Privacy Policy
Last updated: October 30, 2026
Worklog Calendar is a private work calendar app for work entries, reminders, income/expense ledger records, files, reports, and internal team messages.
Controller and contact
Application controller: Worklogs. For privacy questions or data requests, contact [email protected].
Structured contact, financial and technical data
Personnel, partner and company-profile records can include explicitly entered phone numbers, physical addresses, tax identifiers and bank/IBAN details. Orders and financial imports may contain purchase records. Worklogs retains accepted contact connections, group membership and sharing relationships; it does not import the phone address book. Retained technical data includes account and push-device identifiers, action/consent events and operational request-duration/usage diagnostics. These support application functionality, delivery, security and support. Optional Athena memory uses permitted conversation text and reviewed preferences to personalize later replies, not to grant new permissions.
Data collected
The app stores email address, display name, user role, calendar work entries, notes, tags, links, files, tasks, payment/expense ledger records, proof files, personnel records, attendance/project work records, company asset records, company work diaries, ERGANI submission payloads/responses/protocols/PDF files, internal messages, Meeting titles/participants/joined state/timestamps, reminder settings, chosen and last detected device time zone, push subscriptions, sessions, audit/activity logs, and technical server logs from the hosting infrastructure. On iPhone, microphone permission may be requested after sign-in to enable incoming user calls. Microphone access is used for calls and optional Athena voice features; camera access is requested when starting video or deliberately capturing a photo. Athena media processing is described below.
Contractor registration documents
The Company > Contractor registration section stores uploaded certificates, category, optional person or project reference, expiry date, and previous versions. The company owner and accounts granted access to that section can view them. Email and push reminders about document expiry contain the document category, reference and date; the uploaded file itself is not included.
How data is used
Data is used for sign-in, assigning and watching work entries, reports, personnel/project operations, retaining any historical ERGANI records, email and push reminders, user-to-user messages, optional live video calls, security, audit trail, and support. Worklogs does not record or store video call audio/video streams.
Sharing and processors
Data is hosted on DigitalOcean App Platform and Managed PostgreSQL. Transactional emails are sent through Resend. Browser push notifications are delivered through the relevant browser or device push service. Production traffic may pass through the hosting platform's CDN or security layer.
User-to-user voice calls
Direct audio calls use the microphone only after the recipient accepts or the caller starts the call. On an iPhone with microphone permission, incoming calls can appear while Worklogs is closed or the phone is locked, provided the phone has internet and notifications are allowed. PushKit/CallKit displays the caller name; WebRTC connects the devices directly or through the Worklogs TURN relay. The app stores call status and signaling needed to connect, but does not record or retain the call audio. This feature does not send audio to OpenAI.
Athena (optional AI)
Athena is disabled until you enable its single access control and agree to OpenAI processing your requests and relevant Worklogs data. That activation allows Athena to read calendar entries you can see, including entries explicitly assigned or shared with you, and allowlisted fields in the company, financial and personnel sections you can access, including names and email addresses of watchers on projects you can view, plus names, email addresses and current Worklogs presence from peers in your Contacts menu. When you ask about Messages, Athena can read text in direct and group threads you can currently access and attachment metadata; when you explicitly request one visible saved attachment and enable file processing, Athena may extract its contents through OpenAI. Reading does not mark messages as read. When asked about Worklogs Meetings, Athena can read title, status, dates, creator name, participant names and joined/media state only for Meetings you participate in, without joining or starting a call. If you ask to create a Worklogs Meeting, Athena prepares a preview of its title and exact connected recipients; only your separate Create Meeting confirmation creates it and sends invitations, without joining audio or video. If you ask to end an existing Worklogs Meeting you created, Athena checks its current participants and prepares closure; only your separate End Meeting confirmation closes it for everyone. If you ask to create a Worklogs group chat, Athena prepares a preview of its name and exact connected members; only your separate Create group confirmation creates it, without sending a message. For an existing Worklogs group, Athena can read the members you can see and prepare removal of a member if you own the group, or your own departure; only your separate confirmation changes access. Where supported by the application and your role, Athena may prepare changes for your review; every change needs a field-level preview and your separate confirmation before saving. Only relevant permitted fields are sent to the OpenAI API. Entries you cannot see, unrelated users' profiles, global admin access, credentials and files you have not asked Athena to read are excluded. This does not grant unrestricted menu actions or automatic sending. API content is not used for model training by default. Responses are requested with storage disabled; this does not remove provider abuse-monitoring retention, normally up to 30 days subject to the provider's exceptions. Live tool context expires after 30 minutes of inactivity and is cleared on account switching, sign-out or permission changes. Separate, initially disabled choices allow Worklogs to retain conversation text and explicitly reviewed personal notes until you delete them, disable memory or delete your account, without an age or note-count storage cap. Notes remain until edited, deleted, disabled or account deletion. Relevant permitted notes and conversation excerpts are sent with later OpenAI requests for personalization, not model training or new permissions. You can inspect, edit and delete notes in Memory. New conversation deletes stored conversation text but keeps notes. Editing or deleting an existing note also clears stored conversation text; disabling notes or Athena clears both. Account switching restores only the active account's authorized text, never old tool permissions or approvals. File-derived conversations remain transient and are excluded from this saved memory. Proposed, confirmed, cancelled and undone actions, including before/after values, are retained in a private action audit and removed on account deletion. Disabling Athena stops new AI requests; it does not erase the action audit. If you report an Athena response, the selected question and answer, your reason and optional note are stored for review by authorized Worklogs moderators and removed on account deletion. With Athena active, selecting a file/photo or using a voice action requests that specific processing: selected files/photos go to a tool-free OpenAI extractor and recordings to OpenAI transcription. These actions do not start background recording or scan other files. Existing disabled media choices are enabled only when you use the corresponding action or save the unified Athena activation. Voice transcripts remain editable before Send; spoken replies use a disclosed synthetic AI voice and send the selected reply text to OpenAI speech generation. Uploads alone never create records. Raw files selected for Athena extraction are held temporarily, not automatically saved as attachments. If you separately confirm a file save, replacement or send, the original file is retained in the corresponding Worklogs record or message. Existing saved files remain stored when Athena reads them. Voice recordings and generated audio are processed transiently and are not persisted by Worklogs. Structured extracted facts are usable for ten minutes in the current conversation; answers derived from selected files remain only in the temporary session until it expires or is cleared, and confirmed record content remains in normal application records and the action audit. Removing a file clears server conversation history and invalidates related pending proposals. Content extraction supports JPG/PNG/WebP, PDF, DOCX, XLSX and UTF-8 TXT/CSV/XML/JSON/MD up to 25 MB per file. Other selected formats can be stored or sent after review without AI content extraction; voice recordings remain limited to 5 MB; extraction may be partial and is not an authoritative financial report. Provider retention rules also apply to these optional media requests.
Athena live web and saved files
When you ask Athena to verify public current information, it can send a standalone search query to OpenAI web search and show clickable public sources. The search request does not include Worklogs records, personal notes or uploaded file contents. When file processing is enabled and you request a specific saved file you can currently access, Worklogs sends that file to OpenAI for isolated fact extraction; stored files up to 25 MB are supported for the current accepted formats, and extraction may be partial. External folder references and link-only documents are not uploaded file contents. A request to add, replace or delete an eligible Worklogs file produces a preview; only your separate Confirm changes storage. Current file access and ownership are checked again at confirmation.
Athena live voice calls
Optional live voice sends microphone audio and generated speech through OpenAI Realtime. A spoken request about Worklogs can be forwarded to the account's Athena assistant, which may read only data covered by the single Athena activation and current account permissions; that request and authorized results are processed by OpenAI. Manual calls start only when you choose the voice action with Athena active. Incoming iPhone reminder calls require explicit selection on your own reminder, active Athena, current calendar access and identity verification before account access. They are available by default for selected reminders, and a separate Calls menu can pause them all without changing the individual reminders. Quiet hours default to 22:00-08:00 in your selected or detected device time zone. CallKit may show Athena on a locked phone, but the reminder title is withheld until the user enters a six-digit PIN on the call keypad or confirms identity inside the signed-in app. Worklogs stores a salted hash of the call PIN, call state and audit metadata; it does not store PIN digits or call audio or include the PIN in OpenAI API requests. Voice requests can prepare a draft but cannot save a record; changes require review and confirmation in Athena chat. Reviewed voice requests follow the user's Athena conversation-memory setting. OpenAI provider retention rules apply.
Message and user reports
If you report another user's visible message, a contact or a fellow group member in Worklogs, the app stores your reason and optional note, a server-selected copy of that message text and attachment names/metadata or the selected contact name/email, and review status. Only authorized super admins can review these reports. Raw attachment contents are not copied into a report. Reports involving an account are removed when that account is deleted. Reporting does not send message content to OpenAI.
Communication rules acceptance
Before posting message content, the app records the communication-policy version and time you explicitly accepted. This is one acceptance per account and policy version, not per message. The record is removed on account deletion. Reading existing messages, reporting content and blocking a contact do not require this acceptance.
Personal API connections
You may add your own OpenAI API key for Athena and your own AADE myDATA and optional Epsilon Digital API credentials for company financial sync. Worklogs encrypts these credentials at rest and uses them on the server only for your account's provider requests. A short-lived OpenAI voice session token may be sent to your device for a voice call; the standard API key is not sent to the browser. Existing specifically authorized accounts may use the operator's Athena key until they replace it with their own. Credential status is visible without revealing secret values. Removing a connection stops its use in Worklogs but does not revoke the key at its provider. Account deletion removes stored personal credentials.
ChatGPT plugin (optional)
You can separately connect a Worklogs account to ChatGPT using OAuth. ChatGPT can request only the Worklogs tools and data allowed by that account's current role and sharing permissions. Depending on your request, the plugin can return calendar entry titles and short note previews for a requested day, plus full notes and detailed schedule lines for a requested individual entry, task text, project and worker attendance, work-diary items, service and equipment names, payment, order and cheque dates and amounts, financial and report totals, measurement revision summaries, visible contact, user and Meeting names, an explicitly requested visible company partner phone number, reminder dates and preferences, and aggregate administration counts. Each tool returns only its stated fields. Its projected fields exclude tax and social-security identifier fields, bank details, message bodies, attachments and credentials. Direct requests for AFM, AMKA or other government identifiers receive a clear refusal without record lookup. Free-form titles, notes, schedule lines, tasks and work-diary items partially mask recognizable tax, social-security and identity-document numbers, and omit bank/payment details, access secrets and email addresses. Phone numbers are omitted from general reads but can be returned from a specifically requested visible entry, task, work diary or company partner. Decimal monetary amounts remain visible. Calendar reads show a notice when their text is masked or omitted. Tool results are returned to ChatGPT when you invoke the plugin. ChatGPT conversations and files uploaded directly there are governed by your ChatGPT settings and OpenAI terms. Worklogs stores hashed connection tokens (access tokens expire after one hour and refresh tokens after 30 days, unless rotated) and action proposals (pending for up to 25 minutes; records older than 30 days are removed during the next authentication cleanup). Proposed calendar text with detectable government identifiers, bank/payment details or access secrets is rejected before a proposal is saved. Worklogs does not receive your ChatGPT password. Every proposed Worklogs change needs a separate confirmation in Worklogs. You can disconnect from Account > ChatGPT connections, and changing your Worklogs password revokes the link. Account deletion removes connection tokens and proposals.
Security
The production app uses HTTPS, session cookies, hashed passwords, scoped access control, audit logs, CSP/HSTS/security headers, and managed PostgreSQL persistence.
Retention and deletion
Operational data is retained while the account is active or as needed for operational, security, legal, accounting, or audit reasons. Signed-in users can delete their account and related personal data directly inside the app after confirming the action. The account is disabled/anonymized and personal sessions, push subscriptions, messages, and user-owned personal content are cleaned, with only limited records retained where legally, operationally, or audit-wise required.
Children
The app is intended for professional and organizational use and is not directed to children.