Privacy Policy
Last updated October 21, 2026
The short version
- We collect what's needed to run Gusset: your account details, the record you write, and how the service is used.
- We never sell your information, never use it for advertising, and never use it to train AI.
- Stored in Canada. Gus's AI runs through Anthropic, which doesn't train on your entries. Voice runs through Deepgram (US), which keeps nothing after each request and doesn't train on it. Some of our service providers process information in the United States (section 5).
- Gusset takes words only. There is no way to attach a file or a photo. To bring in an old log, you can choose the file in Bring your notes: it's read on your own device, only its text is sent (like pasting it), and the file itself is never uploaded or kept.
- You can download everything we hold about you, or delete your account and everything in it, at any time in Settings.
- No advertising cookies, no trackers, no cookie banner. See Cookies.
1. Who is responsible
Gusset Log is a registered business name of Mridul Sharma, an individual in New Brunswick, Canada ("Gusset", "we", "us"), who is responsible for the personal information described here.
Privacy officer: Mridul Sharma, support@gussetlog.com. Write with any question, request or complaint.
Mailing address available on request: support@gussetlog.com
This policy follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Gusset is offered in Canada only, outside Québec.
The photo on the About page, where it's shown, is of the operator and is published with the operator's consent. Gusset never asks for or keeps a photo of you.
2. What we collect
| Category | What | Why |
|---|---|---|
| Account | Your first name, email address and province or territory; later, if you add them, your discipline, the month your first engineering job started, and the date you submitted your licence application | To run your account |
| Sign-in with Google | If you choose Google instead of the email code: your name, your email address, whether Google has verified that address, and its id for your account. We ask for nothing else (no contacts, calendar, files or photo) and keep nothing else it sends | To sign you in, and to match you to your one Gusset account |
| Your record | The entries you write or dictate, their dates, any hours you mention, projects, topics and competency tags, drafts of write-ups, which competencies you stamped, and the name and professional title of a supervising engineer if you give one | The service itself; a validator you add sees only the drafts you send them |
| Validators | Only if you add one: the name and email address you give for them, what they can see (only the drafts you send with Ask for feedback), their comments, your replies, and which comments you resolved and read. A validator who signs in gets a free account with their own email address and name | To let them comment on your record, at your request |
| Chats with Gus | What you type or say to Gus (as text) and what Gus answers, and the short memory shown under Settings > What Gus remembers | So you can pick a chat back up, and so Gus can file new notes sensibly |
| Your examples, guides and checks | The competency examples you write, every saved version, and Gus's guides and checks of them | So they're there when you come back |
| What you agreed to | That you confirmed being 18 or older, which version of the terms you agreed to, and each email, notification, marketing and renewal consent, with its exact wording and time | Proof of consent |
| Payment | Your plan, currency, and renewal date. Your card is handled by Stripe; we never see or store the full card number | Billing |
| Reminder settings | If you switch them on: the time, the days and the time zone for your reminder, any snooze, each device's address at its browser's notification service, and a private random address for your calendar feed | To remind you when you asked |
| Messages to us | What you send through Help or by email, your email address, the page you were on and your browser type | To answer you |
| Usage and technical | Counts of AI requests and what they cost, how much of Free's allowances you've used, records of errors and of limits being reached, which emails were sent to you (not their content), counts of page views made without cookies, and, if you first arrived through a link tagged with where we posted it (such as our Instagram profile), that one word, kept with your account so we know which of our posts bring people. Your IP address is used in passing to deliver pages and limit abuse, and is not stored with your account or in error reports | Security, cost control and keeping the site working |
We do not ask for and do not want sensitive information such as health, financial, government-ID or biometric information, or other people's personal information beyond a supervising engineer's name and title. Please keep it out of your entries.
3. How we use it, and what we never do
We use personal information only to: provide Gusset; file entries, gather your own notes for and check your examples from what you give us; send service emails (sign-in codes, receipts and subscription terms, renewal notices, confirmations, and a daily note when there is new feedback); send the reminders you switch on; keep the service secure, within its limits and working; answer you; and meet our legal obligations.
We never sell or rent your information. We never share it for advertising or use it to advertise to you. We never use your record to train AI models. Gusset makes no automated decisions about you: Gus only files and suggests, and you decide what to keep. Gus never writes your competency examples.
We rely on your consent, which you give when you create an account and agree to this policy, and which you can withdraw (see section 7). Reminders each need their own separate yes, and are off until you give it.
4. Your words and AI
- What you type or say is sent to Gus to file the entry, and we keep the entry. Gusset does not accept files, photos or documents. Bring your notes reads a notes file (.txt, .csv, .docx or .xlsx) on your device, without opening any macros, and sends only its text to Gus in parts; the file is dropped from the page as soon as it's read. Gus sorts the text into draft entries in your own words, and nothing is saved until you keep them.
- Gus runs on Anthropic (the Claude API), in the United States. Under Anthropic's commercial terms it may not train its models on what we send. Anthropic keeps what we send only for a limited period set out in its own terms, to provide the service and check for misuse, and then deletes it.
- Voice. The mic button (dictation) and talking with Gus both send your speech through Gusset to Deepgram, a speech service run by a United States company, while the microphone is on. Deepgram turns it into text and, in voice mode, turns Gus's replies into Gus's voice. Gusset sets Deepgram's opt-out on every request, so under Deepgram's published terms it keeps the audio and text only as long as it takes to process the request, and doesn't use them to train its models. Gusset never stores your audio. Dictated words wait in the box until you tap Send. In voice mode, what you and Gus say appears in your chat, and when you tap Done your own words are filed as an entry, like a typed note. To count Free's minutes, Gusset keeps how many seconds you've talked, not what you said. If your browser can't reach Deepgram, the mic button uses your browser's own speech recognition instead, under its maker's terms (for example Apple in Safari or Google in Chrome).
- AI can be wrong. Review everything before you rely on it.
- Don't enter confidential, client-identifying or export-controlled information. See the Acceptable Use Policy.
Validators. Only when you add one, Gusset emails one invitation to the person you name (usually the licensed engineer who supervised your work). They sign in to a free account with a code sent to that address. Your entries are always private: a validator sees only the competency drafts you send them with "Ask for feedback", and only their own comments on them, until you remove them. They can only comment; they can't change anything. You see their comments on your draft, reply once and resolve each one, and Gus uses comments you haven't resolved when checking your examples and placing your own sentences. They get an email each time you send them a draft, and at most one a day about your replies, with a link to stop it; you get at most one a day about new comments, which you can turn off in Settings. None of these emails contains your entries, your drafts or anyone's comments. A validator's name and email address are their personal information: give them only if you're entitled to (normally, they've agreed to review your work), and Gusset uses them for this and nothing else; we never send them marketing. Gusset never calls anything verified, approved or validated, and a stamp is your own tracker, not an official stamp or signature. Links you shared before October 9, 2026 keep working until they end.
5. Who processes it for us, and where
We share personal information only with the service providers below, who may use it only to provide their service to us, and each of which we have chosen for its security practices and bound by its contract terms.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | Canada (Central) |
| Anthropic | Gus: filing entries, suggesting competencies, checking your examples and placing your own sentences, and what Gus says in voice mode | United States |
| Deepgram | Voice: turning your speech into text (the mic button and voice mode with Gus) and Gus's replies into speech. Set to keep nothing after each request and not to train on it | United States |
| Cloudflare | Hosting the site, protecting it from abuse, page-view counts without cookies (no cookies and no personal profile), the "are you a person" check on sign-up and the signed-out contact form, and storing our nightly backup, encrypted with a key only Gusset holds | Worldwide network, including the United States; processed where you connect. The backup is stored in North America |
| Stripe | Payments | United States and Canada |
| Resend | Sending email | United States |
| Sentry | Error reports when something on the site breaks: errors only, with personal details scrubbed before they're stored (no entry text, no email or IP addresses) | United States |
| Signing you in, only if you choose "Continue with Google". Google learns that you signed in to Gusset and when; it never sees your record | Where Google runs its sign-in | |
| Apple, Google, Mozilla or Microsoft (your browser's notification service) | Delivering a reminder notification, only if you switch it on for a device. They carry it encrypted and cannot read it | Where that service runs |
We may also disclose information if the law requires it (for example, a court order), or to a successor if Gusset is ever transferred to a company we form or to a buyer, who must honour this policy; we would tell you first.
Information processed outside Canada. Your record is stored in Canada. An encrypted backup copy is kept for up to 30 days in Cloudflare's storage in North America, which may be in the United States; it can only be read with a key Gusset alone holds. The providers above marked United States (and Cloudflare's network) process some information outside Canada. While it is there it is subject to the laws of that country, and may be accessed by its courts, law enforcement and national security authorities under those laws. By using Gusset you consent to this. If you have questions about how these providers handle information, ask the privacy officer.
6. How long we keep it
| What | How long |
|---|---|
| Your record, chats, drafts and settings | Until you delete them or your account |
| A deleted account | Removed from the live database at once, along with its entries, chats, examples, guides, consents, reminders and notification devices, and any shares. Copies remain only in encrypted backups until those age out: our database provider's daily backups (kept 7 days) and our own nightly backup (kept 30 days). If we ever restore a backup, we delete deleted accounts again before anything else |
| A sign-in that was started but never finished (a code asked for, never entered) | 7 days, then the email address is deleted |
| Messages to support | 24 months, then deleted |
| How many seconds you've talked with Gus (never what you said) | Until you delete your account |
| A validator's email address you gave | Until 30 days after you remove them, or at once if you delete your account. Their access and its comments are deleted a year after you remove them, or with your account. A validator's own account stays until they delete it. (For links shared before October 9, 2026: 30 days after the share ends; the share and its notes are deleted after a year) |
| The log of which emails were sent to you (no content) | 24 months, then deleted |
| Records of errors and of limits being reached | 90 days, then deleted |
| Records of what AI requests cost | Kept for accounting, with no link to you once your account is deleted |
| Records of a privacy breach, if one ever happens | At least 24 months, as the law requires |
| Billing records | Held by Stripe for as long as tax and payment laws require (in Canada, generally six years after the end of the tax year they relate to) |
| What our AI provider receives | A limited period set by its own terms, then deleted |
7. Your choices and rights
- See and download. Settings > Download all my data gives you everything we hold about your account in one file. Export gives your entries as a spreadsheet and your examples as documents, free on every plan.
- Correct. Edit your profile and any entry in the app, or ask us.
- Delete. Settings > Delete account removes your account and everything in it, and ends any subscription.
- Withdraw consent. Switch reminders off in Settings (one switch per kind), or remove the calendar feed from your calendar; it works at once. Withdrawing consent to this policy as a whole means deleting your account, because we can't run it otherwise.
- Ask or complain. Write to the privacy officer. We answer within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
We will not treat you differently for using any of these rights. To protect you, we may need to confirm it's you, which signing in normally does.
8. Global Privacy Control and "Do Not Track"
If your browser sends a Global Privacy Control signal, we record it on your profile and honour it as a request not to sell or share your information. We don't sell or share it in any case, and there are no trackers to switch off.
9. Reminders and emails
Reminders. Gusset can remind you to log your work. It's off until you switch on "Remind me to log" in Settings > Reminders, and then comes at the time and on the days you choose, skipping quiet days, any snooze you set, and days you've already logged:
- Notifications on your devices. "Remind me on this device" sends a notification to that phone or computer. It's encrypted for your device and only ever says it's time to log: nothing from your record.
- An email. Where reminder emails are offered, the same reminder also comes by email. It says it's time to log, with how many weeks you've logged and how many entries this week; never anything an entry says.
- A calendar reminder. You can add a daily "Log today's work" event to your calendar, as a link to Google or Outlook, or as a subscription your calendar app checks. The subscription is a private, random address only you have; it gives the same event every day and nothing from your record. You can make a new address in Settings, which turns the old one off.
Progress recap. Where it's offered, "Progress recap by email" in Settings > Reminders (off until you pick weekly or monthly) emails how many entries you made, how many competencies are covered and one gap, with entry titles only, never what you wrote; it's skipped when you logged nothing in that time. People who get the recap also get a short note at two milestones (the 10th entry, six months), once each.
Email. Besides the reminder and recap above, which you switch on yourself, we send only what you need: sign-in codes, receipts and the terms of what you bought, renewal notices for yearly plans, confirmations (for example, of a cancellation or a deleted account), and, if you add a validator, at most one email a day when there's new feedback (Settings > Emails turns it off). Every reminder, recap and milestone email names us, gives our mailing address and has an unsubscribe link that works at once. We don't send news or marketing; if that ever changes, each will need its own separate yes, will name us and give our mailing address, and will have an unsubscribe link that works at once. If an email to you bounces or is marked as spam, our email provider tells us, and the reminder and recap emails stop until you ask for them again in Settings.
How you sign in. You can sign in with a code we email you, or with Google. The email code always works. Under Settings > Account you can see how you sign in, add or remove Google, and change your sign-in email (we send a code to the new address and one to the current address, and need both). We only match a Google sign-in to an existing account when Google says the email address is verified. Use a personal account, so your record stays with you if you change jobs.
10. Security and breaches
We protect your information with encryption in transit and at rest; database rules that let each account read and change only its own data; sign-in without passwords; limits on how often anything can be asked; a strict content security policy; and as little access for us as the work needs. No system is perfectly secure, and we cannot promise that yours will never be breached.
If a breach of our safeguards creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner of Canada as soon as feasible, and keep a record of it for at least 24 months.
11. Children
Gusset is for adults. You must be 18 or older to use it, and we do not knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its information. If you believe a child has given us information, write to support@gussetlog.com.
12. Changes to this policy
If we change this policy in a way that matters, we will tell you by email or in Gusset before the change takes effect, and ask you to agree to it where the law requires consent. The date at the top shows when it last changed.
13. Contact
Privacy officer: Mridul Sharma, support@gussetlog.com
Mailing address available on request: support@gussetlog.com