Privacy policy
What this page is
This is the privacy policy for GC Field Log. It is written for [FOR GREG'S REVIEW: business name].
It describes what this website does with data. It is a draft. It is not legal advice.
The date on this draft is [FOR GREG'S REVIEW: effective date].
Your account
You can sign in with an email and a password. You can also ask for a one-time email link.
Supabase Auth stores that account. A profile stores your email and your role.
The roles in the app are viewer, full, and puller.
Cookies and sign-in
A sign-in cookie keeps you logged in. Another cookie remembers that Procore is connected.
A few short-lived cookies are used only while you connect Procore.
Signing out clears the sign-in cookie. An old unused cookie is cleared too. It is not a way to sign in.
Procore
If you connect Procore, we store tokens for your user in Supabase. Those are an access token and a refresh token.
We also store when the token expires, the Procore user id, a company id, and the email on that connection.
You can save a separate email for sheet-revision alerts.
When a puller refreshes a pack, the app reads companies, projects, drawing revisions, and RFIs from Procore.
Room pack snapshots are stored in Supabase. A snapshot has the project, the room, and the sheet list.
You can disconnect Procore on the Account page. That deletes the stored tokens for your user. It also asks Procore to revoke the access token.
Notes you save
A saved RFI can include a subject, a description, a location, a sheet id, a markup link, and a status.
Markups can include circles, boxes, arrows, and text notes.
Share folders and pinned sheets are stored for the folder owner.
An invite can store a role and an email address.
These rows live in the Supabase database when that database is turned on.
Photos
A photo you attach to an RFI stays in this browser. It is saved with the draft in local storage.
It is not uploaded to Procore. The RFI row in the database does not include the photo file.
Voice
Dictation sends a short audio clip to this website's server. The server sends that clip to xAI (Grok) to turn it into text.
Read-aloud sends the words on the screen to xAI to make spoken audio.
This app does not save those clips in its database.
Time and place
The time page can record punch in and punch out.
A punch can include latitude, longitude, accuracy, and distance from the job fence.
A job site stores a fence center and a radius. A worker row can store a name, a role, and an email.
Punches are stored in Supabase when that storage is turned on.
Billing
If you subscribe, checkout is handled by Stripe. We can send Stripe your email and your user id.
Stripe collects the payment method. This app does not store your card number.
We store the Stripe customer id, subscription id, status, trial end, and email in Supabase.
If billing is not turned on, the pricing page does not charge you.
Invite emails and share-link emails are sent with Resend.
A share-link address is used to send that message. The app does not keep a separate list of those addresses.
Sheet-revision alerts go to the notify email you saved. Those alerts use Resend. If Resend is not set up, they use Gmail.
An alert names the sheet and the new revision. This app does not send text messages.
Sheet PDFs
Sheet PDFs are fetched by our server. The server uses a Google Drive service account with read-only access, or a public PDF link.
Your own Google account is not connected.
A pack and its PDFs can be saved in this browser for offline use. That copy uses IndexedDB and the browser cache.
On this device
The browser can keep RFI drafts, material-order drafts, and markup backups in local storage.
Offline pack snapshots use IndexedDB.
Hosting
The website is hosted on Vercel. This code does not add a web analytics tool.
Ask us to delete your data
There is no delete-account button in the app.
You can disconnect Procore yourself on the Account page.
To ask for the rest of your data to be deleted, open the Support page. Write to [FOR GREG'S REVIEW: support email].