Privacy Policy

Who we are

JDVapor Land (joshdluehosh.com) is built and run by Josh Dluehosh, an individual developer in Arizona, USA. It includes the apps Staff Forge, WriteWithMe and ChadGPT, plus games and community pages. “We” and “us” in this policy mean Josh. Questions or requests: joshdluehosh@gmail.com.

What we collect

Your account. Email address, username, and a password stored only as a one-way hash (Argon2) — we can't see your password. Whether your email is verified, and your plan or subscription status.

What you create in the apps. Everything you write or upload is stored so the app can show it back to you:

• Staff Forge: your AI employees and their settings, chat messages, tasks, documents and their revision history, clients and projects, reminders, and email sent or received by your employees.
• WriteWithMe: your workbooks and uploaded files. A workbook you choose to share can be opened by signed-in people who have the link.
• ChadGPT: your conversations.
• The site's public chat assistant: your messages are processed to answer you, with a daily limit per visitor.
• Games: your saved progress.
• Bookings and the newsletter: the name, email and notes you enter.
• Post-It board and ScavChat: what you post is public to other visitors. Images are hosted by Cloudinary.

Payments. Card payments are handled entirely by Stripe. We never see or store your card number — we keep only your Stripe customer and subscription IDs, payment amounts, and receipts.

Usage limits and security. To limit abuse of free features we count requests per browser session or per network address. Network addresses are stored only as a one-way hash, never in raw form. We also keep error logs from AI requests to fix problems, and an audit log of admin actions on accounts.

Analytics. We use Vercel Web Analytics, which counts page views without cookies and without identifying you.

Cookies and local storage. We use a sign-in session cookie. Your browser's local storage keeps a few settings and a random guest ID used to count free-trial uses. We don't use advertising or cross-site tracking cookies.

Accounts you connect to Staff Forge

Staff Forge lets you give your AI employees access to outside accounts so they can do work for you. Nothing is connected unless you choose to connect it, and you decide which employees may use each account.

• Google — see the next section.
• Instagram (through Meta's official API): your account name, an access token, the reply rules you set, and the comments and messages your employees read or answer for you. Posts and replies are made only within the rules you approve.
• Website logins you save for an employee to use in a secure browser: the site, username, password and any authenticator secret. These are encrypted (AES-256-GCM) before they are stored, are never shown to the AI, and are only used to sign in to the sites you listed. Actions that can't be undone (like purchases) require your approval first.

All access tokens and saved passwords are encrypted at rest. You can disconnect any account or delete any saved login at any time in Forge Settings → Connected accounts, which deletes the stored token or password.

Google user data

If you connect a Google account, Staff Forge asks only for the access it needs:

• Your name and email address (openid, email) — to show which Google account is connected.
• Only the Google Sheets, Docs and Drive files you pick (drive.file) — your employees can read and edit those files, and create new ones, when you ask them to. We can't see any other files in your Drive.
• Sending email as you (gmail.send) — only if you separately click “Allow sending email from this Gmail”. Employees can then send email from your address to clients you've assigned them. We cannot read, search or delete anything in your inbox.

How it's used. Google data is used only to do what you ask — for example, reading a sheet so an employee can total a column, writing the result back, or sending an email you requested. To do that, the relevant file contents are sent to our AI provider (Anthropic) for processing, under terms that do not allow them to use it to train their models. We store your Google access tokens (encrypted) and the list of files you picked; email sent through Gmail is recorded in the employee's sent mail so you can see what was sent.

What we never do with Google data: sell it; use it for advertising; use it to train or improve AI models, ours or anyone else's; or let any person read it, except with your permission, for security reasons, or where the law requires.

Staff Forge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove access at any time by disconnecting Google in Forge Settings → Connected accounts (this revokes the tokens and deletes them), or at myaccount.google.com/permissions.

AI processing

The AI features work by sending your messages, and the documents, files or emails needed to answer them, to AI providers: Anthropic (Claude) for Staff Forge, ChadGPT and WriteWithMe, and OpenAI for some WriteWithMe writing and for generating images such as employee avatars and workbook covers. We use their business APIs, whose terms do not allow them to train models on what we send. They may keep it for a limited time for abuse monitoring under their own policies.

AI output can be wrong. Check important numbers, facts and messages before you rely on them.

Who we share it with

We don't sell your information or share it for advertising. We use these service providers to run the site, and they process data only to provide their service to us:

• Vercel — hosting, analytics, and the secure browser sandbox employees use for website logins
• Neon — database (United States)
• Google Firebase — file storage (PDFs, uploads, avatars) and the live Post-It board and ScavChat
• Cloudinary — images posted in ScavChat
• Anthropic and OpenAI — AI processing, as described above
• Resend — sending and receiving email (verification emails, password resets, employee email)
• Stripe — payments
• Google and Meta — only for accounts you connect yourself

We may also disclose information if required by law, or to protect the site and its users from fraud or abuse.

How long we keep it, and deleting it

We keep your data while your account exists. You can delete individual items (documents, employees, chats, connected accounts) in the apps at any time. To delete your whole account and everything in it, email joshdluehosh@gmail.com from your account's email address; we'll do it within 30 days. We keep payment records as long as tax law requires. Copies in our providers' backups expire on their normal schedule.

You can also ask us for a copy of your data, or to correct it, at the same address.

Security

Data is sent over HTTPS. Passwords are hashed; access tokens and saved logins are encrypted with keys kept separately from the database. No system is perfectly secure, and we'll tell affected users promptly if a breach affects them.

Children

The site isn't meant for children under 13, and we don't knowingly collect their information. If you believe a child has given us information, contact us and we'll delete it.

Changes

If this policy changes, we'll update the date at the top, and for significant changes we'll tell signed-in users. See also our Terms of Service.