Privacy

We keep as little as we can, and this page lists all of it. Last updated: [date, on review].

Using it without an account

You can design a building without signing in. Your design stays in your own browser, on your own device. We don't receive it unless you save it to an account. A small session cookie (sid) lets the app talk to our server. Without an account, the cookie holds nothing about you.

Signing in with Google

When you sign in with Google, we ask Google for the least it will give: your email address and a stable account identifier. We never see your password, contacts, or calendar. We keep the identifier, your email address, and the date you joined. While sign-up is by invitation, we check your email address against the invitation list when you sign in.

Signing in with an email address and a password

You can also make an account with an email address and a password. We store the password only as a scrambled record that can't be turned back into the password. We never store the password itself. To confirm the address is yours, we send a link to it. To reset a forgotten password, we send a one-time link to the same address.

Profile fields

Your profile can hold a name, a phone number, an address, and a photo. All of them are optional. You type them, only you see them, and we use them only to fill in the paperwork you generate.

Saved plans

A saved plan is the short list of choices that describes a building, plus the name you gave it. It's private to your account. If you share a plan, it gets a public page on this site that shows the building and its cut list. The page never shows who owns the plan. Unshare the plan and the page is gone.

Analytics

This site has no third-party analytics script and no analytics cookie. Nothing on any page talks to anyone but our own server. Our server counts visits itself: the day, the page, where you came from, and whether you used a phone, a tablet, or a desktop. To count how many different people visited in a day, it makes a scrambled code from your network address and browser, using a secret that changes every day and is then discarded. The code can't be turned back into you and can't be matched to the next day. We never store your address. The app also counts which of its modes were opened and any errors it hit, by day, with nothing that names you.

Server logs

When a request fails, the server writes one line to its log: the time, the method, and the path, so we can find the fault. It keeps no log of ordinary requests. Our hosting provider's network logging is theirs and is described in their policy.

Where it's kept

Everything is in one database on one server rented from Hetzner in the United States. We take a copy every hour for recovery, and we send a copy to offsite storage when that is set up. We use backups for recovery and nothing else.

Retention

Your account, profile, and plans are kept until you delete them or ask us to. Sessions expire on their own. A deleted account can remain in a backup until that backup is retired. [Owner: set the backup retention period to state here.]

Your rights

Your profile and your plan list show everything we hold about you. You can change or delete any of it there. From your profile you can export all of it as one file, or delete your account and everything under it. You can also ask us to do any of that for you. We don't sell your data, don't share it with advertisers, and don't use it to train anything.

Contact

For questions about this page, or a request about your data, write to info@squareplumb.net.