TRANSPARENCY MATTERS

Privacy

What the application stores

Accounts contain an email identifier, salted password hash and hashed recovery code. Saved projects contain the scope, selected locality, dates, notes, cost lines and purchase information you enter. An exact address is not required. Optional uploaded PDFs, images and text documents, their filenames and content hashes are stored privately with the project, along with quotes, checkpoints and notifications. Guest drafts stay in this browser tab’s session storage; clear the tab’s storage on a shared device.

Account email and support messages

If configured, an SMTP provider sends requested password-reset and verification messages. Tokens expire after 20 minutes; sent and expired mail bodies are cleared. Support messages are stored for operator review. Configure and disclose retention before launch. Do not send secrets through the contact form.

Payments

Square handles checkout. Card details are not collected by this app. The database stores purchase identifiers, configured amounts, payment status, subscription identifiers, recurring-billing consent version and verified paid-period dates. Financial records may be retained after account deletion, without a link to your deleted account.

Your controls

Download your account data or delete your account from the account screen. Project deletion also removes its saved versions, documents, quotes, checkpoints and shared snapshots. A free account export includes project records and document metadata; file bodies are downloaded individually. Paid users can create expiring, redacted snapshot links. Anyone holding a link can read its chosen snapshot until it expires or is revoked; it is not a team login. Backups may retain deleted information until the operator’s documented retention cycle expires; configure and disclose that policy before public launch.

Cookies and advertising

A necessary HTTP-only session cookie keeps you signed in. An optional first-party refusal cookie remembers that you disabled advertising. Global Privacy Control blocks advertising loading. Private project, workspace, account and shared-report pages never carry advertising, and signed-in paid members see no ads.

Public informational pages may show advertisements served by Google AdSense. Google, as a third-party vendor, uses cookies (including the DoubleClick cookie) to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet. You may opt out of personalised advertising by visiting Google Ads Settings or www.aboutads.info. Other third-party vendors and ad networks may also serve ads on this site; see how Google uses information from sites that use its services. Visitors in the European Economic Area, the United Kingdom and Switzerland are shown Google's certified consent message before personalised advertising, and visitors in applicable U.S. states are offered an opt-out message; use the "Privacy choices" link in the footer to change your choice at any time.

No project notes, scope, documents or exact addresses are used for ad targeting.

Operator information

This is release-template privacy text, not legal advice. Before public launch, the operator must publish its legal identity, contact address, retention periods, processors and jurisdiction-specific rights procedures. Operator details have not yet been configured; public launch remains blocked. Use the Contact page for a message to the installation operator.