Legal

Privacy Policy

How FIELDFOLIO handles information, cookies, and customer data.

Updated Oct 14, 2026 (CT). This page also covers cookies and browser storage and how we handle customer data you enter, so it is all in one place.

1. Scope and your choice

This policy describes information handled through fieldfolio.io, the FIELDFOLIO web app, the iPhone app, forms, and related features. By using the service, you acknowledge that data handling has risks and agree to use it at your own risk.

In short: every plan needs an account, including Basic. On the free Basic tier your jobs are not synced to our cloud. Your account, and on paid plans your synced job data, are stored with our providers. We do not sell your personal information.

2. Information we may collect

  • Contact and account data: name, email, organization or business name, sign-in identifiers, support messages, and account settings. An account is required on every plan, including Basic, on the web and in the iPhone app.
  • Job content: photos, notes, checklists, customer or worker details, documents, timestamps, and folios you choose to create or share.
  • Crew and team data: crew invites, roles, seat membership and seat order, which jobs members add to a crew, and which jobs are tagged to which worker, when you use a Crew or team plan.
  • Crew notifications: reminders, deadlines, inspections and messages a crew leader sends to crew members (the job name, the message text, an optional due time, and whether it was marked done), your choice to turn crew notifications on or off, and, if you allow notifications in the iPhone app, the notification token Apple gives your phone so we can deliver them. The token is removed when you sign out.
  • Transaction data: plan, purchase status, trade packs bought (including the trade you picked for a one trade pack), GC seats, where you bought (website or App Store), renewal dates, and limited billing details from payment providers. Card numbers are handled by Stripe on our website and by Apple in the iPhone app. FIELDFOLIO does not store them.
  • Technical data: browser, device, pages or features requested, approximate diagnostics, and security events where available from hosting or authentication providers.
  • Storage data: preferences, drafts, and session information stored by your browser or device. See section 8.
  • Messages: what you write in the contact form, in the support form inside the apps, or in an email to us, and your email address.
  • Checkout reminders: if you start a checkout on our website with your email and stop before paying, we keep that checkout record, with your email, so we can send you one reminder email about it. We do not send one if you already own the item.

We do not ask for your precise location, contacts, or advertising identifiers. The app asks to use your camera or photo picker only when you tap to add a photo, and the microphone and speech recognition only when you tap to dictate a note. On the web, dictation uses your browser’s own speech service, which has its own privacy terms.

3. Local versus cloud data

Basic or local use keeps drafts, photos, preferences, and job records in storage on your device. Clearing browser data, changing devices, browser failures, theft, or device loss can remove local data. When you have a paid plan, your jobs and photos sync to your account so you can see them on your other devices when you sign in. Account and synced job data are processed by our providers, such as Supabase.

The iPhone app includes a copy of the app on your device, so jobs you save on the device work with no signal. FIELDFOLIO works offline for the parts that run on your device. Cloud sync catches up when you are back online. Until it does, the newest version of a job may exist only on the device where you made the change.

4. YOU CONTROL WHAT YOU ENTER

YOU ARE RESPONSIBLE FOR PERSONAL, CUSTOMER, EMPLOYEE, HEALTH, FINANCIAL, AND OTHER DATA YOU ENTER. Collect and share only what you are allowed to handle, give the notices that are required, get permissions, redact unnecessary details, set access appropriately, and honor deletion or access requests from your customers. Do not use FIELDFOLIO as a substitute for your own privacy, security, retention, or legal program.

5. Customer and worker data

This section is for businesses and people who put other people’s personal information into FIELDFOLIO, such as customer names, phones, addresses, photos, and worker details. It is a plain summary and not a signed data processing agreement. If you need a signed one, email support@fieldfolio.io.

Who does what. For the personal data of your customers, workers, and others that you add, you decide why and how it is used, and we process it on your behalf to run the service. For your own account, billing, and sign-in data, and for security and abuse prevention, we decide how it is used. Depending on the law that applies, you are the controller or business, and we are the processor or service provider for that customer content.

What we do with it. We store, sync, back up, display, and transmit it only to provide the service you asked for, to keep it secure, to follow the law, and as the Terms allow. We do not sell it, and we do not use it to market to your customers. We do not use your photos or data to train AI models. Only people with a need, such as support staff handling a request from you, can reach it, and they are bound to keep it confidential. We tell you if we get a legal demand for your data, unless the law stops us.

Your duties. You must have a legal basis and give any notices needed to collect and share customer and worker data with us, as section 4 of the Terms and the acceptable use rules say. You are in charge of what you enter, who you share it with, access in crew and team accounts, and answering requests from your customers. We will help you reasonably if one of your customers asks to see or delete their data. Email support@fieldfolio.io.

Breach notice. If we learn of a breach that affects your customer data, we will tell you without undue delay and give you what we know so you can meet your own duties.

Return and deletion. You can export what you need and delete your jobs or your account any time. Section 10 explains what is deleted and what is kept.

6. How information is used

Information may be used to provide, secure, maintain, troubleshoot, personalize, support, bill, and improve the service; respond to requests; prevent abuse; comply with law; and protect rights. We do not sell your personal information. We do not use your job content to create a public portfolio without your direction.

We do not sell or share your data for ads, including for cross-context behavioral advertising, and we do not run third-party advertising pixels. We do not use your photos or data to train AI models.

7. Sharing, providers, data location

We may share information with service providers that help us run FIELDFOLIO, under their own terms and policies, and with authorities or other parties when required by law or reasonably necessary to prevent harm, fraud, or abuse. Links and integrations can take you to third-party services that FIELDFOLIO does not control. Our current providers, and the data each one handles, are:

  • Cloudflare (Cloudflare Pages): hosts and serves the website and web app, runs our DNS, and provides network security. Cloudflare Turnstile may be used to tell people from bots on forms and sign-in if we turn it on. Cloudflare sees request data such as IP address and browser details. No job content is stored by Pages.
  • Supabase: sign-in and authentication, the database for cloud-synced jobs, profiles, and crew data, file storage for cloud-synced photos, and the functions behind account deletion and the contact form. Data: account data, job content, photos, crew data.
  • Stripe: payments on our website, subscriptions, and the customer portal for changing or cancelling a plan. Stripe collects your card details and billing information directly. No job content.
  • Apple: purchases made in the iPhone app are billed by the App Store under its own terms and privacy policy. Apple handles your payment details and does not get your job content from us.
  • RevenueCat: checks purchases made in the iPhone app with Apple and tells us what you bought. It gets your FIELDFOLIO account ID, your purchase receipts, and, for a one trade pack, the trade you picked. It does not get your jobs, photos, or customer details.
  • Cloudflare (Cloudflare Email Sending): sends email for us, such as support replies and the checkout reminder described above. Data: email address and message content. Sign-in and password reset emails come from our sign-in provider, Supabase.
  • PostHog: counts visits to the pages of our website. It gets the page address without anything after a question mark, the site you came from, your screen width, and the request data any website sees, such as IP address and browser details. It does not run in the apps and does not get your jobs, photos, or account details. Section 8 covers the details.
  • Forward Email: forwards mail sent to our support address to the people who answer it, so the content of your message passes through them.

Each provider handles data under its own terms and privacy policy. We choose providers with care, require protections that suit the data, and share only what each one needs to do its job. We will update this list if it changes. If you want to be told ahead of a change, email support@fieldfolio.io and we will add you to the notice list. If you object to a new provider for a good reason, tell us and we will work with you, which may mean you stop using the affected feature or delete your account. If you share a report or link, the people you send it to can see what is in it. If the business is sold or reorganized, your information may transfer to the new owner, who must honor this policy for data already collected.

Where data is processed. We are based in the United States and our providers process data in the United States, and may do so in other countries where they operate. Our Supabase project (database and file storage) is hosted in the US West (Oregon) region, us-west-2. Cloudflare delivers the site from its global network. If you are in the EEA, the UK, or Switzerland, your data is transferred to the United States. Where the law requires, we rely on the transfer tools our providers offer, such as standard contractual clauses or the EU-US Data Privacy Framework.

8. Cookies and browser storage

FIELDFOLIO uses a small amount of browser storage to work. We do not use advertising cookies, we do not run third-party ad or tracking pixels, and we do not sell browsing histories. What we store and why:

  • Theme: your light or dark setting, so the page does not flash on load.
  • Your work (Basic and offline use): jobs, photos, checklists, notes, your business profile, and your plan status are saved in your browser or app storage on your device. This is how FIELDFOLIO works offline.
  • Sign-in session: when you sign in, our authentication provider, Supabase, stores a session token in your browser so you stay signed in.
  • Plan and cloud sync state: a local copy of your plan status and what has synced, to keep the app fast and to work offline.
  • Acknowledgments: a flag that you saw and accepted the “Before you start” notice, so we do not show it again.
  • Abuse checks: small counters of recent sign-in, reset, and form attempts, stored on your device, to slow down misuse. If we turn on Cloudflare Turnstile, it may set its own data to tell people from bots.
  • Session-only items: a crew invite code you open from a link and a flag for the installed app, kept for that browser session only.
  • App files cache: a service worker saves the app files on your device so it can open without a connection.

These are strictly necessary for the app to work, so we do not ask for consent for them. Hosting by Cloudflare Pages and our other providers may set or read their own security or delivery data as part of serving the page.

Page counts. We count visits to the pages of our website with PostHog. This uses no cookies and saves nothing on your device. It sends the page address without anything after a question mark, the site you came from, and your screen width. It is skipped when your browser sends Global Privacy Control or Do Not Track, and it does not run in the apps.

Stripe and other sites. On our website, when you click a Buy button you go to a Stripe page. Stripe has its own cookies and privacy policy, which we do not control. In the iPhone app, purchases go through Apple and you do not leave the app for a Stripe page. The purchase tool in the app (RevenueCat) keeps a small record on your device so the app knows what you bought. The same goes for any other site we link to.

Your choices. You can clear or block storage in your browser or phone settings, or remove the app. If you block it, you may not be able to sign in or save jobs. Because your jobs can live in browser storage, clearing site data, using private browsing, switching browsers or devices, or low storage on your phone can erase them, so use cloud sync with a paid plan, or export and back up important jobs. Deleting your cloud account does not clear what is stored on your device. Clear it yourself in your browser or by removing the app. If we ever add something that needs consent, such as ads, we will update this page and ask first where the law requires it.

9. Security and data loss

We use reasonable measures that fit the service, but no website, device, transmission, database, or provider is perfectly secure. WE DO NOT GUARANTEE SECURITY, AVAILABILITY, RETENTION, OR RECOVERY. You use the service at your own risk when it comes to data loss and must keep independent backups of important records. Do not enter data whose compromise would create unacceptable risk.

Connections to FIELDFOLIO use HTTPS. Access to cloud data is controlled by account and database rules. To report a security problem, see Security and Vulnerability Disclosure. If a breach affecting your personal information happens, we will tell you as the law requires.

10. Retention and deletion

We may keep information as long as needed to provide features, meet business and legal obligations, resolve disputes, prevent abuse, and enforce agreements. Local data is controlled by your device and browser. You can delete your account in the app, and the steps are on this page.

When you delete your account, we delete your saved jobs, notes, and checklists in our cloud; your photos in our cloud storage; your customer links, so shared reports stop working; your crew memberships and profile; and your login. We keep a billing record of what was bought and when, with your login removed from it. Stripe keeps payment and tax records as the law requires. Short-term security and backup copies can sit in logs or backups for a limited time before they age out: backup copies age out within about 35 days after deletion, and server and security logs are kept for about 30 days. Copies can also remain in legal records or in the systems of people you shared a report with. Jobs and photos saved only on your device are not on our servers, so deleting your account does not clear them.

If you pay for a plan on our website, deleting your account tries to cancel it with no refund. Deleting your account does not cancel an App Store subscription, so cancel that in the store first. Apple and RevenueCat keep their own purchase records under their own policies. Support emails are kept as long as needed to help you and to keep a record of the request.

11. Children

FIELDFOLIO is for adults only. Nobody under 18 may use it, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 provided information, contact us through the Contact page so we can review it. If we learn an account belongs to someone under 18, we will delete it.

12. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, export, or restrict certain personal information, or to object to certain processing. We may need to verify identity and may have lawful exceptions. You can also clear local browser storage, stop using optional features, or contact us. We do not discriminate against you for using a privacy right.

To use a right, email support@fieldfolio.io from the address on your account. We aim to answer within 30 days. If we cannot do what you ask, we will say why. You can designate an authorized agent to make a request for you, and we may ask for proof that they act for you.

California residents. Under the California Consumer Privacy Act (as amended), California residents can ask what personal information we collect, use, and disclose; ask us to correct or delete it; ask for a copy; and opt out of the sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of. We collect the categories listed in section 2, for the purposes in section 6, and disclose them to the providers in section 7 for business purposes.

People in the EEA, UK, and Switzerland. FIELDFOLIO is offered to people worldwide. If the GDPR or UK GDPR applies to you, we process your personal information to carry out our agreement with you (accounts, sync, billing); for our legitimate interests in running and securing the service; to meet legal obligations; and with your consent where we ask for it, which you can withdraw. You can ask for access, correction, deletion, restriction, portability, and to object, and you can complain to your local data protection authority. Transfers to the United States are covered in section 7. We have not appointed an EU or UK representative at this time.

Do Not Track. Our site does not track you across other sites, so we do not act on Do Not Track signals for that. We do honor Global Privacy Control and Do Not Track by skipping our page counts, and we treat Global Privacy Control as an opt out of sale or sharing, even though we do not sell or share.

13. Changes and contact

We may update this policy as the service or law changes. The “Updated” date identifies the current version, and continued use after posting means you accept it to the extent the law allows. If a change is a big one, we will put a notice on the site or in the app.

Privacy questions and rights requests: use the Contact page or email support@fieldfolio.io. Do not send sensitive personal data that is not needed to identify your request.

All legal documents