Controller
Setclock Inc., a New York business corporation,
421 Hudson Street Apt 601, New York, NY 10014, USA
Email: [email protected] · Phone: (646) 345-6775
1 Information we collect
Depending on how you use Tool Shanty, we may collect:
- Account credentials — email and password via Firebase Authentication (email/password only; we do not use phone OTP or social login).
- Profile information — such as full name, display name, nickname, legal name, US phone number, email, avatar preset (curated colors/assets — not your photo library), company memberships, and related timestamps. We keep a history of up to 100 previous display/legal name entries, including changes made by authorized crew leaders.
- Jobsite and crew information — jobsite name and address text, membership roles and status, invite codes, company/jobsite labels, and copies of crew names, email addresses, phone numbers, and avatars used in jobsite records. Access within a jobsite, by company Administrators, and through partner sharing is described below.
- On-site labels, availability, and attendance — manual location labels, status notes, and running-late reports entered by you or authorized crew leaders. Reports can include the degree of lateness, a reason such as transit, weather, or personal circumstances, notes, arrival information, and who recorded the report. Tool Shanty does not collect GPS location.
- Operational records you or your crew create — such as tool custody/orders, break and material records, bulletin posts, tasks, and calendar/attendance entries (typically including user id and display name).
- Device and browser storage — preferences, the selected jobsite, drafts, push settings, and local notification history. The web portal also keeps sign-in state in browser storage. On supported mobile devices, we use encrypted offline database snapshots, queued changes, and secure local keys/leases; the web portal does not use that encrypted offline database. Some break-related history stays only on your device or browser.
- In-app notifications — notification titles and text are stored in cloud feeds for your account and mirrored on your device or browser. They can name coworkers and describe jobsite activity, including when push notifications are off.
- Push notification tokens — if you turn on notifications for a supported device, we store its Firebase Cloud Messaging token with your user id, platform, and last-updated time. Push notifications carry the in-app notification’s title and text. Push is currently supported on Android and the web portal; iOS push is not enabled. Turning notifications off in Profile → Notifications requests removal of that device’s registration. Blocking them in device or browser settings stops them from showing; the app also attempts to remove the registration when it next checks permission while you are signed in. Server cleanup requires a successful connection.
- Camera use for scanning — the mobile apps can use the camera to recognize text or QR/barcodes, such as tool labels and invite codes. Images are processed on-device using Apple Vision on iOS and Google ML Kit on Android; scan images are not uploaded to our servers or to Google for recognition. Recognized values you submit become part of the relevant app record. Camera scanning is not available in the web portal.
- SDK diagnostics and installation identifiers — Google ML Kit on Android sends Google device and app information, installation identifiers, and diagnostic/usage metrics such as processing times, scan configuration, and errors. Firebase SDKs also process installation identifiers, app/SDK versions, and technical information to operate their services. On Android, Firebase can generate an installation identifier and messaging token before you turn push notifications on; this is separate from registering that token with your Tool Shanty account.
- Integrity / anti-abuse signals — App Check may use Google Play Integrity, Apple App Attest/DeviceCheck, and, where configured on web, reCAPTCHA v3. App Check is currently used for monitoring rather than blocking access.
- Version check-ins — platform, app version/build, policy and rollout identifiers, compatibility information, sign-in authentication time, and verification timestamps, used to check whether a build is supported. We do not collect advertising IDs.
- Connection and service logs — our hosting, authentication, and cloud providers process information such as IP address, browser/user-agent information, requested URLs, request times, and diagnostic or security events to deliver and protect the Service.
- Support and feedback you share — bug and feature reports can include your message, name (or account email if no display name is available), app version, platform, jobsite, company, and role. The app prepares these for your device’s share sheet or clipboard; you choose whether and where to send them.
We do not sell your personal information.
2 Information we do not collect (current app)
- GPS / precise device location
- Firebase Analytics, Firebase Crashlytics, or Sentry event/crash reporting in the current app; provider diagnostics and ML Kit usage metrics described above still apply
- User photo library uploads or Firebase Storage media uploads
- Advertising identifiers
3 How we use information
- To provide, maintain, and secure the Service for you and your crew
- To create and manage accounts, invites, and jobsite memberships
- To support tool tracking, materials, tasks, bulletin posts, crew calendars, attendance, running-late reports, and break coordination
- To enable offline use on supported mobile devices and sync when you reconnect
- To communicate about the Service (including support)
- To protect against abuse and keep the Service reliable
- To comply with law and enforce our terms
5 Data retention
We retain information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. You may request deletion of your account by contacting us at the email above or using Profile → Delete account.
Account deletion. We remove sign-in credentials, personal profile information, contact details from membership records, the avatar, live crew status, preferences, personal notification feeds, and account-linked push registrations. A minimal account placeholder remains. Work records and former-membership records stay under your name so the company can review jobsite history. This includes tool custody and requests, materials, tasks, attendance, calendar entries, bulletin posts, and break runs.
Jobsite closure. Closing a jobsite ends field access immediately. Company Administrators can view it read-only for 60 days, after which its jobsite records are scheduled for permanent deletion. Individual record types may have shorter retention periods.
Records exports. Company Administrators can export active or closed jobsite records, including work records under the names on them and a crew roster with contact details. An export is a copy from the time it was made: deleting an account later does not remove the person’s name, email, or phone from an existing export. Exports expire for download after 30 days and are scheduled for deletion from our private storage. After storage deletion, a recoverable copy is retained for seven more days. A copy already downloaded or shared by the company is the company’s own record and is not removed by our deletion process.
Notifications and technical records. Cloud notification feeds are generally scheduled for deletion after about 14 days; local notification history is stored separately. Our Google Cloud operational logs currently have a 30-day retention setting, while certain cloud audit logs are retained for 400 days. Automated deletion is asynchronous. Provider records and recovery copies can remain after account deletion under the provider’s retention schedules; for example, Firebase describes removal of deleted Authentication data from live and backup systems within 180 days. See Firebase’s privacy and retention information.
Current beta service. Tool Shanty is currently in beta. During this period, we may reset the service, including the production web portal’s accounts and jobsite records. A reset may require you to create your account and join your jobsite again.
See Delete your account for the deletion steps and foreman safeguards.
6 Security
We use administrative, technical, and organizational measures designed to protect information, including encrypted on-device storage for supported mobile offline data and role-based access controls on our cloud project. No method of transmission or storage is 100% secure.
7 Children’s privacy
Tool Shanty is intended for adult construction professionals and business use. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.
8 Your choices and rights
You may access or update certain profile information in the app. You may contact us to request access, correction, or deletion of personal information we hold, subject to applicable law and jobsite/admin constraints. California and other U.S. state residents may have additional rights; contact us to exercise them. We will not discriminate against you for exercising privacy rights.
9 International users
We are based in the United States. Our primary jobsite database and records-export storage are located in the United States. If you use the Service from outside the U.S., your information may be processed in the United States and in other locations where our providers operate.
10 Changes
We may update this Privacy Policy from time to time. The “Last updated” date will change when we do. Continued use of the Service after an update means you accept the revised policy.
11 Contact
Privacy questions or requests:
Setclock Inc.
[email protected]
421 Hudson Street Apt 601, New York, NY 10014, USA