Privacy Policy

1. What Data We Collect

Account information: Your email address and password (or authentication provider) when you create an account.

Receipt images and data: Photos of receipts you upload, and the data extracted from them (store names, items, prices, dates, payment methods).

Project and expense data: Project names, budgets, labor expenses, and other cost data you enter into the Service.

Invoice data: Client names, email addresses, and invoice details you create within the Service.

Usage data: We track which features you use and how often to improve the Service and enforce plan limits. This includes API call counts and approximate costs.

2. What We Do NOT Collect

We want to be explicitly clear about what we do NOT do:

• We do NOT access your bank accounts — we have no connection to your bank, credit card company, or any financial institution
• We do NOT store credit card numbers — all payment processing is handled by Stripe, a PCI-compliant payment processor. We never see your full card number
• We do NOT collect your Social Security number, tax ID, or government identification
• We do NOT access your phone contacts, camera roll, or other device data beyond what you explicitly share (e.g., taking a receipt photo). Location data is only accessed when you explicitly enable GPS features in Settings
• We do NOT track you across other websites or apps
• We do NOT collect your clients’ personal information beyond what you voluntarily enter into invoices (client name, email, address)

3. How We Use Your Data

Your data is used exclusively to provide and improve the Service:

• Receipt processing: Your receipt images are sent to Google Gemini for data extraction first. If Gemini isn’t available or can’t process the image, it’s sent to Anthropic Claude instead. When Gemini succeeds but can’t tell whether a payment proof is money in or money out, the same image is also sent to Claude for a second opinion. Receipt PDFs go straight to Anthropic Claude. The AI processes the image and returns structured data. Per our AI providers’ API policies, the receipt images we send them are not used to train AI models.
• Cost tracking: Your receipts, expenses, and project data are used to calculate your budgets, margins, and reports
• Service improvement: We use aggregate, anonymized usage statistics to improve the Service. We never use individual financial data for this purpose

4. We Never Sell Your Data

We do not sell, rent, or trade your personal data or financial information. We do not share it with any third party for marketing or advertising.

The service providers that help us run the Service are listed in Section 6.

5. Data Security

We take the security of your data seriously:

• Encryption at rest: All data stored in our database is encrypted
• Encryption in transit: All data transmitted between your device and our servers uses TLS/HTTPS encryption
• Row-Level Security (RLS): Your data is isolated at the database level — our system enforces that each user can only access their own data. No other customer account can see your receipts, projects, or financial information
• Authentication: All API endpoints require authentication. Unauthorized requests are rejected
• Rate limiting: API endpoints are rate-limited to prevent abuse

6. Third-Party Services

We use the following third-party services (sub-processors) to operate and maintain the Service. Each is bound by its own privacy policy. The notes below describe the main ways we use each service.

• Supabase: Database, authentication, and encrypted file storage. Your account, receipts, and uploaded images are stored here.
• Anthropic (Claude AI): Our AI helper for everything except the first read of a receipt photo. We send Claude: what you type in the in-app AI chat and the help chat, and text you dictate by voice; bids and quotes you upload; plans and blueprints; contracts, insurance papers and other job documents; cost sheets; a job’s numbers, receipts and labor lines (including worker names) when you ask for a job briefing or a job completion report; a homeowner’s intake form, including their name and address, when you ask the AI to read a lead; your yearly totals and job names for the summary in the tax package; messages sent to the chat assistant on our website; receipt PDFs; and receipt photos when Gemini is unavailable, fails, or can’t tell which way a payment went. Per Anthropic’s API policy, data sent via the API is not used to train models.
• Google (Gemini API): Our primary receipt-image data extractor. Receipt images are sent to Gemini first. If Gemini isn’t available or fails, the image is sent to Claude instead; if Gemini succeeds but can’t tell whether a payment proof is money in or money out, the same image is also sent to Claude for a second opinion. Per Google’s API policy, data sent via the paid API is not used to train models.
• OpenAI (Codex): A coding assistant we use for software development and debugging. To help us find and fix bugs, it has read-only access to our production database and can read the records stored there, including account, project, crew time and pay, location, and client information. It cannot change or delete data through this connection.
• Vercel: Application hosting and edge delivery. Standard server logs (IP address, request path, user agent) are retained for security and abuse-prevention purposes. Vercel also collects page views and web-vitals performance data from your browser through its Speed Insights and Analytics tools, so we can see which pages are slow or broken.
• Stripe: Payment processing for paid subscriptions. Stripe collects your billing address, payment card details, and tax information. We never see your full card number. Stripe is PCI-DSS Level 1 certified.
• RevenueCat: Subscription management for in-app purchases on iPhone, iPad and Android. RevenueCat receives your account ID and your purchase and subscription events (which plan, when it started, renewed, or lapsed) so we can tell which features your account has. RevenueCat does not receive your email address, your name, your receipts, or any job or financial data.
• Apple (App Store purchases): In-app purchase verification. When you subscribe through the App Store, we send Apple the transaction identifier for that purchase so Apple can confirm it is genuine and still active. Apple does not receive your receipts, job data, or crew information through this.
• Sentry: Error monitoring and crash reporting. Collects stack traces, device/browser metadata, and (when an authenticated request errors) your user ID, so we can fix bugs. We do not send receipt content, project data, or financial figures to Sentry.
• PostHog: Product analytics. Records usage events (page views, feature usage, subscription tier, and aggregate invoice totals) tied to your user ID so we can see which features to improve. Receipt image content and individual receipt line items are not sent to PostHog.
• Resend: Transactional email delivery (welcome emails, password resets, billing receipts, invoice notifications). Resend processes the recipient email address and message content.
• Twilio: SMS delivery. Twilio is our messaging carrier and transmits the mobile phone numbers and message content needed to deliver transactional texts. That message content can include a worker’s pay total and your business name on a pay-stub text, a customer’s name and email address on an owner alert, and a jobsite address on a daily plan text. Twilio does not receive receipt images or uploaded documents, and may not use these numbers for any other purpose.
• Apple (Push Notifications): Push notification delivery to iPhone and iPad. When you have push notifications enabled, we send Apple the notification’s title and body text — which can include a worker’s name and job details — plus your device’s push token, so Apple can deliver the alert to your device.
• Google (Firebase Cloud Messaging): Push notification delivery to Android devices, via Firebase Cloud Messaging. When you have push notifications enabled, we send Google the notification’s title and body text — which can include a worker’s name and job details — plus your device’s push token, so Google can deliver the alert to your device.
• Browser push services: Push notification delivery to a desktop or mobile web browser. When you enable browser notifications, the notification is encrypted on our server before it is sent, so the push service your browser uses (Apple, Google, Mozilla or Microsoft, depending on whether you are on Safari, Chrome, Firefox or Edge) relays it without being able to read it. That service does see your browser’s push endpoint address and the timing of the message.
• Cloudflare (Turnstile): Bot and abuse protection on sign-in and on our public forms. Cloudflare’s check runs in your browser and receives your IP address and browser signals to tell people from bots. We do not send it your account, project, or financial data.
• OpenStreetMap (Overpass API and Nominatim): These public OpenStreetMap services are used three ways: (1) Store detection (Overpass API) — when you have enabled GPS features, the coordinates of a stop are sent to it, with a search radius, to find a nearby supply store. (2) Address-to-map lookup (Nominatim) — when you or an AI-extracted document sets a jobsite or customer address, that address text is sent to it to turn into map coordinates. (3) Bid-builder reverse lookup (Nominatim) — when you tap to use your current location in the bid builder, your device’s coordinates are sent to it to turn into an address. Overpass and Nominatim are separate OpenStreetMap services with their own policies. None of these requests carry your name, email, or account ID. When the lookup runs from your device, the service also sees your IP address.
• Google (Places API): Backup for store detection. If the map service above has no answer, our server sends the same coordinates and search radius to Google to find a nearby store. The request carries no name, email, or account ID.
• Apple and browser speech services (voice entry): Speech-to-text for the voice buttons. In the iPhone app, Apple’s speech service does this — on your phone when it can, on Apple’s servers when it cannot. On the web, your browser’s own speech service does it (for example Google in Chrome, Apple in Safari). We receive only the text, never the audio.
• Apple (Sign in with Apple): If you sign in using Apple, Apple relays a verified email (or a private relay address) and a unique identifier to us. Apple’s own privacy policy governs that relay.
• Google (Sign in with Google): If you sign in using Google, Google provides your verified email and basic profile to us. Google’s own privacy policy governs that exchange.

A current list of sub-processors is maintained on this page. We will update it before adding new sub-processors that materially affect how your data is processed.

7. Location Data

When you allow location access on your phone, the app checks your location against your jobsites and against supply stores (like Home Depot). Outside those checks and the moments listed below, it does not track where you go. While the app is open, your phone keeps a short list of places where you stopped (up to 500, rounded to about 11 meters) to spot store visits; that list stays on your phone and is not uploaded.

Specifically, location data is used for:

• Supply-store visits: If Store Visit Data Storage (Settings > Privacy & Data) is on for you, the app notices when you stop at a supply store so it can remind you to save the receipt; it is off by default for accounts created since October 11, 2026. If you work on a business’s crew and the owner turned on store alerts for you, the owner is told when you leave: the store’s name (when the app could confirm it) and about how long you stayed, also when you are not on the clock (see Section 8)
• Jobsites and hours: When you arrive at or leave a jobsite you are assigned to, the app can clock you in or out, or ask you to; arriving outside work hours never clocks you in automatically. While you are at one of your jobsites, it records your location in the background about every 15 minutes to confirm your phone is still there; it normally stops when you leave the jobsite. Each background record holds the location as your phone reports it (position, accuracy, speed and heading). The app also uses your phone’s motion sensor to sense arriving and leaving. When you clock in or out in the app, your phone’s location at that moment (if it shares one) is saved with the shift
• Receipts and addresses: When you save a receipt photo, the app may read your location once and save it with the receipt, to help suggest a nearby job. When you ask the app to fill in an address from your current location, it reads your location once and turns it into an address (see Section 6)

Location is collected only with your permission: while the app is open, or in the background if you chose “Always”. We do not sell location data or share it with advertisers. Removing the app’s location permission in your phone’s settings stops all location use. In the app’s Settings, turning off Automatic jobsite clock-in stops background location; Privacy & Data > Location Tracking turns off store checks, receipt-photo location and clock-in location while the app is open (a check already running stops when the app next starts); and Privacy & Data > Store Visit Data Storage stops store visits from being saved. Background location and the location saved with shifts and visits are removed automatically after 90 days (your hours, visit times, and which jobsite or store you visited stay) — see Section 9. The location saved with a receipt photo stays with that receipt until the receipt or your account is deleted.

8. Employee Location Tracking

If you use the team features, your business’s Employee Location Tracking switch is on by default. The owner can turn it off in Settings > Privacy & Data; when it is off, the app stops saving team members’ location for that business. Employers are responsible for telling their team members about location tracking and for getting any consent the law requires.

When employee location tracking is on:

• A team member’s phone checks their location against the business’s jobsites, also outside work hours, once that person has allowed location access on the phone; supply stores are checked too when Store Visit Data Storage is on for that person (off by default for accounts created since October 11, 2026)
• Automatic clock-in and clock-out for a business happen only after the team member agrees in the app for that business; without that, the app asks them first. While they are at a jobsite, their location is recorded about every 15 minutes to confirm the phone is still there, and while the app is open it shows a “GPS active” sign on most screens
• The employer can see when team members clocked in and out and at which jobsite. The location saved at clock-in and clock-out, and with receipt photos, is part of the business’s records (for example in its data export). Arriving at a jobsite outside work hours does not clock anyone in automatically
• If the employer turned on store alerts for a team member and Store Visit Data Storage is on for that person, the employer is told when they leave a supply store after a stop of 5 minutes or more: the store’s name (when the app could confirm it) and about how long they stayed, also when they are not on the clock (at most 3 alerts a day for each team member). The app does not give the employer a live map or a trail of where team members go
• If your phone has a setting that blocks automatic clock-in or clock-out, your employer can see which setting (not your location).

Employers are responsible for following the employment and privacy laws that apply to them, including any notice and consent rules in state biometric or location privacy laws (such as the Illinois BIPA, Texas CUBI or the California CCPA).

9. Data Retention & Deletion

We retain your data for as long as your account is active. If you cancel your subscription, your data remains accessible (read-only on the free plan). If you request account deletion, all data is permanently removed within 30 days.

Regarding specific data types:

• Receipt images: Stored in encrypted cloud storage (Supabase Storage). Deleted when you delete the receipt or your account
• Location history: Automatically removed after 90 days, whether or not you ask. Raw background-location events are deleted outright. On the records that back your pay — clock-in/out entries, jobsite visits and supply-store visits — the coordinates are erased while the times, hours and pay status are kept, because that is your wage record and you may need it to answer a pay dispute. Anything still held is deleted with your account
• AI processing data: Receipt images are sent to Google Gemini for real-time data extraction first. If Gemini isn’t available or fails, the image is sent to Anthropic Claude instead, and if Gemini succeeds but can’t tell a payment proof’s direction, the image is also sent to Claude for a second opinion. Per our AI providers’ API policies, this data is not used to train AI models and is retained by the provider only briefly, in line with its standard data-retention policy

You can request deletion of all your data at any time by visiting our account deletion page or by emailing chris@jobcostpro.online.

10. Your Rights

You have the right to:

• Access all data we store about you — all your data is visible to you within the app at all times
• Export your data at any time using the built-in export features (CSV, spreadsheets, ZIP)
• Request deletion of your data — you can archive and permanently delete individual receipts, expenses, and projects. To delete your entire account and all associated data, use the Delete Account page at jobcostpro.online/delete-account
• Opt out of non-essential data collection — turn off location as shown in the next item. For anything else, email chris@jobcostpro.online
• Disable GPS tracking at any time — turn off Automatic jobsite clock-in in the app’s Settings to stop background location, or remove the app’s location permission in your phone’s settings to stop all location use
• Withdraw your consent — turn off location as shown in “Disable GPS tracking at any time” above. To withdraw consent for anything else, email chris@jobcostpro.online or delete your account in Settings.
• Correct your data — you can edit project names, expense details, and other information

11. Cookies

We use essential cookies only — for authentication and session management. We do not use tracking cookies, advertising cookies, or analytics cookies from third parties.

12. Children’s Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect data from minors.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email. The “Last updated” date at the top reflects the most recent revision.

SMS / Text Messaging

When you provide a phone number for yourself, a worker (when you invite a teammate to your jobsite), or a client (when you set up a project), Job Cost Pro may send transactional SMS messages to that number through our messaging carrier (Twilio).

We send SMS for the following purposes only — never for marketing or promotion:

• Worker invites — a one-time message containing a sign-in link when you invite a worker to a jobsite.
• Payment reminders to clients — a text alert when an invoice you have sent becomes overdue, sent only if you have opted into client SMS in Settings → Notifications.
• Account and billing alerts to you — AI-spend threshold alerts, login codes, and other security notices to your account phone number.

SMS data we collect: the mobile phone numbers entered for you, your workers, or your clients, and an opt-in consent record for each number — the exact disclosure text shown at capture, who provided or attested the consent, and when. We retain these consent records as proof of opt-in for as long as we may send SMS to that number and as required by law.

Frequency: Message frequency varies. Transactional messages only — typically fewer than five (5) messages per month per recipient. There are no scheduled or recurring promotional sends.

Opt-in / consent: when you enter a phone number for a worker or a client, you confirm that you have that person’s consent to receive these messages. We do not auto-collect phone numbers from contacts or third-party sources.

Opt-out: every message includes "Reply STOP to opt out." Replying STOP unsubscribes that number permanently from all Job Cost Pro SMS. Replying HELP returns our support contact (chris@jobcostpro.online).

Carrier rates: Message and data rates may apply, charged by your carrier — we do not charge for SMS itself.

Privacy of phone numbers: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Mobile phone numbers and SMS opt-in data will never be sold, rented, or transferred to third parties or lead generators for any purpose. Phone numbers are used only to deliver the message types described above and are stored encrypted at rest in our database.

How consent is captured (Call to Action)

Below is the exact wording shown to an account holder inside Job Cost Pro at every point we collect a phone number. The account holder must check the consent box before the form will save the number — it is impossible to enter a phone number without the explicit attestation. Reviewers and customers can verify this flow in real time by signing up for a free account at jobcostpro.online and visiting Team → Add member, or Projects → New project.

14. Contact & Data Controller

Salvation Home Remodeling LLC, doing business as Job Cost Pro, is the data controller for any personal information you provide. For privacy questions, data access, correction, or deletion requests, contact us at:

To delete your account and all associated data without contacting us first, visit our account deletion page. We respond to verified requests within 30 days.