DRAFT — OWNER REVIEW REQUIRED BEFORE PUBLICATION OR APP STORE SUBMISSION. Not submitted.
Draft updated: October 10, 2026
Labor Witness ("we," "our," or "us") is a private workplace documentation tool. This Privacy Policy explains what the app collects, how it is used, and the controls available to you. Labor Witness preserves user-supplied records; it does not make legal findings or monitor calls, messages, or inboxes.
We collect only the information necessary to provide our service:
Private account data is associated with your authenticated account ID and is stored through the authenticated API. Private files use private object storage and signed, time-limited access URLs. The server derives ownership from your authenticated session; client-supplied owner IDs are not trusted.
Submitted records and original files are not silently replaced. Corrections, notes, and AI observations are stored separately when those features are available. A matching hash indicates unchanged file bytes; it does not independently prove authenticity, ownership, legal admissibility, or chain of custody.
Firebase is used only as a non-blocking authentication and service bridge in the current architecture. It is not used by the app to silently read SMS, iMessage, carrier call history, or carrier-call audio.
We do not sell, rent, or use your private records for advertising. We do not share reports, journal content, work contacts, or private worker reviews with employers, government agencies, or other parties unless you explicitly direct a sharing action or disclosure is required by law.
We use the following third-party services:
Informational only. Not medical or legal advice. The Advocate is an AI documentation coach, not a lawyer or doctor, and does not provide diagnosis, treatment, legal findings, or professional advice.
In an injury status check-in, the opening and pain/duty controls use saved data without calling AI. Nothing is appended to the injury record until you confirm “Save as dated update.” If you send an AI message in that check-in, the selected saved injury context is sent to Gemini for that reply. Ordinary Advocate chat does not receive saved injury records. Injury prompts and their settings are device-local; no local device notifications are scheduled in this version. Any future lock-screen reminder must be generic by default without injury details. Manual dated updates and device-only memory extraction do not consume the monthly AI reply allowance.
To reply, your Workplace Advocate sends your message and up to 11 recent chat turns to Google Gemini’s free service. Google may use these messages to improve its products, and people may review them. Please leave out sensitive, confidential, or personal information.
Conversations disappear from the chat and its stored transcript after 24 hours, on app open and while the app is open. Recognized details are distilled on the device into compact private reference notes, saved to the user's account until deleted or the account is deleted. Read, delete one note, or erase all notes in “What your Advocate remembers,” reachable from the chat menu and Settings. Private notes are not included in shared or exported records, push notifications, or logs. Your check-ins are not sent to this chat.
Advocate chat excludes private memory notes, saved reports, journal entries and cases, apart from a selected injury status check-in disclosed in the app. Private notes do not personalize future conversations. Automatic notes may miss nuance and should be reviewed for accuracy. Deleting data in Labor Witness does not guarantee deletion of copies already processed by Google under its terms.
Journal AI assessments are separate and optional. Only after you allow the journal-assessment notice, the text of one saved, user-written addition is sent to Google Gemini's free service. Google may use it to improve products, and people may review it. No other journal entries, titles, GPS, contacts or saved records are sent with this assessment. Automatic mood entries are excluded. Turn assessments off in Journal settings or skip an individual entry. Each successful assessment or regeneration uses one monthly Advocate reply; failed attempts do not. The assessment, its generation time and an AI-generated label are stored privately with the entry and deleted with the entry or account. Filing as a report copies your chosen addition into a draft for your review and explicit submission; it does not change the original journal. Linking records does not share them externally.
Labor Witness does not automatically access SMS, iMessage, email inboxes, carrier call history, carrier-call audio, or your device contacts. The current app has no background call, message, inbox, contact, or microphone surveillance. Work contacts shown in the app are entered by you one at a time.
You may delete your account from the Profile screen after recent authentication. Advocate check-ins have no automatic expiry; the Profile screen currently offers individual edit and delete controls for only the five newest entries. Account deletion removes the account and associated private records, journal pages, saved work contacts, analyses, private files, and Advocate check-ins through the deletion process. Advocate chat history can be cleared from the chat screen and is stored only on the device; the app server does not retain it. The app also requests removal of the associated RevenueCat customer record when that provider operation is available.
Apple controls its own App Store transaction records and may retain purchase history, receipts, or other billing records under its policies and legal obligations. Deleting a Labor Witness account does not claim to erase those store-managed records. If RevenueCat cleanup is unavailable because of a provider permission or service issue, app-owned account deletion still completes and the app reports that provider retention may apply.
AI can identify possible patterns in the report material you choose to analyze. AI output should cite supporting Report IDs with dates and counts where available. It may say “possible pattern,” but it will not determine intent, declare harassment, discrimination, retaliation, or a law violation, or treat chronology as proof of causation. Results may be incomplete when your records do not include the full history.
Your Workplace Advocate uses the saved private records selected for a record-aware conversation only to generate the response you request. Its visible and device-stored transcript expires after 24 hours, on app open and while the app is open; the API does not persist chat transcripts. You decide whether to save any proposed journal entry or incident report; an AI summary is kept separate from the original words you review.
Labor Witness is not a law firm and does not provide legal advice. Your records and any statement you confirm remain user-supplied records; they are not automatically court-certified, legally admissible, or an official chain of custody.
Your Workplace Advocate is an AI feature, not a human, lawyer, or doctor. It provides supportive workplace conversation, not legal advice, legal findings, medical diagnosis, or emergency services. Check-ins are self-reported and are used only for the app's check-in and history features. They are linked to your account, not shared with employers or other users, and not used for tracking or advertising.
Labor Witness is for adults 18 and older. We do not knowingly collect information from children under 18.
Phone numbers, email addresses, review text, report text, work-contact information, and journal content are not sent to advertising analytics. Operational logs are minimized and should not contain the content of private records.
We may update this Privacy Policy from time to time. We will notify you of significant changes via the app.
If you have questions about this Privacy Policy, contact us at marcel@vantashieldtransitllc.com.