← sh4q.io Privacy

Privacy

Command Center is a private tool with exactly one user.

Last updated 6 September 2026

Command Center is a personal dashboard built and used by Shafiq Aznir. It runs at dash.sh4q.io and is not open to sign-ups: account creation is disabled and exactly one account exists, so requests from anyone else are refused. This page describes what the application does with data, because Google requires a published policy before an app may leave testing mode — not because there is a second user whose data is at stake.

What it accesses

With the owner's explicit Google consent, the application reads:

Gmail — message headers, subjects, snippets and bodies from the owner's own mailboxes, to work out which conversations are waiting on a reply, to detect bills and their amounts, and to display a conversation in the app.
Gmail (write) — creating drafts, sending replies the owner has written or approved, marking read, archiving and snoozing, when the owner presses those controls.
Google Calendar — events in the coming days, to show the schedule, and RSVP responses when the owner presses them.

It also reads the owner's own WhatsApp message metadata through a self-hosted connection, and business records from systems the owner operates. No data belonging to any other person's account is collected.

What it does with that data

Everything is used for one purpose: to show the owner what needs attention. Message text is classified to decide whether something is waiting on a reply, and short summaries are generated for the owner's own screen.

To do that classification, message text is sent to Anthropic's API, which processes it as a service provider and does not use API inputs to train models. No other third party receives message content.

Command Center's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, never used for advertising, and never used to train generalised AI or ML models.

Where it is stored

Data lives in a private Supabase (PostgreSQL) project in Singapore, reachable only by the application. OAuth tokens are encrypted at rest in Supabase Vault. The application is hosted on Vercel. Row-level security restricts every table to the owning account.

How long it is kept

The conversation ledger keeps a rolling window of roughly the last fourteen days and prunes older entries automatically. Detected bills and business records are kept until the owner removes them. Revoking access stops all further collection immediately.

Revoking access and deletion

The owner can revoke the application's access at any time at myaccount.google.com/permissions, which immediately ends its ability to read anything. To have stored data deleted, write to the address below and it will be removed.

Contact

shafiq.aznir@gmail.com