Privacy Policy

Last updated: October 30, 2026

This policy explains what information ConCal collects, how it's used, and what choices you have. We don't sell your data and we never will. If you have questions, email us at support@con-cal.net.

1. What We Collect

Depending on how you use ConCal, we may collect:

Data	When collected	Why
Email address	When you create an account	Account login and transactional emails (receipts, alerts)
Name & company	When you fill out your profile	Personalizing proposals and estimates
Job estimates	When you save a job	Cloud sync across your devices
Customer contact info	When you add a customer record	Storing your customer database
Proposal data	When you create or share a proposal	Generating and hosting shareable proposals
Billing info	When you subscribe	Processed by Stripe. ConCal never sees your full card number
Hours and clock punches	When a worker or foreman clocks in or out, or logs a crew sheet	Payroll, overtime and job costing for the company they work for
Location at clock-in and clock-out	Only if the company allows it and the worker turns on "Record location when I punch"	Shows where a punch happened. Never tracked between punches
Job-site photos	When the crew takes photos on a crew sheet	The job record. The desk can choose to show some of them to the customer
Receipts (photo, store, date, amounts)	When a worker, foreman or owner adds a receipt, or anyone emails one to the account's receipts address	Job costs and paying people back. Anthropic's Claude reads the photo to fill in the amounts (in the iPhone app, only after you say OK). For an emailed receipt we keep the sender, the subject and the attachment, or the email's text when the receipt is the email
Card and bank statement lines (date, amount, description, last four of the card)	When the owner loads a statement file they downloaded from their bank	Matching each charge to its receipt. The file is read in your browser; only the charges are saved. ConCal never connects to your bank and never sees a login or a full card number
Voice captures	When you speak a job or a note into ConCal or the ConCal Field app	Your speech is turned into text on your phone (by Apple in the iPhone app, or by your browser). The text, never the recording, is sent to ConCal and read by Anthropic's Claude to fill in the job sheet. In the iPhone app this happens only after you say OK to it
What you ask an AI helper to read	Only when you tap an AI helper (reading a ticket, sketch, plan set or price sheet, filling a day log, rewording a scope, Spanish notes, asking about your jobs)	Anthropic's Claude reads it and fills in boxes for you to check. See Anthropic below. We keep a count of AI use per account, not the text, to hold each account to a monthly limit
Notification token (iPhone app)	When you turn on notifications in the app	Sending you a notice when a job is sent to you, or when you are still clocked in late. Removed when you sign out or delete your account
Usage analytics	While you use the app	Understanding which features are used to improve the product

Data about your customers. ConCal lets you store contact details (name, phone, email, address) for your own clients and the people you send proposals to. We store and process that information solely on your behalf so the product works for you. We don't use it for our own purposes. You're responsible for having the right to add your customers' information to ConCal and for telling them how you use it.

Crew and team accounts. If your employer uses ConCal, the account owner and the people they choose can see the hours, crew sheets, photos and receipts you enter for their company. Workers see only their own hours and receipts, never other people's, and never prices or bids. The owner controls these permissions. For your hours, location and photos, your employer decides how they are used, and your employer is responsible for any notice your state requires. Questions about that go to your employer first.

Customer job pages. When a contractor shares a job page with their customer, the customer sees the job's progress, the contractor's note, and only the photos the contractor chose to share. Never hours, crew names or costs.

If a contractor has your information. If you are a customer of a contractor who uses ConCal and want your information changed or removed, ask the contractor, since they control it. You can also email us and we'll pass your request to them.

2. How Your Data Is Stored

ConCal's backend runs on Supabase, hosted on Amazon Web Services (AWS) in the United States. Your data is stored in a PostgreSQL database with row-level security, so it isn't accessible to other users, with one exception: the owner of a company account, and the team members they give permission, can see the work their team enters for that company, since that's the point of a shared team workspace.

Passwords are never stored in plaintext. Supabase Auth handles authentication using industry-standard hashed credentials. All data in transit is encrypted via HTTPS.

3. Cookies and Local Storage

We don't use advertising cookies or third-party tracking pixels. Here's what we do store in your browser:

• Theme preference: saved in localStorage so dark/light mode sticks between visits.
• Supabase session token: a secure token in localStorage to keep you logged in. It expires automatically.
• App preferences: settings like unit system (imperial/metric) and onboarding state, saved locally.

There are no third-party tracking cookies on ConCal. The "usage analytics" we mention are first-party only: for example, error logs and basic feature-usage records stored in our own Supabase database to help us fix bugs and improve the app. We don't use Google Analytics or any third-party analytics SDK.

4. Third-Party Services

ConCal uses the following services to function. Each has its own privacy policy.

5. Data Sharing

ConCal does not sell your data. We don't share your information with advertisers, data brokers, or any third party for marketing purposes.

Your data is only shared with the third-party services listed above, and only as needed to provide the service. We may disclose data if required by law (e.g., a valid court order), and will notify you if legally permitted.

Shared proposals. When you send a proposal link, anyone with the link can view that proposal's contents until it expires. When a proposal is opened, ConCal records the view and stores a one-way hashed version of the viewer's IP address (we cannot recover the original IP from it) so we can show you that it was viewed. We don't otherwise identify proposal recipients.

6. Your Rights

You have full control over your data:

• Export: Download all your data as a JSON file from your dashboard settings at any time.
• Delete your data: From your dashboard settings you can permanently delete your jobs, customers, and proposals (including their revision history). To fully close your account and erase everything we hold (including your saved settings, price book, and billing record), go to Settings, then Delete my account, on the dashboard or in the ConCal Field iPhone app, or email us at support@con-cal.net and we'll erase it within 30 days. If you work for a company that uses ConCal, the hours you logged for them stay in your employer's payroll records after your login is deleted, as they're required to keep them.
• Correct: Update your name, email, or company from your profile settings. For corrections you can't make yourself, email us.
• Emails from ConCal: We send emails about your account (sign-up, trial and billing notices, receipts, security notices, and emails about your jobs). These can't be turned off while your account is active. We don't send marketing emails today. If we ever do, each one will have an unsubscribe link.

Privacy rights under state law. Depending on where you live, a state privacy law may give you the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of its sale, targeted advertising or profiling. We give these rights to everyone, wherever they live. We don't sell personal information, don't share it for targeted advertising, and don't use it for profiling that has legal effects. To make a request, email support@con-cal.net from the email on your account (or tell us how to reach you if you don't have one). We may ask a question or two to confirm it's you, and we'll answer within 45 days. If we say no, reply to that email to appeal and we'll look at it again. We won't treat you differently for using these rights.

7. Data Retention

We keep your data as long as your account is active. When you delete your data in the app, or ask us to close your account, we remove it within 30 days. Copies in our nightly backups expire within 30 more days.

We keep only what the law makes us keep after that, such as records of what you paid us for tax and accounting, and only for as long as required. Stripe keeps its own payment records under its own policy.

If your subscription lapses, we keep your account and its data so you can pick up where you left off if you resubscribe. You can delete it yourself at any time using the steps in "Your Rights" above.

8. Security

• All connections use HTTPS (TLS encryption in transit)
• Passwords are hashed by Supabase Auth, so we never see your plaintext password
• Row-level security in our database prevents one user from accessing another's data (except deliberate sharing, such as a company owner viewing their team's work)
• Payment card data is handled entirely by Stripe, so we never store it

If a security breach affects your personal information, we'll tell you as soon as we reasonably can and as the law requires.

If you discover a security issue, please report it to support@con-cal.net.

9. Children

ConCal is not intended for users under 18. We don't knowingly collect personal information from minors. If you believe a minor has created an account, contact us and we'll remove it promptly.

10. Changes to This Policy

If we make significant changes, we'll email you before they take effect. The latest version is always at con-cal.net/privacy.