Privacy Policy

Account information: your name, email address and a securely hashed password when you create an account.

Organization and project data: the information you and your team enter to use the service — organizations, projects, contract values, transactions, income and expenses, clients, categories and notes.

Uploaded files: receipts, invoices and project photos you attach to transactions or projects.

Technical data: standard server logs (IP address, browser type, pages requested) used for security and reliability.

Files you upload are stored with Cloudflare R2. Private files — such as receipts and transaction documents — are only ever served through authenticated, authorized links. Images belonging to projects you explicitly publish to your public portfolio are served through a content delivery network.

When you attach a receipt or invoice to a transaction, the document is sent to Obra's configured AI receipt-processing provider (Anthropic or OpenAI) to extract the amount, date, vendor and a suggested category from your own category list. The extraction is used solely to prefill the transaction form for your review — nothing is saved without your confirmation. The selected provider processes this data on our behalf as a service provider solely to provide receipt extraction.

We use a session cookie to keep you signed in and to protect against cross-site request forgery, a locale cookie to remember your language, and your browser's local storage to remember your theme preference. We do not use advertising cookies, cross-site tracking, or analytics that identify you, and we never sell your data.

Projects appear on your public portfolio page only when you explicitly mark them as public. Financial details — costs, income and every derived figure — are never displayed publicly. You can unpublish a project at any time.

We use your information to provide and improve the service, to respond to support requests, to keep the service secure, to process billing, and to send essential service communications. We do not use your project or financial data for marketing.

We share data only with service providers who help us run Obra — hosting infrastructure, Cloudflare R2 for file storage, Anthropic or OpenAI for receipt extraction, email delivery, and payment processing — and only to the extent needed to provide the service. We may also disclose information when required by law. We never sell personal data.

We keep your data for as long as your account is active. You can download a structured export of your organization's data (CSV files; uploaded files are listed with download links but not bundled) and delete your organization or account yourself, at any time, from Settings. Deletion removes your data from the live application immediately; residual copies in our deletion-recovery storage and backups are purged within approximately 90 days, and anonymized product feedback may be retained. Our payment processor deletes stored payment details when your organization is deleted, keeping only what it must for financial record-keeping. You can also email support@tryobra.com and we will act on your request within 30 days, except where we must retain records to meet legal obligations.

All traffic to Obra is encrypted in transit. Passwords are stored using strong one-way hashing, and access to production data is restricted. No system is perfectly secure, but we work to protect your information with industry-standard measures.

Our infrastructure and service providers are primarily located in the United States. If you use Obra from elsewhere, your information will be transferred to and processed in the United States.

Obra is not directed at children and may not be used by anyone under 16 years of age.

Depending on where you live, you may have rights to access, correct, export or delete your personal information, and to object to or restrict certain processing. You can export and delete your data directly from Settings; for anything else, email support@tryobra.com.

We may update this policy from time to time. If we make material changes we will notify you by email or through the service before the changes take effect.

My Tiny Rocket LLC · support@tryobra.com. We're happy to answer any question about how your data is handled.