What the testing app stores
CareWork Ledger is for subcontractors invoicing agencies. It stores your account name and email, password credentials, sign-in sessions, business and payment details, agreed rates, customers, invoice documents and manually recorded payments, credits and corrections. A logo is stored if you add one. Session and abuse-prevention records can include IP addresses and browser information. Detailed support notes, diagnoses and participant identifiers are not required.
Where information is used
The web app runs on Sites using a Cloudflare Worker and a D1 database. Your sign-in controls access to your own records. Team administrators can invite people and manage team access; this does not give them access to staff-owned invoices, profiles or payment records. Platform administration is separate from team administration. Sites and Cloudflare provide the hosting and database; Resend is used for account mail only when configured. Their processing locations, any additional subprocessors, and the operator’s support-access permissions, approvals and logging still need confirmation. No platform support access is granted by transferring ordinary team administration.
PDF, CSV and JSON downloads are prepared for you to save or share. Payments are recorded manually. CareWork Ledger does not automatically email invoice PDFs. When configured, Resend delivers account verification, password recovery and email-change messages. Account email delivery is configured; the operator must still verify real delivery and recovery before public signup.
Private account recovery
A team administrator may request recovery delivery, but cannot receive a password-reset token or usable reset link. Instructions are sent only to an active account’s verified email address. Invited staff can verify their own address in Settings once account mail is configured. Requests for missing, unverified, disabled or unrelated accounts receive the same acknowledgement; that acknowledgement does not confirm eligibility or delivery. Provider failure cannot be used to identify an account.
Recovery requests leave a dated occurrence without storing their token, link or message. Reset links expire after one hour and are single use. A successful reset ends password sessions. Recovery does not enable a disabled account. The original owner’s authenticated original platform identity can change only its own linked password; this does not confer staff recovery access or recover transferred team administration. Operator-assisted recovery needs a documented identity review; there is no impersonation or identity-check bypass in the app.
Your browser and device
Sign-in cookies keep your session. A non-personal browser marker tells other open tabs when the account changes. The installation cache holds public app assets, not invoice records. Invoice editing requires a connection; unsaved inputs on an open page are not a saved backup. Downloads remain on your device until you remove them.
Access, correction and exports
Use Profile for your details, Customers for templates, and Invoices for saved documents and payment history. Settings offers CSV history, a PDF ZIP and a JSON export of personal records. These exports do not contain the whole database and have no tested account-import feature; they are not a complete backup system. Issued documents remain fixed; use a credit or replacement to preserve their correction history. Export the records you need before deleting an account.
Deleting your account or closing a team
Settings provides personal account deletion after password confirmation. An administrator first transfers administration to an eligible active member or explicitly closes the team. Transfer preserves outstanding invitations and their existing expiry. Closure revokes unused invitations. Active staff keep independent access and their own records; disabled accounts stay disabled. Closure ends administrative assistance with recovery delivery and access changes. A disabled member needs verified operator assistance after closure; the operator’s assistance service is not yet established. No recovery guarantee is made.
Deletion removes your login, profile, customers, invoices and financial events from the active database. It ends your sessions. Hashed denial markers remain for the deleted account and any original platform identity, to support deletion enforcement and restoration reconciliation. They contain no email or recovery secret. A deleted original owner’s legacy login cannot recreate that account. Team access audit entries are retained with the deleted actor’s identity redacted. Other people’s records stay with their accounts. A new account, if later permitted, does not recover deleted records.
Retention, backups and contact — awaiting confirmation
No verified backup retention period, backup deletion schedule or restoration commitment has been provided. Active-record, deleted-account marker, recovery-request and audit retention, and any legally required record retention, must be defined by the operator before launch. A disposable local restoration drill does not verify the hosting provider’s ability to recover this live database. Restored data must remain inaccessible until current deletions, disabled access and team ownership have been reconciled. Deletion from the active app is not a promise of immediate removal from infrastructure backups. The operator’s legal name, privacy contact, complaint process and any overseas handling disclosures are also outstanding. Use Help & support for current testing limitations.