What OffYet keeps, why, and what it never does.

• Your account: your name, email and a hashed password. Never the password itself.
• Passkeys, if you add one: the public key only. The private key never leaves your device.
• Your OSS link: your OSS name, employee number and home station. Your OSS username and password are encrypted before they’re stored, and so is the device-trust snapshot that keeps OSS from asking you to verify again.
• Your home station and the name on your schedule row, so OffYet can find you on the schedule.
• Where you said you were working on a tour, when you tell us.
• When you first and last got an answer.
• When your OSS login was last verified.
• Your “I actually left at” reports: the station, seat and times, and a reason from a fixed list if you pick one. No names.
• Referral records: who referred you and when, and any credit either of you earned.
• Billing records: Stripe’s IDs for you, what you bought, what it cost and when. Stripe holds the payment details. OffYet never keeps a card number.

OffYet reads station schedules you can already open in OSS. It keeps them for up to 7 days to keep the load on OSS down, and shows them only to other active OffYet users with a working OSS login.

They’re never sold, published, exported or used for anything but answering relief questions.

• Sell your data.
• Run ads or trackers.
• Share anything with your department.
• Change anything in OSS.
• Show your own home details to other users.

Payments go through Stripe. OffYet never sees your card. We keep only Stripe’s IDs for you, what you bought, what it cost and when. Stripe gets your email for receipts.

If you use someone’s link, we record who referred you and when, and any credit either of you earned. Neither of you sees the other’s details.

A sign-in session cookie, and a referral cookie for 30 days if you open someone’s link. No third-party analytics.

We count how often features are used, not who used them. These counts never leave OffYet.

• Delete your account in Settings. It removes everything right away, including your encrypted OSS login.
• Remove your OSS login in Settings. That also stops your access.
• Ask for a copy of your data through the contact page.

OSS usernames, passwords and device-trust snapshots are encrypted at rest, with the key kept outside the database. The admin account uses two-factor sign-in. Requests are rate-limited, pages are served with strict security headers, and nothing secret is written to logs.

If your data is ever exposed, we’ll tell you by email and on the site without unreasonable delay, and tell you to change your OSS password.

OffYet doesn’t use AI to make your estimate, and never sends your data to an AI company on its own.

If you connect an assistant (Grok, ChatGPT, Claude, Meta Muse or another) from Settings, OffYet sends that assistant only your own answer when it asks: your times, how deep your chain is, the station codes in it, when the data is from, and any notes. Never your OSS login, never coworkers’ names, never anything you didn’t ask it for.

That company then has what it was sent, under its own privacy policy, not OffYet’s. Read theirs before you connect.

OffYet stores which assistants you connected, when, and when each last asked. Any key is stored hashed, like a password. Disconnect any of them in Settings at any time. Deleting your account disconnects them all.

Assistant requests only read what OffYet already has cached. They never make OffYet contact OSS.

If names are ever allowed for some accounts, this page will say so first, with a new date.

California gives you the right to know what we hold about you, to have it deleted, and to say no to its sale. OffYet honors those rights for everyone, wherever you live. It doesn’t sell data at all.

OffYet is independent. Not affiliated with CAL FIRE, Riverside County, or OSS.

Questions about this page, or a request for your data: use the contact page.

When you write to us on the contact page or through a “Something look wrong?” link, we keep what you wrote, the reply email if you give one, and where you were: the page, station, date, seat, depth and app version. Codes only: never other people’s names, and nothing else from OSS.

Messages are kept for one year, then deleted.