Privacy policy

Tims Ops (operated by Muhammad Rayyan Mohsin) runs ready-made store-operations checks for Tim Hortons franchise owners. Questions or requests: mo.rayyan2002@gmail.com.

Your account: your email, your name, and your two-step verification (MFA) setup.

Business data you connect: only what the checks you choose need. For your business data, we act on your instructions.

• Clearview reports: sales, labour, time cards (staff display name, job code, punch times, hours; never pay), waste, stock levels, and staff hire dates for probation reminders.
• The read-only Clearview login you create for us, kept encrypted and never shown back.
• Crunchtime emails you forward to us, such as food-safety forms.
• Slack workspace and channel ids, and the Slack user ids of the managers you choose to alert.
• Your store settings: store numbers, hours, targets, delivery days.

• Staff SIN, birth dates, home addresses, pay rates or wages, phone numbers or personal emails.
• Guest or customer data, and card data.
• Your profit and loss or marketing plans.
• Clearview pages your checks don’t need.
• Passwords in logs, links, error messages or recordings.

If you choose “Continue with Google”, we receive only your email address and basic profile (name and picture) to sign you in. We don’t ask for, read or store any other Google data, such as Gmail, Drive or Calendar.

Tims Ops’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don’t sell it, use it for ads, or use it to train AI.

Only to run the checks you turned on and send you alerts and summaries. Some alert wording is written by AI from numbers only: no names, no time cards, no contact details.

Your data is stored in Canada (Supabase, ca-central-1). To run the service, some of it passes through these services, most of them in the US:

• Supabase: database and encrypted secret storage, in Canada. The only place your data is stored.
• Vercel: runs this website. Nothing is stored there.
• Browserbase: the secure browser window you sign in to Clearview with. Recording is off.
• Slack: delivers your alerts to the workspace and channels you choose.
• Anthropic: writes some alert wording from numbers only, through a business API that never trains on it.
• Railway (when enabled): runs the checks. Data is held in memory only, nothing is stored.
• Postmark (when enabled): receives the Crunchtime emails you forward, kept only briefly.

• Your account: while you are a customer.
• Clearview login: until you change or disconnect it.
• Sales, labour, waste and stock numbers: 13 months, then only store totals.
• Time cards: 60 days, then per-person rows are deleted and only store totals are kept.
• Copies of report pages (only the columns we need): 30 days.
• Alerts we sent: 90 days.
• Record of who did what, including our own admin access: 2 years.

• Disconnect Clearview at any time: we delete its login and session at once and the checks stop.
• Ask us to delete all your data: we remove your business’s data, files and secrets within 30 days of your request, with confirmation. Backups age out on Supabase’s schedule.
• Ask us for a copy of the data we store for you.

Email mo.rayyan2002@gmail.com for any of these.

• Two-step verification (MFA) is required on every account, yours and ours.
• Encrypted in transit and at rest; Clearview logins are kept in an encrypted vault.
• Each business’s data is kept separate from every other owner’s.
• If anything ever goes wrong with your data, we’ll tell you as soon as feasible after we learn of it, as Canadian privacy law requires.

We never sell your data or share it for advertising. Your data is never used to train AI.

If this policy changes, we update the date above and ask you to agree again in the app before you continue.