Privacy Policy

Base 10 Project Console and Base 10 Timer apps · Effective August 15, 2026

This Privacy Policy explains how Base 10 Consultants LLC ("Base 10," "we," "us") handles information in its internal business software: the Base 10 Project Console at app.base10consultants.com (the "Console"), including its integration with Intuit QuickBooks Online; and the Base 10 Timer apps for iPhone, Apple Watch, and Mac (the "Timer Apps"). These are private tools operated by Base 10 for its own business operations and for the clients and subcontractors it works with. They are not public products, and no one can sign themselves up for them.

For the privacy practices of our public website and free tools, see the base10consultants.com Privacy Policy.

Who uses the Console

• Base 10 personnel and subcontractors, who sign in with an account created by invitation only. There is no public sign-up.
• Clients, who receive single-purpose links to review and sign engagement documents, or to view a project status report. These links do not create an account.

Information in the Console

• Account information for invited users: name, email address, and role. Authentication is handled by Supabase Auth; we do not store passwords.
• Client and engagement records: company and contact details, agreements (master services agreements, statements of work, non-disclosure agreements), signatures captured on our signing pages, and the resulting signed documents.
• Project and time records: projects, tasks, time entries and their notes, rates, invoices, and payment status.
• Subcontractor onboarding and tax information: the details a subcontractor provides on IRS Form W-9 or Form W-8BEN, including taxpayer identification numbers, and the resulting executed forms. This is collected because U.S. tax law requires us to hold it in order to pay a contractor and to file information returns.
• QuickBooks Online data accessed via Intuit's API — accounting records such as the chart of accounts, customers, vendors, invoices, bills, expenses, transactions, and related financial reports — together with the OAuth 2.0 access and refresh tokens used to make that connection.

How we use it

We use this information solely to run Base 10's business: scoping and delivering projects, tracking time against work, invoicing clients, paying subcontractors, meeting tax and record-keeping obligations, and reconciling all of the above with our accounting records. We do not use it for advertising or profiling, and the Console shows no advertising.

How we share it

We do not sell, rent, or trade this information. We share it only with service providers acting on our behalf in order to operate the Console, and with our accountant and taxing authorities where required:

• Supabase — database and authentication.
• Cloudflare — application hosting, document storage, and the cookieless page-view analytics described below.
• Intuit QuickBooks Online — accounting.
• Stripe — client card and bank payments. Payment details are entered on Stripe's own pages; we do not receive or store full card or bank account numbers.
• Mercury — our business bank, used to pay subcontractors. Payment instructions are held at the bank; the Console records that a payout occurred, not the account it went to.
• Microsoft 365 — the mail service that sends Console email.

Otherwise we disclose information only where required by law.

Analytics

Console pages carry Cloudflare Web Analytics, which counts page views and reports aggregate information such as the referring site, browser, operating system, and country. It sets no cookies, does not fingerprint your device, and cannot follow you to other sites. This applies to the client-facing signing and status pages as well. There is no advertising anywhere in the Console, and no third-party advertising or tracking pixels. (The Timer Apps are separate and send no analytics at all — see below.)

Storage & security

Data is transmitted over encrypted connections (HTTPS/TLS) and stored with access controls that limit each user to the records their role requires. Connections to QuickBooks use OAuth 2.0; we do not store QuickBooks account passwords. Documents are stored in Cloudflare R2. Access to tax identification information is restricted to the Base 10 personnel who need it to make payments and file returns.

Retention & deletion

Engagement documents, time entries, invoices, payout records, and tax forms are business and accounting records, and are retained for as long as required for legal, tax, and accounting purposes. Other records are kept as long as needed for the purposes above. To request deletion of records about you, contact us at the address below; we delete on request except where retention is required by law.

Intuit / QuickBooks

The Console uses the Intuit QuickBooks Online API and operates in accordance with Intuit's Developer Terms of Service. You can revoke its access at any time from within QuickBooks Online (Apps → Manage), which invalidates its tokens. On disconnection or on request, we delete the associated stored QuickBooks data unless retention is required for legal, tax, or accounting purposes. Your use of QuickBooks Online remains governed by Intuit's own terms and privacy policy.

Base 10 Timer apps (iPhone, Apple Watch, Mac)

The Timer Apps let Base 10 personnel and subcontractors start and stop timers against their own assigned work. They are distributed privately (TestFlight or direct install) and are not available to the general public.

No account is created in the app. There is no sign-up, and the app never asks for an email address or password. Access requires a device access key issued by Base 10 from the Console; without one the app does nothing.

What the apps send to us: the identifier of the task you are timing, the start and stop times, and any note you choose to type on a time entry. What they read: your own running timers and the tasks, projects and client names you are assigned to.

What stays on your device: the access key, held in the device Keychain; and a local copy of what is currently running plus any action not yet delivered to our server, so time logged without a network connection is not lost. Both are removed when the app is deleted.

What the apps do not collect: no analytics, no advertising identifiers, no tracking of any kind, and no third-party analytics or advertising SDKs. The apps do not request or use location, contacts, photos, the microphone, the camera, or health data.

Sharing: we do not sell, rent, trade, or share this information with third parties. It is transmitted over encrypted connections (HTTPS/TLS) to Base 10's own service and stored in Base 10's database, hosted on Cloudflare and Supabase infrastructure acting on our behalf.

Retention and deletion: time entries are business records and are retained for accounting and invoicing purposes. You can sign a device out at any time from the Console, which revokes that device's key and leaves your other devices unaffected. To have records deleted, contact us at the address below; we delete on request unless retention is required for legal, tax, or accounting purposes.

Children

The Console and the Timer Apps are business tools and are not directed to children. We do not knowingly collect information from anyone under 16.

Changes

We may update this policy from time to time. The effective date above reflects the latest version.

Contact

Base 10 Consultants LLC · Petoskey, MI 49770
Dave Dewey — dave.dewey@base10consultants.com