Privacy Policy

Last Updated: September 18, 2026

1. Information We Collect

H2A Compass operates on a freemium model. Most features require no account. If you choose to create an account to access premium content, we collect:

• Email address — used to identify your account and send password reset codes
• Password — stored as a secure one-way hash (bcrypt, 12 rounds); we never store your plain-text password
• Optional display name — only if you choose to provide one
• Session tokens — temporary authentication tokens stored server-side with a 30-day expiry
• Password reset codes — 6-digit one-time codes sent by email and stored temporarily (expire in 1 hour)
• Synced app data and calendars — records you choose to synchronize while signed in
• Document Vault content — files, names, categories, and sharing/folder information you upload or create
• AI Q&A records — questions, answers, language, and account association when applicable, used for history, quality, and safety review
• Feedback and service records — feedback you submit, push tokens, app/platform metadata, subscription state, and limited usage/security events

We do not collect:

• Financial information or payment card details
• Precise GPS location, unless a feature clearly asks for and receives your permission

2. Local and Server Data Storage

H2A Compass keeps local copies of data needed for offline and device use. Depending on the feature and whether you are signed in, the following may also synchronize to our servers:

• Calendar & Deadlines: Filing deadlines and calendar events
• Compliance Reports: Scorecard results, timeline reports, and inspection checklists
• Document Vault: Documents you upload, plus folder, membership, and QR-sharing records
• OCR Results: Scanned documents and translations cached for offline access
• Subscription Status: IAP subscription status managed locally by Apple or Google

Important: Uninstalling removes local app data from that device but does not delete information already synchronized or uploaded to our servers. Use available in-app deletion controls or request account deletion to remove server-held data, subject to legal and operational retention requirements.

3. Camera Permission

H2A Compass requests camera access for the following features:

• Paystub Compliance Checker: Scan paystubs to verify wage compliance with OCR technology
• Document Translator: Scan documents (contracts, notices, pay statements) for instant translation
• 3-Year Limit Calculator: Scan passport and I-94 documents to calculate H-2A eligibility

Privacy Protection: When you use OCR, photos are transmitted to our service and Google Cloud Vision for text extraction. Google processes this data under its applicable service terms. You can deny camera permission and manually enter information instead.

4. Push Notifications

H2A Compass uses push notifications to deliver regulatory updates:

• We store a device push token to send broadcast notifications
• If you are logged in, your push token may be associated with your account so we can send account-specific notifications in the future
• Notifications are broadcast to all users — we do not send personalized tracking notifications
• You can disable notifications in your device settings at any time

5. Third-Party Services

H2A Compass uses the following third-party services:

• Google Cloud Vision API: Processes images submitted for OCR under Google's applicable service terms.
• Google Cloud Translation API: Processes text submitted for translation under Google's applicable service terms.
• OpenAI (GPT-5-mini): Processes AI assistant and tool requests under OpenAI's applicable data terms. H2A Compass may retain Q&A records for user history, quality, safety, and support.
• Resend: Delivers password reset emails. Your email address is shared with Resend solely for the purpose of sending transactional emails.
• App Store Payment Processing: Your subscription is managed by Apple App Store or Google Play Store. We never see your payment information.
• Neon (PostgreSQL): Our managed database provider for account, synchronized app/calendar data, Document Vault content, service, and administrative records.

6. Optional User Accounts

Creating an account is entirely optional. Accounts are only needed to access premium subscription features. If you create an account:

• Your email address and hashed password are stored on our secure servers
• Session tokens are stored server-side and expire after 30 days of inactivity
• You may be signed in on up to 1 device at a time by default (configurable)
• You can delete your account at any time, which permanently removes your email, password hash, and all session data from our servers
• Selected records you synchronize and files you upload may be associated with your account on our servers

If you choose not to create an account, you can still use all free features and access premium content via an App Store subscription — no account required for IAP subscribers.

7. Data Sharing

We do not sell or rent your personal information. We disclose data to service providers as needed to operate requested features, secure the service, and meet legal obligations.

Data transmission includes situations when:

• You create an account (email and hashed password stored on our servers)
• You use OCR features (images sent to Google Cloud APIs and immediately processed)
• You use AI tools (queries sent to OpenAI for processing)
• You register for push notifications (device token stored on our server)
• You request a password reset (email address shared with Resend for delivery)
• You synchronize app data or calendars, upload Document Vault files, submit feedback, or use account-connected features
• You voluntarily email documents to yourself using your device's native email client

8. Children's Privacy

H2A Compass is intended for adults aged 18 and older involved in H-2A agricultural employment. We do not knowingly collect information from children under 13. If you believe a child has created an account, please contact us immediately.

9. Security

We implement industry-standard security measures:

• Passwords hashed with bcrypt (12 salt rounds) — never stored in plain text
• Session tokens are random, server-side, and expire after 30 days
• All network communications encrypted with HTTPS/TLS
• Device security controls may protect local data where supported and enabled
• Rate limiting on all authentication endpoints to prevent brute-force attacks
• Database hosted on Neon with encryption at rest

10. Your Rights

You have the following rights regarding your data:

• Access: You can view the email address associated with your account in the About tab
• Delete your account: Contact us at admin@h2acompass.com to permanently delete your account, email address, hashed password, and all session data from our servers
• Local data: Delete individual calendar entries, compliance reports, or scanned documents within the app at any time
• Uninstall: Removes local app data from that device but does not itself delete synchronized server data
• Notifications: Disable push notifications in your device settings at any time
• Camera: Disable camera permissions in your device settings at any time

11. Data Retention

We retain account and feature data while your account is active or as needed to provide the service. Password reset codes expire after 1 hour and session tokens expire according to the active session policy. Account deletion removes associated server data except where limited retention is required for security, legal, fraud-prevention, or transactional recordkeeping. Local device data remains until you delete it in the app or uninstall the app.

12. Changes to This Privacy Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. Updates will be posted within the app and on this page with a new "Last Updated" date.

13. Contact Us

If you have questions about this privacy policy, your data, or to request account deletion, please contact us:

Email: h2acompass@gmail.com

© 2026 H2A Compass. All rights reserved.
A privacy-conscious compliance tool for the H-2A agricultural workforce.