Bounded, read-only monitoring

The app uses ClickUp OAuth to read the connected user identity, authorized Workspaces, Spaces, Folders, Lists, and bounded task results required to evaluate explicitly configured expectations. It registers a task-event webhook and never edits ClickUp tasks.

Access tokens, webhook secrets, Workspace and List names, account email and name, and expected task names are encrypted at rest in Cloudflare D1. Matching task IDs are stored only as an HMAC aggregate. Generated CSV and PDF receipts are stored in Cloudflare R2 and delivered through expiring signed links.

Stripe processes subscriptions. Cloudflare provides the application runtime, database, object storage, queues, rate limiting, bot protection, and logs. Operational logs exclude credentials and personal data. Records are retained for up to 365 days unless the customer deletes the account sooner.

Deleting the app account removes the ClickUp webhook, encrypted application records, and receipt objects. An active Stripe subscription must be canceled first so deletion cannot silently leave a charge behind.

Shared Cazi Media privacy policy and terms also apply. Questions: [email protected].