Privacy Policy — Foreshadow

Foreshadow is property-management software for short-term rental operators. Companies use it to run their properties: tasks, schedules, team assignments, and guest messaging. This policy explains what information we collect, why, and what you can do about it.

Two kinds of people appear in Foreshadow, and the distinction matters throughout this policy. Users are the people who sign in — owners, managers, staff and outside vendors at a property-management company. Guests are the travellers those companies host; guests never sign in to Foreshadow, but their reservations and messages flow through it. For guest information, the company that hosts them decides how it is used, and we process it on that company's instructions.

Information we collect

Your account. Your name, email address, profile photo if you add one, and the role your workspace gives you. We record when you accepted your invitation and set a password. We never see or store your password itself — authentication is handled by Supabase, which stores a cryptographic hash.

What you create in the app. Tasks, checklists, comments, templates, notes, automation rules, property and department records, schedules, and any photos or files you attach.

Reservation and guest data from your connected systems. If your workspace connects its property-management system — Foreshadow works with a range of them, such as Hostaway, Hospitable and Guesty — we retrieve reservations, property listings, and guest messages, including guest names, stay dates and message contents. We fetch this so the app can show it to you and so the messaging features work.

Connected accounts. If your workspace connects Slack, we store the access token for that workspace, encrypted at rest, along with the channel and user identifiers needed to post and receive messages.

Notifications. If you allow push notifications, we store the device token Apple or Google issues for your phone, so we can deliver alerts. If you turn on email notifications, we send them to your account email address. We also store your notification preferences.

Technical records. Our hosting and database providers keep standard server logs — IP address, timestamps, request paths, error traces — used to operate the service and diagnose problems.

What we do not collect. Foreshadow contains no analytics SDK, no advertising SDK, and no third-party tracker. We do not track you across other apps or websites, we do not build advertising profiles, and we do not sell personal information.

How we use information

To provide the service: showing your workspace's data to the people entitled to see it.
To sign you in and keep your session secure.
To send the notifications you have asked for — in the app, by push notification, by email, or in Slack.
To power the assistant and automation features described below.
To keep the service running: monitoring, debugging, preventing abuse, and backups.
To contact you about the service — account, security and billing matters.

Artificial intelligence features

Foreshadow includes an assistant that drafts guest replies, proposes tasks and answers questions about your workspace. To do this, the relevant content — the message thread, task details, property records and the instructions your workspace has configured — is sent to our AI providers, OpenAI and Anthropic, which return the response.

We use these providers under their business terms, which do not permit your content to be used to train their models. Automated replies are sent to guests only where a workspace has deliberately turned that on; it is off by default.

Who we share information with

We share information with the service providers that make Foreshadow work, and for no other purpose. They are:

Supabase — database, authentication, and file storage.
Vercel — application hosting.
OpenAI and Anthropic — the assistant and automation features.
Resend — delivery of account and notification emails.
Apple and Google — delivery of push notifications to your device.
Slack and your property-management system — only where your workspace has connected them, and only to exchange the data those integrations need.

We may also disclose information where the law requires it, or to protect the rights and safety of our users. If Foreshadow is ever acquired or merged, information may transfer as part of that transaction; we would tell you before your information became subject to a different policy.

Who can see your workspace

Workspaces are isolated from one another at the database level. Within a workspace, what you can see depends on your role. Superadmins and managers see and manage everything, including the workspace's settings and team. Staff see the day-to-day operation — schedules, tasks, reservations, guest messages and properties — but not the workspace's settings or team administration. Vendors see only the work assigned to them. Your workspace administrators can see the content you create in the workspace, change your role, and remove you.

Keeping and deleting information

We keep workspace data for as long as the workspace is active, because it is the operating record of a working business — a property's maintenance history is of no use with pieces missing.

You can delete your own account at any time, from Profile → Danger Zone → Delete account inside the app. That deletes your sign-in credentials, your name, email address, profile photo, notification preferences and device tokens. Tasks, comments, logged time and messages you created remain with the workspace, shown as “Deleted user” and no longer attributed to you, because they are the company's operating history rather than your personal data.

If you own a workspace with other members, you will be asked to transfer ownership to another superadmin before deleting your account, so the workspace is not left without an owner.

To have an entire workspace and its records deleted, write to hello@foreshadowpm.com from the owner's email address. Backups are retained by our infrastructure providers on their own rotation and are overwritten in the ordinary course.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to certain processing, or to complain to a data-protection authority. You can exercise most of these directly in the app, and for anything else write to hello@foreshadowpm.com. If you are a guest of a company that uses Foreshadow, please contact that company first — they decide how your information is used, and we will support them in answering you.

Security

Traffic is encrypted in transit with TLS. Data is encrypted at rest by our infrastructure providers, and integration tokens are additionally encrypted by us before they are stored. Access between workspaces is enforced by row-level security in the database, not only by application code. No method of transmitting or storing data is completely secure, so we cannot guarantee absolute security, but we work to protect your information with the measures described here.

International transfers

Foreshadow is operated from the United States, and our providers process information there. If you use the service from elsewhere, your information is transferred to and processed in the United States.

Children

Foreshadow is a tool for businesses and is not directed to children. We do not knowingly collect information from anyone under 16. If you believe a child has provided us information, write to us and we will delete it.

Changes to this policy

We will update this page when our practices change, and revise the date at the top. If a change materially affects how we handle your information, we will tell account holders by email or in the app before it takes effect.

Contact

Questions about this policy, or about information we hold: hello@foreshadowpm.com.