Privacy notice
Private cloud work should stay private.
This notice explains what the project website and the planned hosted bridge process, why the data is needed, where it goes, and how users can disconnect and request deletion.
Last updated · 20 August 2026The website and open-source release are available as a beta. Public hosted account registration is not open yet. The production bridge hosting and OAuth providers, their regions, retention periods, and transfer safeguards will be named here before the service accepts users.
1. Controller and contact
The project is maintained by v4t0r. For the planned project-operated hosted service, v4t0r is the controller for bridge account and connection data. Use the private project channel linked on the Support page for privacy requests. Do not put personal data or credentials in a public GitHub issue.
A separately self-hosted installation has its own operator. That operator—not this project maintainer—decides its hosting, logs, users, retention, and legal basis and must provide its own notice.
2. Website data
This website sets no non-essential cookies, runs no advertising or behavioral analytics, and contains no account or contact form. The website is delivered through OpenAI Sites on Cloudflare infrastructure. Those providers may process IP address, timestamp, requested URL, user agent, and security events to deliver and protect the site under their own published privacy terms.
3. Bridge account and connection data
The hosted bridge needs the following limited data to operate:
- verified OAuth issuer, subject, client identifier, and scopes; the issuer and subject are converted to a pseudonymous tenant ID;
- Nextcloud base URL, Nextcloud login name, selected workspace root, connection status, opaque identifiers, and timestamps;
- short-lived Login Flow endpoint and poll secret while account connection is pending;
- a Nextcloud-generated app password encrypted separately from connection metadata; and
- optional household display name, root-relative invoice paths, and default currency.
The bridge does not ask for or store the user's Nextcloud account password, recovery codes, or ChatGPT password.
4. File and invoice content
The bridge retrieves only content requested through an MCP tool and processes it transiently to produce the requested result. Tool results are returned to ChatGPT or Codex, where OpenAI's terms and privacy controls apply. The bridge does not use file content to train models or build advertising profiles.
Household invoice extraction is bounded. Raw extracted text is not stored in the bridge database. When a user explicitly saves a review, the redacted structured JSON report is written to that user's own Nextcloud workspace. The user controls that file through Nextcloud.
5. Purposes and legal bases
- provide the requested account connection and file tools under the service terms (GDPR Article 6(1)(b));
- protect tenants, credentials, infrastructure, and the project from abuse and security incidents (Article 6(1)(f)); and
- comply with binding legal obligations where they apply (Article 6(1)(c)).
The app does not make a solely automated decision with legal or similarly significant effects. Invoice checks are decision support for a human user.
6. Retention and deletion
- Pending Login Flows expire after their short authorization window and are removed by maintenance cleanup.
- Connection metadata and its encrypted app password remain until the user disconnects, the account is deleted, or retention is no longer necessary.
- Disconnect removes local connection data and attempts to revoke the generated app password at Nextcloud. Orphaned encrypted records are removed after a short recovery grace period.
- Saved review reports remain in the user's Nextcloud until the user or Nextcloud administrator deletes them.
Application access logging is disabled by default. Limited infrastructure security logs, if supplied by the future production bridge and OAuth providers, will be retained only for the published operational period and then deleted or aggregated.
7. Recipients and transfers
Data is sent only where needed to the user's Nextcloud, the user's selected OpenAI product, the bridge OAuth provider, and infrastructure providers operating the service. No personal data is sold. Final provider identities, processing regions, subprocessors, and any international-transfer safeguards are a public-launch gate and will be listed here before hosted registration opens.
8. Your choices and rights
Users can change the workspace root, disconnect Nextcloud, delete saved reports in Nextcloud, and revoke the bridge app password from Nextcloud security settings. Depending on applicable law, users may also request access, correction, deletion, restriction, portability, or object to processing, and may complain to their competent data protection authority.
Use the private contact channel on the Support page. Identity may need to be verified before account data is disclosed or deleted.
9. Security and changes
Security measures include OAuth verification, request-scoped tenant context, encrypted credentials, root-bound paths, transfer limits, network egress policy, rate limits, and secret-free application responses. No system is risk-free. Material changes to this notice will receive a new date and will be shown before continued hosted use where required.