Privacy Policy

Last Updated: August 10, 2026

At ThatVariant ("we," "our," or "us"), accessible from thatvariant.com and its associated subdomains (*.thatvariant.com), we prioritize the privacy and data ownership of our users. This Privacy Policy details how our Web Apps as a Service (WaaS) and Managed Progressive Web App (PWA) hosting architecture collect, process, and handle data when you use our platform and applications.

1. Service Architecture & Client Data Ownership 

ThatVariant operates on a zero server-side business database architecture. We believe you should retain 100% ownership and control over your business operations.

• Client Data Storage: All operational business data generated through our PWAs—including but not limited to appointment logs, POS sales history, inventory catalogs, staff schedules, and client rosters—is stored strictly and directly inside your personal Google Drive and Google Sheets account.

• No Central Database Storage: ThatVariant does not maintain central backend database servers (e.g., Firestore, SQL, or remote NoSQL databases) to aggregate, store, inspect, sell, or monetize your business or operational data.

• Direct API Connection: Your web browser communicates directly with Google API endpoints using encrypted HTTPS protocols to read and write your operational data.

2. Google OAuth & API User Data Disclosures 

To provide seamless PWA functionality, automated spreadsheet database creation, and document storage, ThatVariant requests explicit permission to access specific Google APIs via Google OAuth 2.0.

• Google Drive File Access Scope: Allows our application to view, create, edit, and manage only the specific Google Drive files, folders, and Google Sheets spreadsheets created by or explicitly opened with our web apps. This scope is strictly used to maintain your zero-server app database inside your own Google Drive.

• Google Spreadsheets Full Access Scope: Allows our application to view, edit, create, and delete your Google Sheets spreadsheets to manage your operational database records, inventory, and business logs directly.

• Google Gmail Send Scope: Allows our application to compose and dispatch transactional messages—such as booking confirmations, digital receipts, and client appointment reminders—directly from your connected Gmail address on your behalf. We do not read, access, or inspect your inbox or received emails.

Google API Limited Use Compliance Statement

• Google API Services User Data Policy Compliance: ThatVariant’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We do not use data obtained through Google Workspace APIs to train generalized AI or machine learning models, nor do we transfer Google user data to third parties, advertising networks, or data brokers.

3. Local Browser Storage & Client-Side Caching

To ensure fast load times, offline availability, and smooth PWA operation, our applications utilize standard local web storage technologies strictly on your local device:

• Session & Local Storage (localStorage / IndexedDB): Used exclusively to cache temporary session tokens, UI preferences, offline transaction queues, and active state flags.

• Data Retention: Local browser cache remains on your personal device and can be cleared at any time via your web browser settings.

• Offline Data Responsibility: Our applications support offline functionality by caching data locally on your device before it is synced to your personal Google account. Please be aware that:

  • Synchronization: Data is not backed up to your Google account until a successful synchronization occurs. Users are responsible for ensuring regular network connectivity to facilitate data syncing.

  • Device Security: Data stored locally on your device is protected by your device’s security measures. ThatVariant is not responsible for data loss or unauthorized access resulting from device hardware failure, cleared browser caches, or lost/stolen hardware.

4. Third-Party Infrastructure & Subprocessors 

To host our progressive web application code and manage subscription billing, we integrate with trusted third-party infrastructure providers:

• Frontend Web Hosting & CDN: We utilize cloud hosting infrastructure (such as Vercel and Firebase Hosting) to deliver compiled frontend web app assets and manage PWA routing via subdomains (*.thatvariant.com). These networks may collect standard server log files (e.g., IP address, user-agent, request timestamps) solely for technical diagnostic and security monitoring purposes.

• Subscription Billing & Payments: Payment processing and subscription management are handled securely by Lemon Squeezy (our Merchant of Record). Lemon Squeezy logs your email address to manage account access tiers and process payments. ThatVariant does not collect, process, or store raw payment card details or banking credentials on our servers.

5. Data Security 

Because all operational data resides within your own Google Cloud infrastructure (Google Sheets and Google Drive), your business data is protected by Google’s enterprise-grade security protocols. Security within our PWA frontend relies on standard HTTPS/TLS encryption for all client-side network communications.

6. Your Rights & Data Control 

Because we do not store your operational database records on central servers:

• Data Export & Access: You have immediate, full access to all your operational records at any time simply by opening your designated Google Sheets or Google Drive folder.

• Data Deletion: You retain complete authority to modify, export, or permanently delete your spreadsheets, files, and app records directly from your Google Account without needing to request permission from ThatVariant.

• Revoking Access: You may revoke ThatVariant’s access to your Google Account at any time via your Google Account Permissions Manager.

7. Changes to This Privacy Policy 

We may update this Privacy Policy periodically to reflect changes in technical architecture, legal standards, or platform functionality. The revised version will be published with an updated "Last Updated" date at the top of this page.

8. Contact Information 

If you have any questions, concerns, or inquiries regarding this Privacy Policy or our client-side data practices, please contact us at:

• Website: thatvariant.com

• Email: support@thatvariant.com