Privacy policy
Last updated: October 29, 2026. CardTotals is run by Laniakea Ventures LLC ("we", "us").
Short version: we use your photos to read the times, then let them go. We don't save the photos or the table of hours. We keep only what we need to count free photos, run subscriptions and send sign-in links. No ads and no tracking scripts, and we don't sell your data.
Timecard photos
- Before upload, your browser shrinks each photo. It is then sent over an encrypted (HTTPS) connection to our server, which runs on Cloudflare.
- The server passes it to Cloudflare Workers AI, which reads the names, dates and times. Our code doesn't write the photo to a database, file storage or our logs. Once the answer is sent back to you, it's gone from our side.
- Cloudflare says it doesn't keep Workers AI inputs or outputs once a request is done, except in limited cases such as legal obligations. It also says it doesn't use them to train AI models.
- The names, dates and times we read come back to your browser and stay in that tab. We don't store them. Close or reload the tab and they're gone unless you copied them or downloaded the CSV.
- Timecards contain your employees' names and hours. Only upload cards you're allowed to handle for your business.
What we store
| What | Why | How long |
|---|---|---|
A random ID in a cookie (ct_anon), plus a keyed one-way hash of your IP address. We don't store the IP itself. Each comes with a count of free photos used and the first and last time we saw it. | To count your 5 free photos, including after browser data is cleared. | The cookie lasts up to 400 days. The counts aren't deleted automatically yet. Email us and we'll delete yours. |
| Your email, Stripe customer and subscription IDs, subscription status and this month's photo count. | To know you're a subscriber and apply the 200-photo monthly limit. | While you're a customer. After that we keep them as long as we need them for tax and accounting records, or delete them when you ask if we're allowed to. |
A sign-in cookie (ct_sess) with your email and Stripe customer ID, signed so it can't be altered. | To keep you signed in on that device. | 30 days, or until you sign out. |
| Sign-in link requests: your email, a one-way hash of the link (not the link itself), a hash of your IP and the time. | To make one-time sign-in links work and to limit abuse. | Links expire after 15 minutes. The records aren't deleted automatically yet. Email us and we'll delete yours. |
| Your overtime settings (weekly and daily limits, workweek start, 12- or 24-hour time). | So you don't have to set them again. | In your browser's local storage, on your device only. |
Payments
Payments are handled by Stripe. We never see or store your card number. Stripe shares your email, customer ID and subscription status with us. See Stripe's privacy policy.
We email you only to send sign-in links you ask for, plus (only if you opt in) a short series of tips. Emails are sent through Resend. Every non-essential email has an unsubscribe link.
Service providers
- Cloudflare: hosting, database and AI processing. Cloudflare may keep standard request logs (such as IP address, page and time) under its own policies.
- Stripe: payments.
- Resend: sending sign-in links and opted-in emails.
We don't use advertising or analytics trackers, and we don't sell or share personal information for advertising.
Your choices
- Cancel your subscription anytime from the link in your Stripe receipt email.
- Ask us to see or delete the data we hold about you: email [email protected]. We'll answer within 30 days. Some payment records may have to be kept for tax and accounting reasons.
- Clearing your browser data removes your settings and the sign-in cookie. The free-photo count stays on our side so the free tier can't be reset.
Children
CardTotals is a tool for businesses and isn't meant for children under 16.
Changes
If we change this policy, we'll update the date above. If a change matters, we'll email subscribers before it takes effect.
Contact
Laniakea Ventures LLC, 303 W Madison St Ste 1000, Chicago, IL 60606. Email: [email protected].