Privacy Policy

Effective July 14, 2026 · achieve.vision

1. What VISION is

VISION is a personal productivity suite — Horizon (tasks), Luminate (notes), Refract (weekly journaling), Pupil (team management), and Loupe (checklists and inspections) — operated by Andrew Larson as an individual. It is not a commercial service: accounts exist by personal invitation only, and there is no business model attached to your data.

2. What is stored

• Your account: the first name you're registered under.
• Sign-in credentials: the public half of your passkey and a salted hash of your PIN. Biometric data (Face ID, fingerprints) never leaves your own device — VISION never sees or stores it.
• Your content: what you create in each app — Horizon tasks, Luminate notes, Refract journal entries, Pupil team records, and Loupe checklist templates and runs — plus any images, photos, or PDFs you attach or upload in Luminate and Loupe.
• Trusted devices: if you sign in on the VISION app, that device is remembered so it doesn't have to re-authenticate every day. Only a hash of the device's token is stored, alongside the device name you gave it, its operating system version, and when it last opened the app — the token itself exists nowhere but that device's own keychain. Every device is listed under Preferences and can be revoked individually, and one that goes 90 days without opening the app drops off on its own.
• Operational records: a hashed device token and last sign-in date (used to offer PIN sign-in), standard short-lived infrastructure logs used only to keep the service running, and browser-error reports (the technical error message and stack trace when a signed-in page hits a bug, kept for 30 days and used only to find and fix those bugs).

3. How it is protected

• Every account's data is fully separate; the isolation is enforced by the server on every request, not just hidden in the interface.
• Everything you write — text, not the photos/PDFs you upload, see below — is encrypted at rest with AES‑256‑GCM at the application layer, in addition to the infrastructure provider's own storage encryption, and encrypted in transit with TLS.
• Images placed in Luminate notes and Horizon task notes are embedded in the note text itself, so they get the same application-layer encryption as the writing around them.
• Uploaded photos and PDFs (Loupe checklist photos and imported PDF forms, Luminate imported PDF documents) are stored as-is in Cloudflare object storage — protected by that infrastructure's own storage-level encryption and by the same per-account access control as everything else, but not additionally encrypted at the application layer the way text fields are, since that layer only covers the database's text columns.
• Authentication uses passkeys (WebAuthn), which are phishing-resistant and never transmit a reusable secret.
• The one deliberate exception to signed-in-only access is a printable to-do list you explicitly create for sharing: its check-off page is reachable by anyone holding its long, unguessable link (the QR code on the printed sheet), and shows only the items you chose to put on it — nothing else in your account is reachable from it.

4. Where it lives

VISION runs entirely on Cloudflare infrastructure (Workers, D1, R2, Vectorize, and Workers AI), which acts as the hosting and processing provider. R2 is where the photos and PDFs described in section 3 live. Some features process your text with AI models running on that infrastructure: semantic search (used across Horizon and Luminate) uses the BAAI bge‑base‑en‑v1.5 embedding model (@cf/baai/bge-base-en-v1.5), Refract’s weekly-reflection assistant uses OpenAI gpt‑oss‑120b (@cf/openai/gpt-oss-120b), and the structured-extraction features — Horizon’s incoming-email summarizer (which reads mail sent to an account’s own hive address, and only that mail) and AI sort, Luminate’s PDF task scan, and Loupe’s PDF form import — use Meta Llama 4 Scout (@cf/meta/llama-4-scout-17b-16e-instruct), all served by Cloudflare Workers AI. If these models are ever swapped, this section will be updated to match. That processing exists solely to power those features for you; your content is not used to train any model, and no other third party receives your data.

5. Why Cloudflare

Cloudflare is one of the largest infrastructure companies on the internet, and its business is selling infrastructure — not data — so its incentives point the same direction as yours. It holds independent security certifications (SOC 2 Type II, ISO 27001, and ISO 27701 for privacy management), publishes a regular transparency report about government requests, and commits contractually to not selling customer data or using customer content to train AI models. And because of the application-layer encryption described in section 3, the written text sitting in Cloudflare's database is ciphertext, readable only through this application — while uploaded photos/PDFs rely on Cloudflare's own storage-level protections instead, as noted above.

6. How this software was built (AI disclosure)

VISION was predominantly written with the help of artificial intelligence — specifically Anthropic's Claude. AI-written code carries real risks: subtle bugs that mishandle data, security vulnerabilities a casual read won't catch, software quietly drifting from what its author believes it does.

How I manage them:

• Nothing ships on the AI's word. I run every change against a live staging environment before it reaches production, and I test the running software myself rather than accepting descriptions of it.
• The codebase is audited by AI for security flaws. Those adversarial audits have caught and fixed real issues here.
• Security rests on boring, standard, widely reviewed mechanisms — WebAuthn passkeys, AES‑256‑GCM, server-enforced account isolation — never on invented cryptography, precisely because novelty is where AI-written security goes wrong.
• The privacy protections here were deliberately specified. At-rest encryption, the sign-in page's refusal to reveal account names, per-app access controls, this policy, and its model disclosures all exist because I asked for them.
• Design decisions are written down inside the codebase — what was built, why, and which trade-offs I accepted — so my understanding of this software never depends on memory, or on the tool.

7. What is never done with your data

Your data is not sold. It is also not rented, leased, licensed, sublicensed, loaned, traded, bartered, exchanged, brokered, auctioned, syndicated, or resold; not aggregated, bundled, compiled, or packaged into datasets for anyone else; not shared with, disclosed to, or made available to advertisers, ad networks, data brokers, analytics providers, “marketing partners,” or any other “trusted third parties”; not used for advertising, ad targeting, audience building, lookalike modeling, profiling, scoring, market research, or the enrichment of anyone else's records; not used to train AI models; and not monetized through affiliate arrangements, sponsorships, referrals, or any scheme not yet invented — not in identifiable form, not in “anonymized” or “aggregated” form, not for money, not in kind, not ever. It cannot even be transferred as a business asset in a sale, merger, or bankruptcy, because there is no business to sell. No marketing email is sent, because VISION doesn't even have your email address — it was never collected in the first place. The only circumstance under which data would be disclosed to anyone else is a valid legal requirement to do so.

8. Cookies

VISION sets two strictly functional cookies: one that recognizes a device you've signed in on (so PIN sign-in can be offered) and one short-lived cookie used during the sign-in handshake itself. Neither tracks you, and there are no third-party cookies of any kind.

9. Retention and deletion

Your content is kept until you delete it. Deleting an item removes it from the live database immediately (short-lived infrastructure backups age out on their own). If your account is removed, everything associated with it — content, credentials, and settings — is permanently deleted. You can also request deletion or a copy of your data at any time using the contact below.

10. Changes and contact

If this policy ever changes, the effective date above will change with it. Questions, deletion requests, or anything else: privacy_concerns@andrewlarson.org.

11. CCPA and similar laws

VISION is not subject to the California Consumer Privacy Act (CCPA, as amended by the CPRA). The CCPA applies only to a “business” as defined in Cal. Civ. Code § 1798.140(d): a for-profit entity doing business in California that meets at least one of three thresholds:

• annual gross revenues over $25 million;
• annually buying, selling, or sharing the personal information of 100,000 or more consumers or households; or
• deriving 50% or more of annual revenue from selling or sharing consumers' personal information.

VISION meets none of these: it is operated by an individual, not a for-profit entity; it has no revenue; it serves a small number of personally invited users; and it never buys, sells, or shares personal information. Similar state privacy laws carry comparable business definitions and thresholds and do not apply either. The core rights those laws grant — access to your data, deletion, and no sale — are provided here regardless (sections 7, 9, and 10).