Privacy Policy

Account information: your name, email address and a securely hashed password when you create an account.

Organization and project data: the information you and your team enter to use the service — organizations, projects, contract values, transactions, income and expenses, clients, categories and notes.

Uploaded files: receipts, invoices and project photos you attach to transactions or projects.

Receipts sent by WhatsApp: if you link your WhatsApp number, the phone number you link, the messages and captions you send to Obra's business number, and the photos or documents they contain. These messages reach us through Meta's WhatsApp Cloud API.

Receipts sent by email: if you email a receipt to your organization's capture address, the sender address, subject line and attachments. These emails reach us through our email provider's inbound service, and only messages from members of your organization are accepted.

Technical data: standard server logs (IP address, browser type, pages requested) used for security and reliability.

Product usage measurement: to understand whether Obra is working for your organization, we record when key product steps first happen (for example, the first project, the first recorded cost, or the first time a project's financial state is viewed) and, per project and week, whether financial information was kept up to date. These records contain dates and yes/no facts only — never amounts — they are stored with your organization's data, deleted with it, and are not included in your data export because they are our measurements about product usage rather than records you created.

Analytics and product improvement: to understand how Obra is used and to find and fix usability problems, we use a product-analytics service. For visitors who are not signed in this activity is anonymous; once you sign in, we associate it with your account. We collect the pages you view and the actions you take in the app; page addresses with query strings removed and any security tokens stripped out; your browser and device type; an approximate region derived from your IP address (the IP address itself is not stored); and, for signed-in users, your account identifier, your email address and your organization's name. We also record masked session replays — a playback of a visit in which all text and form inputs are hidden — to find confusing parts of the interface. When error reporting is enabled, we also send diagnostic details about errors, including error messages, technical stack traces and request context, so we can fix them. This information is processed in the United States. We do not collect the in-app analytics or session replays on our own internal staff accounts, or on sign-in, invitation and similar links; server-side error diagnostics may still be recorded for any account, including staff, to keep the service reliable.

Marketing-site statistics: on our public marketing pages — and only for visitors who are not signed in — we use a cookieless statistics service to count visits and see which pages and referrers bring people to Obra. It sets no cookies, does not follow you across other sites, and does not store your IP address; it uses it only briefly to distinguish visits and derive a country-level location, on servers located in the European Union.

Files you upload are stored with a cloud object-storage provider. Private files — such as receipts and transaction documents — are only ever served through authenticated, authorized links. Images belonging to projects you explicitly publish to your public portfolio are served through a content delivery network.

When you attach a receipt or invoice to a transaction — or send one by WhatsApp or email — the document is sent to Obra's configured AI receipt-processing provider (Anthropic or OpenAI) to extract the amount, date, vendor and a suggested category from your own category list. Extracted values are held in your private capture queue for your review; nothing becomes part of your records until you confirm it, and you can discard a capture at any time. The selected provider processes this data on our behalf as a service provider solely to provide receipt extraction.

These providers process this data in the United States, and under our agreements with them, documents and data sent through their business APIs are not used to train their models.

We use a session cookie to keep you signed in and to protect against cross-site request forgery, a locale cookie to remember your language, and your browser's local storage to remember your theme preference. We also use cookies and local storage set by our product-analytics provider to recognize your device across visits so we can measure how Obra is used, as described under Analytics and product improvement above. Our marketing-site statistics service sets no cookies at all. We do not use advertising cookies or share your activity with advertising networks, and we never sell your data.

Projects appear on your public portfolio page only when you explicitly mark them as public. Financial details — costs, income and every derived figure — are never displayed publicly. You can unpublish a project at any time.

Running your business in Obra can involve recording information about other people — your clients, vendors and team members, such as names and contact details. Your organization is responsible for having the right to record that information, and we process it on your organization's behalf, only as described in this policy, to provide the service. If someone contacts us about records your organization keeps in Obra, we will refer them to you, because those records belong to your organization.

We use your information to provide and improve the service, to respond to support requests, to keep the service secure, to process billing, and to send essential service communications. Service communications include summaries derived from your organization's own data — such as the weekly financial digest — and you can turn those summaries off at any time. We do not use your project or financial data for marketing.

We share data only with service providers who help us run Obra, and only to the extent needed to provide the service: hosting, database and operational-monitoring infrastructure located in the United States; a cloud storage provider for the files you upload; Anthropic or OpenAI for receipt extraction; an email provider for sending and receiving email; Meta's WhatsApp Cloud API for the WhatsApp channel; the analytics services described above; Stripe for payment processing; and an error-monitoring service, when error reporting is enabled. The WhatsApp channel is also subject to Meta's own WhatsApp terms and privacy policy. We may also disclose information when required by law or to protect the service, our customers or others. We never sell personal data.

We keep your data for as long as your account is active. You can download a structured export of your organization's data (CSV files; uploaded files are listed with download links but not bundled) and delete your organization or account yourself, at any time, from Settings. Deletion removes your data from the live application immediately; residual copies in our deletion-recovery storage and backups are purged within approximately 90 days, and anonymized product feedback may be retained. Our payment processor deletes stored payment details when your organization is deleted, keeping only what it must for financial record-keeping. When you delete your account or organization, we also request erasure of the related analytics and session-replay data from our analytics provider; because our provider processes these deletions asynchronously — and a device that was offline at the time may send a little further activity afterward — full removal can take additional time, and diagnostic error records or analytics that have already been stripped of account identifiers may remain for our provider's standard retention period. You can also email support@tryobra.com and we will act on your request within 30 days, except where we must retain records to meet legal obligations.

All traffic to Obra is encrypted in transit. Passwords are stored using strong one-way hashing, and access to production data is restricted. No system is perfectly secure, but we work to protect your information with industry-standard measures.

Obra is operated from the United States, and our infrastructure and service providers are primarily located there (our marketing-site statistics are processed in the European Union, as described above). By using Obra you agree that your information is transferred to and processed in the United States. If you use Obra from outside the United States, you do so on your own initiative and are responsible for complying with your local laws.

Obra is a business tool and requires users to be at least 18 years old. It is not directed at children, and we do not knowingly collect personal information from children under 13; if we learn that we have, we will delete it.

We give every customer the same controls, wherever they live: you can access, correct, export and delete your personal information. You can export and delete your data directly from Settings; for anything else, email support@tryobra.com and we will respond within 30 days. We do not sell personal information, we do not share it for targeted advertising, and we will never treat you differently for exercising these rights.

We may update this policy from time to time. If we make material changes we will notify you by email or through the service before the changes take effect.

My Tiny Rocket LLC · support@tryobra.com. We're happy to answer any question about how your data is handled.