Privacy Policy

What Data We Collect

When you use Own Your Tools, we collect and store the following information to provide you with a fully functional business management experience:

• Account information — your name, email address, and phone number, provided during registration
• Billing records — your Stripe customer and subscription identifiers; for a one-time purchase, when you bought it, Stripe's reference for that payment, and when it was revoked after a refund or a dispute, or restored, if it was; on the monthly plan, how many payments you have made, the plan's dates (when it started, the month it is paid through, when a payment failed, until when you have access, when it is set to end or ended, and when the license became yours), and a record of each payment (its amount and currency, the months and period it paid for, its date, Stripe's references for it, and whether it was refunded or reversed). We never store card numbers.
• Business data — customer records, job details, invoices, proposals, expenses, mileage logs, inventory, and scheduling data you enter into the app, and, for an account with offline mode on, your automations, which of them are switched on, your follow-up sequences and your automation tasks
• Customer data you enter — when you add your customers' information (their names, phone numbers, email addresses, service addresses) to the platform, you are responsible for having appropriate consent from those customers under applicable law
• Leads from your public form — when someone fills in your lead-capture form, what they send (their name, contact details, address, the job they describe and whether they agree to be contacted), the page they sent it from and their browser type, saved to your account
• Job photos — the photos you and your team take or add on a job, each with who took it, whether it is a before or an after photo, and any caption you write. The app saves each photo again on your device before it is sent, which removes the location and the other details a camera stores in the file; we keep no location for a photo
• Checklists and forms — the checklists you set up, and the checklists and forms filled in on a job, with the signatures and photos taken in them
• Purchase orders — the orders you write, with each supplier's name and email address, the items and their costs, and when an order was sent and to whom
• Stock used on jobs — for an account that tracks it, each change to an item's stock that a job or an invoice makes, and who made it
• Appointment reminders — for an account with appointment reminders: how long before a job a reminder goes, or that reminders are off; your time zone, which the app takes from your device; which jobs are not to be reminded; a record of each reminder (the customer's name and email address, the appointment's time, and whether it was sent); and the customers who asked to stop them
• Your team — when you invite people to your team: each one's name, email address and phone number, their role, and when they were invited, joined or removed. When a member is removed, a copy of their details is kept as the record of the removal
• Google® Calendar tokens — OAuth 2.0 access and refresh tokens when you connect your Google Calendar for job scheduling sync
• Device information — your IP address and browser type, which our sign-in provider records each time you sign in, and the IP address of requests to some of our services, which we keep for about a week to limit abuse
• How you first arrived — the first time you visit one of our public pages: the page you landed on, the website that sent you there (its name only, such as www.google.com, never what you searched for), and any campaign tag (its utm_source, utm_medium, utm_campaign and utm_content) or referral code (ref) in the link you followed, with when you arrived; saved with your account when you sign up (see Cookies and Tracking Technologies)
• Device and sync records — for an account with offline mode on: a random identifier for each device the app runs on, the app version it runs, when it first and last synced, and how many changes it has sent; a receipt for each change a device sends, so no change is saved twice; and, when a change from a device could not be saved as made, the device's value beside the value your account kept. For every account, a list of the records you delete (which kind of record, and when), so your devices remove them too
• Location data — GPS coordinates when you use the mileage tracker, only while the feature is actively in use, and once, when you tap Use my location on a job address
• Files you import — when you import customers or inventory items from a spreadsheet or contact file, the file is read on your device and is not uploaded to us; only the rows you choose to import are saved to your account
• Your choice about our texts — whether you asked for our proposal alerts, the number you asked for them at, and when and where (at sign-up or in Settings) you ticked or unticked the box
• Opt-outs — the phone numbers that replied STOP to a text sent through the Service, with the reply, and the email addresses that unsubscribed from our emails, kept so we do not contact them again

How We Use Your Data

Your data is used exclusively to operate the Own Your Tools platform, provide the features you use, and learn which of our pages and links bring people to it:

• Running the application — storing and syncing your business data (clients, jobs, invoices, expenses) across devices
• Offline mode — for an account with offline mode on, keeping a copy of your business records on each of your devices so the app works without a connection, and sending the changes made there to your account when the device is back online (see Data Storage and Security)
• Finding and fixing problems — errors in the app are reported to Sentry (see Third-Party Services). For an account with offline mode on, a device also reports when a change could not be saved to your account, when a sync failed for a reason other than a lost connection, or when it found that our database had been restored from a backup. The report itself names your account identifier, the device's random identifier, a short reason code and counts, never the words you or your customers wrote; like every error report, it can arrive with a short record of what happened in the app just before, which can include such words (see Sentry under Third-Party Services). An automatic check reads these reports, and the count of changes your account could not keep as made, every hour, and emails us when an account's sync needs attention
• SMS notifications — via Twilio®, texting you when a customer accepts your proposal, if you asked for it (see SMS Communications and Opt-Out), and receiving the replies sent to our number (including opt-out replies) so we can honor unsubscribe requests. The Job Map's Notify client does not text your customer: it opens the messaging app on your phone with a message for you to send from your own number
• Email notifications — sending account-related emails (trial reminders and account updates) and product communications via Resend (built on AWS SES), password-reset emails through our sign-in provider, Supabase, and emailing, from your business name, the invoices and proposals you send to your customers and the purchase orders you send to your suppliers
• Calendar synchronization — when you connect your Google® Calendar, adding an event for each job you schedule and removing it when you delete the job
• Route optimization — calculating efficient driving routes between job sites using Google Maps
• Payment processing — handling one-time purchase payments, monthly plan payments, and contractor payouts through Stripe®
• Appointment reminders, sent for you — when your account sends appointment reminders, we send them on your behalf, as your service provider: we use your customers' names, email addresses and appointment details only to send the reminders you have set up and to keep their requests to stop, and for no purpose of our own. Each reminder comes from your business name at contact@ownyourtools.work, replies go to your email address, and it carries a link with which your customer stops reminders from your business; a stop applies to that customer in your account only
• Your customer portal — when you send a proposal or an invoice, your customer gets a private link, which works for 365 days, to a page that shows your business's name, phone number, email address and logo, the proposals and the sent invoices you have for them, the title, description and dates of their jobs, the messages you exchange there, and, where you choose, the after photos and the checklists of the job an invoice is for. A link to a photo there stops working after an hour
• Learning which of our pages and links bring people — counting, for each website, campaign tag, referral code and landing page, how many accounts that first arrived by it signed up, sent their first quote or invoice, and bought. Only our founders see these counts, inside Own Your Tools, and they carry no name or email address; where a tag or referral code belongs to a single business we wrote to, its counts can show us that that business signed up or bought. When you buy, the campaign and content parts of your account's tag go to Stripe with your payment (see Stripe under Third-Party Services)
• Keeping our promise if we stop — if you have bought a license, made a payment toward one on the monthly plan, or are renting right now, keeping an encrypted copy of your account's email address outside our database (see GitHub under Third-Party Services), so that we can tell you where to get the Kit if our service stops, as Section 12 of our Terms of Service promises

We do not sell your personal data, or the data you keep about your customers, to anyone, for any purpose. We do not rent or share either with third parties for marketing or advertising purposes, except that our email provider, Resend, sends you our own product emails.

Third-Party Services

Own Your Tools integrates with the following third-party services (our sub-processors) to deliver and operate its features. Each receives only the data necessary to perform its specific function:

• Supabase™ — cloud database, authentication and file storage. Stores your account credentials, business data and files with database-level access controls applied per user. Job photos, receipts, and the signatures and photos in checklists and forms are kept in private storage, and open only through links that expire; profile pictures and business logos are kept in public storage, where anyone who has a file's link can open it (your logo appears in the emails you send). Supabase Privacy Policy
• Netlify® — web hosting, content delivery, and serverless functions. As our hosting provider, Netlify processes all traffic to the site (including IP addresses and request metadata) and runs the server-side functions that power features such as payments, messaging, and lead capture. Netlify Privacy Policy
• Twilio® — SMS delivery and inbound message handling. Receives your phone number and the text we send you when a customer accepts your proposal (your customer's name, the proposal's number and amount, and a link to create the invoice), if you asked for it, and the replies (including STOP messages) sent to our number. Twilio Privacy Policy
• Resend (Plus Five Five, Inc.) — email delivery, built on AWS SES. Receives email addresses and message content when we send you account-related or product emails, and, when your account emails a customer or a supplier, the recipient's name and email address, your business name and email address, your logo and colour, and the message: for an invoice or proposal, its number, its amount, any due date or note to your customer, and a link to it in your customer's portal; for a purchase order, its number, date, items and total, and your business's phone number; for an appointment reminder, the appointment's date, time and address, your business's phone number, and the link to stop reminders. Resend Privacy Policy
• Amazon Web Services, Inc. (AWS) — cloud email infrastructure (Amazon SES) that Resend uses to deliver our email. Receives email addresses and message content downstream when we send you account-related or product emails, and every email your account sends to your customers or suppliers. AWS Privacy Notice
• Stripe® — payment processing, in two separate flows. When you buy Own Your Tools, Stripe handles your card data and receives your email address and, if your account was saved with a campaign tag, its utm_campaign and utm_content; we never store card numbers. On the monthly plan, Stripe keeps your card on file and charges it for the monthly payments until the 12th, or until you pay off or cancel the plan; after that the card stays saved with Stripe, but the plan does not charge it again unless you start or continue the plan again. You can update the card, or cancel, in Settings, on a page Stripe provides. Separately, if you switch on card payments for your own customers, Stripe Connect receives your email address and account identifier from us, and the business and identity details you give it to verify your account, and your customer's name, card data and email address when they pay one of your invoices. Those customer payments go to your Stripe account, not ours. With each payment to us, Stripe also receives your account identifier and which price you pay; when you buy the team upgrade, it receives your email address and the identifiers of your account and your team. Stripe Privacy Policy
• Google® — Calendar API, Maps API (with Places address suggestions and Directions), Geocoding API and Google sign-in, used for calendar sync, route planning, address suggestions and lookup, and signing in with your Google account. Receives the street addresses you type or that are stored on your jobs, customers and leads (to suggest and complete them, to turn them into map coordinates, to draw routes, and to open directions in Google Maps when you tap an address or Navigate), your device's coordinates when you tap Use my location (to look up the street address), your Google sign-in if you choose Continue with Google, and, if you connect Google Calendar, an event on your own calendar for each job it syncs, carrying the job's title, your customer's name, the job's address, its date and time, and the job description you wrote. Apart from what you write into a job's description, it does not receive your customers' phone numbers, email addresses, invoices or payment details. Google Privacy Policy
• Cloudflare® Turnstile™ — bot and abuse prevention on our public lead-capture form. Receives the IP address and browser details (its user agent and TLS fingerprint) of each visitor to the form, and a challenge token, to tell real visitors apart from automated bots. Cloudflare Privacy Policy
• Sentry® — application error monitoring. Receives diagnostic information about errors in your browser and on our servers (such as error messages, stack traces, a short record of what happened in the app just before the error, browser type, IP address, your account identifier, and references to the payments or sessions involved in the error), which may incidentally include limited personal data present when an error occurs. Sentry Privacy Policy
• Plausible Analytics — privacy-friendly usage analytics, loaded on our public pages and on signed-in application pages. Receives the address of the page you viewed, the referring site, general device, browser, and country information derived from your IP address, how far you scrolled and how long the page was open, and the names of a few steps you complete (such as signing up or sending your first invoice). Plausible sets no cookies and stores nothing on your device: it counts visitors using a hash it computes on its own servers from your IP address and browser, and rotates that hash daily. We never send it your name, email address, or account identifiers. Plausible Privacy Policy
• Waze® — optional turn-by-turn navigation from the Route Planner, offered on phones and tablets. If you tap a stop there, its Navigate button or Open in Waze, the destination address for that stop is passed to Waze in the link we open. Nothing is sent to Waze unless you tap it, and we send no customer name, phone number or job details. Waze Privacy Policy
• GitHub® — hosts our source code and the automation that tests it and applies changes to our database, and stores our published "Intel" articles. If you have bought a license, made a payment toward one on the monthly plan, or are renting right now, GitHub also stores an encrypted copy of your account's email address, so that we can tell you where to get the Kit if our service stops (Section 12 of our Terms of Service). Once a day our automation there reads the email address of each such account from our database, encrypts the list and replaces the copy it made the day before. The private key that opens it is not kept at GitHub or on our servers, and the copy is used for nothing else. The app asks GitHub for a small public status file when you open Settings, and again while our servers cannot be reached, so GitHub receives your device's IP address and ordinary request details. GitHub does not receive your business or customer data; when we change one account's settings through that automation (such as switching its offline mode off), the run records that account's identifier and business name. GitHub Privacy Statement

Google® Calendar Access

Own Your Tools requests access to your Google Calendar to put the jobs you schedule on it. Specifically, the app:

• Creates a calendar event when you schedule a job in the Scheduler or add one on the job screen, and, on the Job Map, when you tap a job's calendar button or Sync all
• Moves the event when you move its job in the Scheduler
• Deletes calendar events only when you delete the corresponding job in Own Your Tools
• Does not read the other events on your calendar

Calendar access is entirely optional. You can connect or disconnect your Google Calendar at any time from the Settings page. Your Google OAuth tokens are stored securely in our database with database-level access controls: they are never sent to the app on your device, our servers use them only to add, move and remove the calendar events described above, and no other user can read them. Apart from your name, email address and profile picture when you choose Continue with Google, we do not access any Google data beyond Calendar events, and we do not share your calendar data with any third party.

Own Your Tools' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data Storage and Security

Your data is stored in a Supabase™-hosted PostgreSQL database with the following security measures:

• Database-level access controls — applied to user-scoped business data (customers, jobs, invoices, proposals, expenses, mileage, inventory) so that users can only access their own records, except that a team member can see, start and complete a job you assign to them, with its notes, price and address and, where your account has it switched on, your customer's name, phone number and service address and the job's photos; and you can see the photos and checklists your team adds to your jobs. The files in our storage follow the same rules
• Encryption in transit — all data is transmitted over HTTPS/TLS
• Encryption at rest — Supabase encrypts stored data using AES-256
• Local browser cache — your data is cached locally in your browser for fast access, and most of it is synced to the cloud when connectivity is available. Messages you send in shared team channels are stored on our servers so that everyone in your organization sees them and they reach your other devices; they are not included in your data export, and are deleted with your organization (or, for messages you wrote, when your account is deleted). Some features are stored only on the device where they were created and are not synced to our servers, such as direct or job-thread messages made in earlier versions of the app and, for an account without offline mode, your automations, which of them are switched on, follow-up sequences and automation tasks, service plans and their visits, marketing campaigns and what they sent, and your saved route. For an account with offline mode on, your automations, which of them are switched on, your follow-up sequences and your automation tasks are kept on our servers with the account's other records, and reach its other devices.
• Offline mode: your records on your devices — for an account with offline mode on, the app keeps a copy of your business records in the browser's storage on each device where you use it, with the changes not yet sent and the photos you take or add there. Photos already sent to your account are kept on the device for viewing up to 100 MB, the oldest removed first; a photo not yet sent is never removed to make room. The copy leaves a device when you sign out there, unless something is still waiting to sync: then the app tells you and keeps the whole copy until the change is sent or you discard it. It also leaves when you delete your account from that device, and when another account with offline mode on signs in on that device, if nothing of yours is still waiting. There is no remote erase: if a device is lost or stolen, the copy stays on it until the app is signed out there or the browser's data is cleared, so protect your devices with a passcode or screen lock.
• No plaintext passwords — authentication is handled by Supabase Auth with bcrypt hashing

We retain your data for as long as your account is active. Not paying the annual platform fee does not close your account or delete any of your data: your account stays active, and you keep using it. If you request account deletion, we will permanently remove your account and associated data from our systems within 30 days; the business records you made in an organization someone else owns pass to its owner instead, except purchase orders and what was received on them, automations, and job photos, which are deleted. Your address leaves the encrypted copy of email addresses kept for Section 12 of our Terms of Service (see GitHub under Third-Party Services) at its next daily update after you ask us to delete your account. Some information may be retained longer where required by law (for example, transaction records for tax purposes) or in encrypted backups that are overwritten on a rolling basis. The records of monthly plan payments — for each, the account it was for, its amount, the months it paid for, its date and Stripe's references — are such records, and we keep them after an account is deleted. We also keep the phone numbers and email addresses that asked not to be contacted, so that we do not contact them again. A customer's request to stop your appointment reminders is kept until that customer or your account is deleted, and the record of each reminder is kept with its job, and deleted with it. Job photos are kept until they are deleted: deleting a job deletes its photos and the image files of those you took, and the image file of a photo a member of your team took on it stays in our storage until that member's account is deleted. When a member is removed from your team, the copy of their details is kept until your organization, or their account, is deleted.

Cookies and Tracking Technologies

Own Your Tools uses only a small set of cookies and browser storage technologies: those necessary to run and secure the service, and one that keeps how you first arrived on our site. We do not use advertising, analytics, or cross-site tracking cookies, and we do not load any third-party advertising trackers.

• Browser storage (essential) — we store your authentication session and cache your business data in your browser's storage (local storage and, for an account with offline mode on, the browser's database, IndexedDB) so the app loads quickly and, with offline mode, works without a connection. This data stays on your device. When you log out it is removed, except that items kept only on that device (such as service plans on an account without offline mode) are set aside, marked as yours, and put back when you next sign in there, and, with offline mode on, nothing is removed while a change is still waiting to sync (see Data Storage and Security). If a different account signs in on the device, the items set aside for you are deleted. Clearing your browser storage removes all of it.
• Cloudflare® Turnstile cookies (essential / security) — on our public lead-capture form only, Cloudflare Turnstile may set cookies (such as Cloudflare's "_cf" cookies) to tell real visitors apart from automated bots and prevent spam submissions.
• First arrival (not essential) — the first time you visit one of our public pages, the page keeps, in your browser's local storage, the page you landed on, the website that sent you (its name only), any campaign tag (its utm_source, utm_medium, utm_campaign and utm_content) or referral code (ref) in the link you followed, and when you arrived, so that it can be saved with your account if you sign up. It is sent to us only if you sign up, and it leaves your device once it is saved with your account, or 30 days after you arrived.

Own Your Tools does not display a cookie consent banner. You can block or delete cookies and clear local storage at any time through your browser settings, though doing so may affect functionality — for example, you may be signed out.

SMS Communications and Opt-Out

We text you only if you ask. When you tick "Text me when a customer accepts a proposal" beside your phone number, at sign-up or in Settings, we text that number each time a customer accepts one of your proposals online (Own Your Tools proposal alerts). Message frequency varies. Message and data rates may apply. To stop them at any time, untick the box or reply STOP to any of our texts; for help, reply HELP or email support@ownyourtools.work. We will honor your opt-out request, and you will no longer receive SMS communications from Own Your Tools at that number.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

We send no text messages to your customers. When the Job Map opens your messaging app with a message for your customer, you send it from your own number, and you are responsible for obtaining prior consent from your customers under applicable law (including the Telephone Consumer Protection Act in the United States) and for honoring opt-out requests they make to you.

Your Rights

You have the right to access, correct, or delete your personal data at any time. You can export your business data directly from the app (Settings), as one JSON file that also carries what is kept only on that device (with offline mode on, changes and photos the device has not yet sent are only in the .zip file below); photos stored on our servers are listed in it by where they are stored rather than included as image files. Settings also offers one .zip file that holds the same export with those photos and signatures as image files. You can also contact us at the email address below to request a full data export or account deletion. Team chat is deleted with your organization when you are its only owner; messages you wrote are deleted when your account is deleted. Team-chat messages are not included in the export.

If a business that uses Own Your Tools holds your details, for example as its customer or its supplier, that business decides what it keeps about you and what it sends you: ask it to see, correct or delete them. You can stop that business's appointment reminders with the link in any of them.

Depending on where you live, you may have additional rights under applicable privacy laws (such as the California Consumer Privacy Act). To exercise any of these rights, contact us at the email address below.

Changes to This Policy

We may update this privacy policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will provide notice via email to your registered address or via an in-app notification at least 14 days before the changes take effect.

Contact Us

If you have questions about this privacy policy or how your data is handled, reach out to us: