Privacy Policy

Effective July 17, 2026

Calibrated Risk ("we", "us") provides a data-driven job hazard analysis (JHA) tool through our website at calibratedrisk.io and our mobile apps. This policy explains what we collect, why, who processes it on our behalf, and the choices you have. We do not sell your personal information, and we do not use advertising or third-party tracking or analytics SDKs.

Information we collect

Account information — your email address, your name, and a securely hashed password. For organization accounts, your organization name and your role (admin or member).
Content you create — the job descriptions, industry codes, and work-condition details you enter for an analysis; the resulting hazard assessments you save (JHAs); and, if you use them, digital signatures (signer name, title, and the signature image).
Usage counters — the number of analyses you run, so we can apply plan limits.
Billing information — your subscription plan and status. We do not receive or store your card number or payment credentials; those are handled entirely by our payment processors (below).

We do not request access to your device contacts, photos, location, or camera, and the apps contain no advertising identifiers.

How we use it

To create and operate your account and keep you signed in.
To generate hazard analyses from the details you enter and to store the JHAs you choose to save.
To enforce plan limits and process subscriptions.
To send transactional email you request, such as password resets.
To secure the service, debug problems, and comply with legal obligations.

Service providers

We share the minimum data needed with providers that process it on our behalf:

Provider	Purpose	Data
Anthropic (Claude API)	Generating the hazard analysis	The job/work-condition details you submit for an analysis
Stripe	Payment processing (web)	Billing details you enter with Stripe; we receive only subscription status/identifiers
Apple / Google	Payment processing (in-app purchases)	Handled by the App Store / Google Play; we receive only a subscription identifier and status
Resend	Transactional email (e.g. password resets)	Your email address and the message contents
DigitalOcean	Application hosting	Data stored by the service, hosted in the United States

Hazard analyses are grounded in public OSHA enforcement data, which contains no information about you.

Data retention and deletion

We keep your information for as long as your account is active. You can permanently delete your account and all associated data at any time — from Settings → Delete Account in the mobile apps, or the Account page on the web. See our account deletion instructions for details. Deletion is immediate and cannot be undone.

Security

Passwords are stored only as bcrypt hashes, all traffic is encrypted over HTTPS, and session and password-reset tokens are stored hashed so a database copy cannot be replayed. No system is perfectly secure, but we work to protect your data using industry-standard measures.

Children

Calibrated Risk is a workplace-safety tool intended for use by adults in a professional setting. It is not directed to children, and we do not knowingly collect information from anyone under 16.

Your rights

You can access and update your name and email in the app, delete your account and data yourself, and contact us with any privacy request. Depending on where you live, you may have additional rights (such as access, correction, or deletion) under laws like the GDPR or CCPA; email us to exercise them.

Changes

If we make material changes to this policy we will update the effective date above and, where appropriate, notify you.

Contact

Questions or requests: support@calibratedrisk.io.