Privacy Policy

Last updated: 2026-05-09

Imperfect Shade ("the Application") is a private, self-hosted personal data ingest application operated by a single individual for personal use. The Application connects to third-party services that the Operator authorizes via OAuth — including social media platforms and personal accounting or financial-data services — and stores the returned data on the Operator's own infrastructure. This policy describes what data the Application collects, how it is used, and how to request deletion.

Who operates the Application

Imperfect Shade is operated by Steven Harris (the "Operator"). The Application is not offered as a service to third parties; it runs on the Operator's own infrastructure for the Operator's own use.

What data is collected

When the Operator authorizes the Application to connect to a third-party service via OAuth, the Application stores:

• OAuth access tokens and refresh tokens for the connected service. Tokens are stored encrypted at rest on the Operator's server.
• Basic account or profile information returned by the service's API (for example: display name, account or company identifier, and any account-level metadata the service exposes through its API).
• Service-specific content the Operator has chosen to ingest. For social-media services this includes posts, drafts, and per-post analytics composed or retrieved by the Operator. For accounting or financial-data services this includes account balances, chart-of-accounts entries, and standard financial reports (such as a balance sheet) authored by the Operator's own books.
• Derived aggregates the Application computes locally from the above (for example, time-series of net-worth totals or post performance), stored in the Application's own database.

The specific OAuth scopes requested vary by service and are documented in each service's developer documentation. The Application requests only the scopes required for the use cases listed in "How the data is used" below — typically read-oriented scopes for the Operator's own data — and does not request scopes that would grant access to other users' data.

How the data is used

Collected data is used solely to:

• Display the Operator's connected accounts inside the Application.
• Render and aggregate the Operator's own data — for example, scheduling and publishing content the Operator has authored to a connected social platform, or computing net-worth totals from the Operator's own connected financial accounts.
• Display analytics, summaries, and time-series derived from the Operator's own data.

Data is not sold, shared with third parties, or used for advertising. The Application does not include third-party analytics or tracking scripts.

Where the data is stored

Data is stored on the Operator's self-hosted infrastructure. No data is sent to any third party other than the connected services whose APIs the Operator has authorized.

Data retention

Data is retained while the corresponding service connection remains authorized. When the Operator disconnects a service from the Application, OAuth tokens for that service are deleted, and the cached account, content, and analytics data for that service is removed within 30 days.

Data deletion requests

Because the Application is single-operator, the Operator may delete any data at any time directly from the Application's database. Third parties who believe their data may be referenced inside the Application — for example, public commenters on a tracked post — may request deletion by emailing [email protected]. Requests will be honored within 30 days.

You may also revoke the Application's access from each connected service's own settings page (for example, the TikTok app permissions screen, the Intuit App Connections page, or the equivalent setting on any other service) at any time, which will invalidate the Application's tokens for that account.

Security

OAuth tokens are encrypted at rest. The Application is served over HTTPS. Access to the Application's user interface is restricted to authenticated sessions on the Operator's own account. The underlying server is not exposed publicly except via the Application's HTTPS endpoint.

Children's data

The Application is not directed at children under 13 and does not knowingly collect data from children under 13.

Changes to this policy

This policy may be updated from time to time. Material changes will be reflected in the "Last updated" date above.

Contact

Questions or deletion requests: [email protected].