Privacy Policy

Coffee is for Trackers ("the App", "we", "us") is a private sales activity and lead tracking tool built for individual mortgage professionals. This policy describes what data we collect, how it is stored, and your rights regarding that data.

1. Who This App Is For

This application is intended for use by authorized users only — specifically licensed mortgage loan officers who have been granted access. It is not a public-facing consumer service.

2. Information We Collect

When you sign in and use the App, the following information may be stored:

• Google account info — your name and email address, obtained through Google Sign-In at authentication
• Profile data — name, job title, phone, NMLS number, company, and time zone that you enter manually
• Lead records — names, phone numbers, email addresses, and notes for mortgage leads you enter
• Contact records — referral partners, COI contacts, clients, and related relationship data you enter
• Activity data — weekly sales activity counts (dials, meetings, deals, etc.) you log
• Deal and commission records — loan details, deal stages, and commission estimates you enter
• Notes and follow-up data — call notes, follow-up dates, and calendar event references

3. How Your Data Is Stored

All data is stored in Firebase Realtime Database, a cloud database service operated by Google LLC. Your data is organized by your unique Firebase user ID and is not accessible to other users of the App.

Firebase is subject to Google's security and privacy standards. For more information, see Firebase's Privacy Policy.

4. Google Services Integration

With your explicit authorization, the App may access:

• Google Calendar — to create follow-up reminder events on your behalf. Requires the calendar.events scope.
• Google Contacts — to push new contacts you add in the App to your Google Contacts. Requires the contacts scope.

These permissions are connected once through the App's Settings screen (not at sign-in) and can be revoked at any time through your Google Account permissions page. To enable Google Calendar and Google Contacts syncing to run in the background (so follow-up events and new/edited contacts sync automatically, not only while you're actively signed in), a Google-issued refresh token for each scope is stored securely in our backend, tied to your account. These tokens are used solely to create and update your own Google Calendar events and Google Contacts, and can be revoked at any time from your Google Account permissions page or by disconnecting Google Calendar/Contacts in the App's settings, which deletes the corresponding stored token.

5. How We Use Your Data

Your data is used solely to power the features of this App — tracking leads, contacts, activity, and deals. We do not:

• Sell, rent, or share your data with third parties
• Use your data for advertising or marketing purposes
• Access your data for any purpose other than providing the App's functionality
• Aggregate your data with other users' data for any commercial purpose

6. Data Retention and Deletion

Your data remains in Firebase until you request deletion. To delete your account data, contact us at the address below and we will remove it from the database within 30 days.

7. Cookies and Local Storage

The App uses localStorage and sessionStorage in your browser to store preferences (such as theme and AI provider settings) and temporary session tokens. No third-party tracking cookies are used.

8. Security

Access to your data requires authentication via Google Sign-In. Firebase security rules are configured so that each user can only read and write their own data. We do not have access to your Google account password.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date above. Continued use of the App after changes constitutes acceptance of the updated policy.

10. Contact

If you have questions about this Privacy Policy or your data, contact us at:
tracker@coffeeisfortrackers.com

---

Coffee is for Trackers is a private application. Unauthorized access is prohibited.