Privacy Policy

Last updated: [DATE]

Buffalo Consulting LLC ("we," "us," "I") operates obnamia.tech and app.obnamia.tech.

This policy explains what we collect, why, and what you can do about it.

Short version: we collect the minimum needed to run the site and send email

you asked for. The workbook you upload is never stored — it is read in

memory and dropped. If you have an account you can save a close: the computed

figures and the date, and nothing else. We don't sell anything about you. You

can delete your account yourself, from /account, it takes your closes and your

drill scores with it, and it is a real deletion.

---

What we collect

You give us:

• Email address — when you subscribe to the mailing list, or when you create

a free account

• A password, stored only as a bcrypt hash. We cannot read it and we cannot

recover it for you.

• Your Position Sheet, only if you choose to save it to your account. It

lives in your browser until you press save. If you never press save, it never

reaches us.

• Anything you write in the feedback box on the reader, and an email address

there only if you supply one. Both optional, and it says so.

• Your drill scores, if you have an account. How many you got right, how

long the round took, which drill and which setting, and when you started.

Nothing about what you answered. See Drill history below.

We do not take payments. There is no checkout, no payment processor and no

billing detail anywhere in this system. If that changes, this section changes in

the same commit.

Collected automatically:

• Web server logs — IP address, the URL requested, the time, and the browser

string, kept in a rolling log on the server for operational purposes. Capped

at five files of 10 MB.

• A count. The site's own analytics store a date, an event name from a fixed

list, and a number. **No IP, no browser, no referrer, no identifier, and no

cookie.** There is nothing in it that could be tied back to you, which is why

this site shows no cookie banner.

Cookies: two, both strictly necessary and neither used for tracking. One

keeps you signed in to a member account; one keeps the private hub session. No

advertising, analytics or third-party cookies are set.

---

The money tools, specifically

This is the part most people want to know about, so it is not buried in a list.

The free reader stores nothing. You upload a spreadsheet; it is read in

memory, analysed, and dropped when the request ends. It is never written to

disk, never logged, never cached, and never sent anywhere else. Close the tab

and there is nothing left.

We never ask for and never receive your account numbers, your login details

for any institution, or any connection to a bank. There is no aggregator and

there is no integration. The instrument is a spreadsheet you own.

Saved closes. The Position Sheet reader was withdrawn from this site on

19 August 2026 and there is now no way to save a close. Nothing new is

stored. Closes saved before that date are still held, still yours, and are

still deleted with your account; what follows describes them, and it describes the

limit that applied when they were written:

• Stored: computed figures only — totals, ratios, layer balances, debt

utilisation, months of runway, allocation by asset class — plus the date on

the sheet and the date you saved it.

• Never stored: the workbook, any row from it, any label, group or name you

typed, any account number, any institution, any balance tied to one.

A close has no text field. Not a name for the close, not the sheet's own

title, not your labels for your own accounts. That is stated as a mechanism

rather than a promise, because it is one: the code that builds a close keeps

numbers and two dates, re-checks the finished record before writing it, and

refuses to store one that contains anything else. The reason is that people put

account numbers in labels, and the only reliable way to not hold one is to have

nowhere to put it.

The differences between closes are computed when you look at them, from the

two snapshots. They are not stored separately.

The reason for all of this is not modesty. It is that the useful thing is the

trend, and holding the underlying detail would create a liability for you and

for us that the product does not need.

The free reader is gone. It stored nothing at all while it existed, and it

cannot store anything now: there is no upload path on this site.

Videos, and the one third-party request on this site

The tai chi modules can carry a YouTube video.

Nothing is loaded from YouTube until you press play.

The page ships a still frame and a button we drew; there

is no YouTube code, no YouTube frame and no request to any Google address in the

page you receive. Everything on the site until this feature shipped made

requests to obnamia.tech and to nothing else.

• Recorded by us: nothing. We do not know whether you pressed play, we do

not count it, and there is no event, no cookie and no row anywhere that says

you watched anything.

• Where it lives: nowhere on our side. If you press play, whatever YouTube

keeps is between you and Google, under their policy rather than ours.

• Transmitted: nothing until you press play. When you do, your browser

fetches the player from Google, and that request tells them your IP address,

the page you were on and the video you asked for — the same as opening the

video on YouTube itself would.

The player is the no-cookie one — youtube-nocookie.com rather than

youtube.com. It is Google's own reduced-tracking embed; it is not zero

tracking, and we do not claim it is. What makes the difference on this site is

that it is not loaded at all until you ask for it.

Drill history

The brain games at /hub/brain keep a score for each round you finish. **Until

19 August 2026 that score stayed in your browser and nothing was sent to us.

It is now also copied to your account**, so your history follows you to another

device instead of being tied to one browser.

Your browser is still written first, on every round. The upload is a second

step. If you are offline, signed out, or the server is down, the round is saved

locally anyway and nothing is lost; a failed upload is retried the next time you

open a drill page, not in a loop.

• Stored, per finished round: which drill, which setting you chose, when the

round started, how many questions you answered, how many you got right, and

how long it took.

• Never stored: what you answered. Not the question, not your answer, not

whether a particular item was right — only the totals above.

A round has no field an answer could occupy, in your browser or in our

database. That is stated as a mechanism rather than a promise, because it is

one: the record is six values, the table has six columns plus the owner, and the

endpoint that receives a round refuses anything carrying an extra field

rather than quietly dropping it. Same reasoning as a saved close having no text

box — the only reliable way to not hold something is to have nowhere to put it.

A round is never edited and never overwritten. Sending the same one twice

does nothing. That is why two devices need no reconciliation and why there is no

history of changes to keep.

Nothing is sent while you are playing, and nothing about your rounds is

visible to any other person. There is no leaderboard and no ranking, and no part

of this site reads one account's scores from another.

Blocks stores nothing at all. It has no score, no history and no account

row, and a round of it is rejected by the endpoint rather than stored.

---

Why we use it

• To deliver what you requested
• To operate and secure the site and members portal
• To send email you subscribed to
• To respond to you
• To understand aggregate traffic patterns and improve the site
• To comply with legal obligations

Legal bases where GDPR applies: consent (marketing email), contract

performance (running an account you created), legitimate interests (security and

aggregate counts), and legal obligation (records we are required to keep).

---

Cookies

• Essential — two, one per sign-in surface. The site does not function

without them.

• Analytics: none. The site's own counters set no cookie and store no

identifier, which is the reason you have not been asked to accept anything.

• We use no advertising and no cross-site tracking cookies, first-party or

third-party.

Most browsers let you refuse cookies. Refusing the essential ones will break

sign-in and nothing else.

---

Who can see it

Forrest can. This is a one-person business and there is an operator's

console on the private side of the site. Through it he can see:

• every account's email address, role, status, sign-up date and last sign-in
• how many entitlements an account has, and which
• everything written in the feedback box, including a reply address if one

was supplied

• the site's counters — dates, event names and numbers

Nobody else has an account on that console, and it is behind the same login as

the rest of the private side.

What it deliberately cannot do, because the absence is the point:

• It cannot read your password, and it cannot set one. Passwords are

stored only as a bcrypt hash and the console never selects that column.

Nobody, including an operator, can see what your password is.

What it can do, and this is worth being exact about: an operator can

issue a single-use reset link for an account. There is no email provider on

this site yet, so that link is shown to the operator rather than sent to

you — which means an operator holding it could complete the reset

themselves. **Every issue is recorded in the audit trail with the operator's

name and the account it was for.**

We would rather write that down than describe a protection we do not have.

When email delivery is configured the link will go to the address on the

account instead, and this paragraph will get shorter.

• It cannot see your financial figures. The operator's console shows a

count of how many closes an account has saved and nothing else — not a net

worth, not a date, not one figure from inside one. It never opens a stored

close.

• It cannot publish anything you wrote. Feedback is never turned into a

public quote without separate, explicit written permission.

Every action taken on that console is recorded — who did it, what, and when.

Sharing

We do not sell your personal information. We share it only with service

providers who need it to operate the business:

Only the first row is real today. The list used to read as though all four

were in use, which sat oddly beside "we do not take payments" three sections

above it. If one of the others is ever switched on, this column changes in the

same commit.

We may also disclose information where required by law, or in connection with a

business transfer.

---

Affiliate links

Some links are affiliate links. When you click one you leave our site, and

the third party's privacy policy governs from that point — not this one. We

may receive aggregate reporting on referrals and commissions. See /disclosure.

---

Retention

• Uploaded workbooks: not retained at all. Read in memory, dropped when the

request ends.

• Email subscribers: until you unsubscribe, plus a record that you did, so

we do not re-add you.

• Account data, including every saved close: while your account exists.

When you delete it, it is gone from the live database immediately — see below.

• Saved closes: you can delete your account to remove all of them. There is

no expiry on them otherwise; a trend with holes in it is not a trend.

• Drill history: while your account exists, and it goes with the account.

There is no expiry on it otherwise, for the same reason as a close — the

useful thing is the comparison against your own previous rounds, and a

history with holes in it is not one. The copy in your browser is yours and we

cannot reach it; clearing your browser storage removes that copy and leaves

the account copy, and deleting your account removes the account copy and

leaves the browser one.

• Counts: the analytics rows are a date, an event name and a number. There

is nothing personal in them to expire, so they are kept.

• Feedback: kept until you ask us to remove it.
• Server logs: a rolling file, five generations of 10 MB, then overwritten.

Backups, and what deletion actually means

The account database is snapshotted once a day and **snapshots are kept for 30

days**, on the server and on a machine off it. This is ordinary and it is the

only reason your account survives a disk failure — but it means a deletion is

not instantaneous everywhere:

• Immediately: your account, your entitlements, every session, every saved

close, every drill round and everything else you saved are removed from

the live database. The deletion is real, not a flag, and cascades take

everything with it.

• Within 30 days: the last snapshot containing you ages out and is deleted.

A snapshot taken before you deleted your account still contains your rows,

including your drill history, until it ages out. That is the same window that

applies to a saved close, described the same way, because it is the same

window and the same backup.

We do not restore a backup to recover a deleted account, and we do not mine

snapshots. Saying this is better than a promise that is not true.

---

Your rights

Wherever you are, you can ask us to:

• Give you a copy of the data we hold
• Correct anything inaccurate
• Delete your data, subject to records we're legally required to keep
• Stop sending you marketing email — every email has a one-click unsubscribe
• Object to or restrict certain processing

You can delete your own account without asking us, from /account. It is a

hard delete — see the backup note above for the one window where a copy still

exists.

For anything else, email [CONTACT_EMAIL]. We respond within 30 days.

California residents (CCPA/CPRA): you have the right to know what we

collect, to delete it, to correct it, and to opt out of sale or sharing. **We do

not sell or share personal information as those terms are defined.** You will

not be discriminated against for exercising these rights.

EEA/UK residents (GDPR): you additionally have the right to data portability

and the right to lodge a complaint with your supervisory authority.

---

Security

We use industry-standard measures — encrypted transport (TLS), hashed passwords,

access controls, and a default-deny network posture. No method of transmission

or storage is completely secure, and we cannot guarantee absolute security.

---

Children

The site is not directed at anyone under 16 and we do not knowingly collect

information from children. If you believe a child has given us information,

email [CONTACT_EMAIL] and we'll delete it.

---

International transfers

We're based in the United States and information is processed there. If you're

outside the US, you're consenting to that transfer.

---

Changes

We may update this policy. Material changes will be noted by updating the date

above and, where appropriate, by email.

---

Contact

Buffalo Consulting LLC

[BUSINESS_ADDRESS]

[CONTACT_EMAIL]