign-in tokens with AES-256-GCM encryption before we store them. The key is a deployment secret, not stored in the database. All traffic to Google, Microsoft and the Service uses HTTPS. Every read and write runs for the signed-in person only. Before we change or remove an event, we check our record that we added it, and refuse if there is none.

Disconnecting

You can disconnect at any time on the calendar card. We then delete the connection, its tokens and our list of events we added. We delete them even if the calendar service does not answer.

• Google: we also ask Google to end our access. You can check or remove it yourself at https://myaccount.google.com/permissions.
• Microsoft: Microsoft gives us no way to end one app's access. To end it at Microsoft too, remove Working Attention at https://myapps.microsoft.com for a work or school account, or at https://account.live.com/consent/Manage for a personal account.

Events we added stay on your calendar, because they are yours. Remove them on the card before you disconnect, or in your calendar afterwards.

If you remove our access at Google or Microsoft, or it runs out, we delete the tokens. We keep the rest of the connection so the card can ask you to reconnect. Disconnect to delete it. If you connect a different account, we delete our list of events added to the old one.

Deleting your account or a workspace

When you delete your account, we disconnect each calendar as above and delete our list of events we added. If that does not finish, we delete the connection anyway about 5 minutes later. Deleting a workspace deletes the records of events added from that workspace. Your connection stays, because it is yours, not the workspace's.

People who are not users

Some information in the Service is about people who have never signed in, or who deal with it only through email or Slack. This section is for them.

People invited by email

When an owner or admin invites you, we store your email address, the role, who invited you, the workspace, the invite's status and a scrambled form of the link's token. Resend delivers the email. It names the workspace, the person who invited you and the role, and holds your invite link.

The link expires after 14 days. The invite record stays, whether or not you accept. So does the full text of the email, invite link included. The invite email has no unsubscribe link. To raise anything about an invite, write to support@sim-cfo.com.

People named in Customer Data

Authorized Users can write about other people. Examples are employees discussed in one-on-ones, job candidates in the interview tools, and people named in notes, voice notes or as owners of a task. Nothing in the Service tells those people, so they are stored without their knowledge. Their information can also go to AI providers.

If this is you, go first to the Customer, usually your employer or the company you applied to. It decides what goes in the workspace. You can also write to support@sim-cfo.com. The Service gives you no way to see or remove this information yourself.

People who answer by email or in Slack

Questions go only to people with an active seat. If your team answers questions by email or in Slack, this part applies. Both run only where switched on.

• We store up to 20,000 characters of each email reply, with your user ID and the reply's status.
• In Slack we also store your Slack IDs, the messages we send, your replies and your clicks.
• Automatic replies, and email replies that fail our sender check, are logged with no text. So are Slack messages from anyone else in the chat.
• TypeSafe reads your reply. The Service can then record your answer in the workspace with no person checking it, hold it for you to confirm, or pass it to owners and admins. It can also send you an AI-written follow-up, at most one per thread and three per person per day.
• Owners and admins of your workspace may read your replies.
• If a reply is ignored or dismissed, we clear its text and keep the record that it arrived. No other time limit applies to reply text.
• If you delete a Slack reply while it waits, we withdraw it and clear its text. An answer already recorded stays. We do not follow edits.
• A reply sent after your seat is deactivated is stored, then ignored.
• Clearing text does not reach copies that third-party services already hold.

Digest, daily scan and follow-up emails carry one-click unsubscribe. Unsubscribe links do not expire. Unsubscribing stops digests, daily scans and Slack backup email. It does not stop invites or reply follow-ups. Nudges inside the Service keep going, and so do Slack messages where Slack is switched on. The stop stands until you pick an email option in the Service again.

How long we keep information

Unless this section names a limit, we keep information with no time limit, until it is deleted.

Some records are built to be added to, not rewritten: voice notes on a map, question history, version history (which holds past copies of records), replies typed in the Service, and Slack history where switched on. The main exceptions are cleared reply text, sharing changes, and status updates on questions and replies. Apart from deleting a whole account or workspace, the Service has no way to delete saved observations, questions, email records, replies or seats.

The main limits are:

• An invite link expires after 14 days. The invite record stays.
• The full text of a sent email has the limits described under Email.
• Unsaved words are removed about 7 days after the last change, as described under Voice.
• A front-page company lookup made before sign-up is removed about 14 days after it ran.
• Reply text clears when a reply is ignored or dismissed, not on a timer.
• Calendar events we read are not kept. A calendar connection stays until you disconnect or delete your account, as Calendar connect describes.

Deactivating a seat keeps that person's data, except that where reply by email or Slack is switched on, some waiting replies are dismissed and their text is cleared. Where billing is switched on, ending a subscription does not change or remove workspace data, and billing records stay.

Deleting or copying information

You can do all of this yourself in the Service. Deleting is permanent. We offer a download first, and we ask you to type a confirmation and to have signed in recently.

Download a copy

Anyone can download what they can read in the Service, for their whole account from their account settings, or for one workspace from its settings. The download holds only what you can read today, so it leaves out other people's private work. It includes the files you can read in Documents, up to 500 MB, and lists any that did not fit. Some tools also offer partial exports, such as a PDF or Word file.

Delete an account

You can delete your account from your account settings. We remove your private work, your notes and settings, and any workspace only you use. We take your name and email address off your seat in workspaces other people use. We also disconnect any calendar you connected, as Calendar connect describes.

You cannot delete your account until you clear these:

• If you are the only owner of a workspace that has other members, hand it over or delete it.
• If a workspace that would be deleted has a live subscription, cancel it.
• If you created a demo workspace, write to us.

These stay after you delete your account:

• Work you shared stays with the workspace, because it belongs to the Customer. Your name stays where it was written into comments, history or the content itself, and each record can keep an internal ID for your login.
• Messages you sent to your CFO stay with your CFO.
• Your sign-in stays, because the same login opens the SimCFO games. Your game scores and activity stay too. If you sign in again, you start with an empty workspace.
• An email address that bounced or complained stays on its send record, so we do not email it again.
• The log of an invite we sent you keeps your address.

Delete a workspace

An owner can delete a workspace from its settings. Everyone in it loses access at once. Its content, seats, invites and Slack connection are then removed in the background, and a last pass runs about an hour later to catch anything still arriving. A workspace with a live subscription cannot be deleted until the subscription is cancelled. A demo workspace cannot be deleted this way.

Copies a delete does not reach

We cannot promise that every copy is gone. A delete does not reach backups of our database, error logs, or copies held by third-party services, including our email, payment, hosting and AI providers. Those follow each service's own schedule. Stripe keeps payment records, and billing records in our database stay. Our older SimCFO system keeps your user record.

Other ways to remove things

• An owner or admin can deactivate a seat. An admin can deactivate their own seat, and so can an owner if the workspace has another active owner. Other people cannot leave a workspace on their own, short of deleting their account.
• The author of a saved tool run, or an admin, can delete that one run. Some personal tools can delete single entries.
• You can clear your own thumbs up or down and the reason you gave.

If you cannot use these features, or want something they do not cover, write to support@sim-cfo.com. We handle these requests by hand and will respond as the law requires. We may need to check with the Customer.

Security

We check sign-in tokens, and we check for an active seat when someone reads workspace data. The app shows a private draft only to its author. Treat that as a sharing setting, not a security promise. The Service is hosted on the third-party services listed above, so it relies on their security too.

We hold no SOC 2 or ISO certification. We make no promise about uptime or encryption at rest, apart from the calendar tokens described under Calendar connect. This policy is not a data processing agreement. No system is fully secure, and we cannot promise that information will never be exposed.

Cookies and browser storage

Our own code sets no cookies. Your sign-in state lives in browser storage through Firebase, and it stays after you close the tab. Third-party services may set their own cookies or storage. This policy does not list those.

Our code also keeps these kinds of items in your browser:

• your workspace choice
• your last sign-in method
• your theme and sound volume
• your progress and stats in some tools
• your scroll position, for the session only
• an invite token, for the sign-in session only
• a code that moves a front-page company lookup into your new workspace, for up to 7 days
• a marker that stops a reload loop after an update
• a developer switch

Apart from Sentry and Cloudflare Web Analytics, this website has no analytics, and it has no ad trackers. Cloudflare adds its analytics as a page loads. It records the page address, the page you came from, your country, device, browser and load times. The footer's Pricing, FAQ and About links go to the older SimCFO website, which runs Google Analytics and Microsoft Clarity, including session replay. That website has its own privacy policy.

International transfers

We make no promise about the country where information is stored or processed. Sentry receives data in the US. Cloudflare, Google and other third-party services may process information elsewhere. TypeSafe says it hosts in the US.

If you are in the European Economic Area, the UK or Switzerland, your information may reach countries with different privacy laws. This policy does not claim that any particular transfer safeguard applies.

Your rights

If GDPR or UK GDPR applies to you, you can ask for access to your personal information, and ask us to correct it, delete it, restrict its use or give you a portable copy. You can object to how we use it. You can also complain to your data protection regulator.

If a US state privacy law applies to you, you can ask to know what we hold about you, ask us to delete or correct it, and opt out of any sale. We will not treat you differently for using these rights.

To use any of these rights, write to support@sim-cfo.com. We may need to confirm who you are. We will respond as the law requires. Some rights have legal limits, and the section on deleting or copying information explains what stays after a delete.

For Customer Data, the Customer decides what goes in, so you should usually go to the Customer first. In general, the Customer decides why Customer Data is used and we handle it to provide the Service. Our Terms of Service also let us use it to improve the Service and to create Aggregated/De-Identified Data. We decide how we use account, email and technical information and Aggregated/De-Identified Data. The exact legal roles can depend on the facts.

We do not sell personal information, and we do not share it for cross-context advertising. The code of the Service has no ad trackers.

Children

The Service is for business use. It is not for anyone under 18. We do not check age at sign-up. If you think someone under 18 has given us information, write to support@sim-cfo.com.

Changes to this policy

When we change this policy, we post the new version here and change the effective date at the top. We may also tell you by email or in the Service.

Contact us

Another Adventure Studio Inc., 8080 Westpark Drive STE 42019, Houston, TX 77063, USA, support@sim-cfo.com