Privacy Policy

Effective date: July 24, 2026 · Last updated: July 24, 2026

1. Introduction

This Privacy Policy explains how The Trades Tracker LLC (“TradesTrack”, “we”, “us”, or “our”) collects, uses, shares, and retains personal information when you use the TradesTrack mobile application, website, and related services (the “Service”).

TradesTrack is a field-service and timeclock platform for trade businesses. Much of the data in the Service is entered by an employer (Admin) about its own workers and customers. In those cases, the employer is the data controller and TradesTrack acts as a processor / service provider on the employer’s behalf. Where we determine the purposes of processing (for example, account and billing administration), we act as the controller.

2. Information We Collect

2.1 Account information

When a company account and its users are created, we collect, for each user: name; email address (optional per user); phone number (optional per user); role (Admin, Office, or Crew) and account status; and preferences such as time-display format (12h/24h).

2.2 Time and payroll data

For workforce timekeeping we collect, per time entry: employee identifier and date; start and end times; live clock-in / clock-out punch timestamps; breaks (for each break, its type — lunch, rest, travel, or other — and its length in minutes; travel is recorded separately because travel time can carry different pay treatment); total hours and free-text notes; approval-workflow data (approval status, reviewer’s notes, and who approved an entry); and a pay rate where the employer records one.

2.3 Location (GPS) data — collected today

The mobile app records the device’s GPS coordinates at clock-in and at clock-out (latitude/longitude), to support payroll accuracy and job verification. The employer can see that location on the time entry.

Location is captured only at those moments. The app uses the device’s foreground (“while using the app”) location permission, takes a single reading at the punch, and never tracks location in the background — not between punches, not after hours, and not when the app is closed.

If a worker declines the location permission, the Service still works: the punch is recorded and the location fields stay empty.

These coordinates are sent to Google in one of two ways: (a) where the app is built with a Google Maps key, opening a time entry automatically requests a map image from Google Maps with the coordinates in the request; and (b) tapping “Open in Maps” passes the same coordinates to Google Maps. The request goes from the device directly to Google — it does not pass through our servers, which is why Google is an independent recipient and not a processor (Section 5). The employer is the controller of this data (see Section 10).

2.4 Job, quote, and customer data

Admins, Office users, and Crew enter business records including: jobs (job name, address, notes, status); quotes and quote lines (including a customer/client reference); job reports and catalog/line items; and invoices and payment records. Invoices can be created, sent, and viewed by your customer through a link, and a payment you received yourself (check, cash, bank transfer) can be recorded against an invoice.

Job and customer addresses are disclosed to a maps provider when someone taps them. Tapping an address opens directions, which hands that address to Apple Maps, Google Maps, or Waze, depending on the maps app chosen on the device. On iPhone, with no choice made, it goes to Apple Maps by default (see Section 5).

2.5 Photos

The Service lets users attach photos to job reports as field evidence. For each photo we store the image and metadata: the capturing employee, capture time, caption, image dimensions and size, and an upload/sync status. Every photo is re-encoded when added — whether taken with the camera or picked from the library — which strips EXIF metadata, including any camera-embedded GPS location; stored photos therefore do not retain location data from the camera. Photos are uploaded to our object storage (Cloudflare R2) so the office can see them, using short-lived presigned URLs; the app holds no storage credentials.

2.6 Payment information

When paid subscriptions launch, payment will be processed by Stripe. Stripe collects and stores your payment card and billing details directly. We receive limited billing metadata (such as subscription status and customer identifiers) but do not store full payment card numbers. When online payment collection launches, you will be able to collect payments from your own customers through your own connected Stripe account; those payments go to you directly, and we receive the transaction metadata needed to record the payment against your invoice.

2.7 Device and technical information

To operate the app we collect technical information such as device/app identifiers, app version, and basic logs. We use Sentry to collect crash and error diagnostics (for example, an error message, a stack trace, the app version, and device model) so we can find and fix defects; this happens only in builds that carry a Sentry key. The app keeps a local copy of your data on the device (an on-device SQLite database) so it works offline on a jobsite; that local copy is a cache, and our hosted database is the system of record.

3. How We Use Information

• Create and administer company accounts and user roles.
• Record and calculate time, breaks, and payroll-relevant totals, and support the review/approval workflow.
• Record clock-in/clock-out location for payroll accuracy and job verification (Section 2.3).
• Store and display job reports, quotes, invoices, and photos.
• Process subscriptions, billing, and trials via Stripe, and — when invoicing payments launch — process payments from your customers to you.
• Provide data export (CSV) and respond to data requests.
• Maintain security, prevent abuse, debug (including crash diagnostics), and comply with legal obligations.

We do not sell personal information.

4. Legal Bases (where GDPR/UK GDPR applies)

Where applicable, we rely on: performance of a contract (providing the Service), legitimate interests (security, service improvement), legal obligation, and consent (for example, device location permission). Where TradesTrack acts as a processor for an employer, the employer is responsible for establishing the legal basis for processing employee data — including location data (Section 2.3).

5. Where Your Data Goes

This list is derived from where data actually leaves the Service. The recipients fall into two legal categories.

Processors — acting on our behalf, on our instructions

Independent recipients — receiving data for their own purposes, under their own terms

These are not processors. A maps provider that receives an address uses it as an independent controller; we cannot instruct it and we cannot make it delete anything.

We may also disclose information to comply with law, enforce our terms, or protect rights and safety, and in connection with a merger or acquisition.

6. Data Storage and Security

Your data is stored in a hosted database (Supabase/Postgres) with tenant isolation per company. Files are stored in Cloudflare R2, and the distinction matters: job photos are private and reachable only through short-lived signed links, while your company logo is public because it is customer-facing branding printed on the invoices you send — do not use a logo file you would not publish. The mobile app also keeps a local copy on the device (on-device SQLite) so the crew can work without a signal; it syncs when the device is back online. We apply reasonable technical and organizational measures to protect data. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

7. Data Retention and Deletion

Retention is defined in our Terms of Service, Section 7.3, which is the canonical statement. In summary: we keep your data for as long as your account exists — including while an account is read-only; we do not run an automatic deletion schedule; you can export your data at any time (Section 8); and we delete your data when you ask us to (Section 8).

8. Your Rights

Depending on where you live, you may have rights to: access the personal data we hold about you; export your data (the app supports CSV export today, at any time — payroll/time, job reports, catalog lines; photos attached to job reports are viewable but have no export path in the product); correct inaccurate data; delete your data (GDPR Article 17 and CCPA/CPRA deletion rights); object to or restrict certain processing, and withdraw consent (for example, by disabling device location permission). For California residents: precise geolocation (Section 2.3) may be sensitive personal information under the CPRA, with a right to limit its use.

Because much workforce data is controlled by the employer, requests from employees regarding employer-entered data may be directed to the employer (controller); we will assist the employer as a processor. Account-level and billing requests can be made to us directly. To exercise rights, contact support@thetradestracker.com.

9. Children’s Privacy

The Service is intended for businesses and is not directed to children. All users must be at least 18 years old. We do not knowingly collect personal information from anyone under 18; if we learn that we have, we will delete it.

10. Location Notice

The app records your location at clock-in and at clock-out. It does this with the device’s foreground (“while using the app”) permission, and it never tracks you in the background. When someone opens that location, the coordinates can go to Google Maps (Section 5).

If you are an employer: you are the controller of your crew’s location data, and you are responsible — now — for giving your crew any legally required notice of monitoring and obtaining any consent required by law before relying on location capture. Several states require written notice of electronic monitoring, and some treat precise location as sensitive personal information.

If you are a crew member: you can decline or disable the location permission at any time in your device settings. The Service will still work — your punch is recorded and the location fields stay empty.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email, and the “Last updated” date will be revised.

12. Contact

Questions or data requests:

The Trades Tracker LLC
Michigan, USA
Email / data requests: support@thetradestracker.com