Privacy, from the visit onward.

App activity and service alerts

The app can report limited usage milestones, such as a first open or first completed visit, without requiring sign-in. It sends a named event and its UTC day, verified with an Apple-signed app transaction. We retain a one-way app-account identifier to avoid repeat counts. This measurement is pseudonymous: it does not contain customer records, workspace identifiers, note text, addresses, contact details, photos or private links. Signed receipt bodies are verified in memory and are not stored in analytics records or logs.

In app versions with the Share app usage setting, this optional measurement is enabled by default. Turn it off in Settings to stop first-open and feature-usage reporting and clear unsent usage events. Purchase verification, report delivery and other operations needed to provide the service continue. Usage event records are retained for up to 365 days and daily aggregate counts for up to 730 days; older records are removed when new events arrive. These counts are not used for advertising or cross-app tracking.

Verified production app opens, subscriptions and service failures can generate internal alerts delivered through Slack. These alerts exclude customer names, addresses, access notes, photos and private report links. TestFlight, Sandbox, staging activity and raw workspace creation do not generate these alerts.

This website

We count visits to named public pages, clicks on Get the app and template downloads to understand which pages help operators discover PoolTrail. A click or download is not treated as an installation, signup or purchase. Downloads are counted by the public page that offers them, without collecting the contents of your files. The sample report is fictional. Opening the public website does not create an app workspace.

Our first-party measurement uses a random identifier in the current browser tab’s session storage to avoid duplicate counts. It is not an account identifier and is not linked to app records. Our service retains daily totals by public page and event, plus a day-specific one-way identifier for deduplication. Deduplication records older than the previous day and aggregate totals older than two years are removed as new events arrive. Closing the tab clears the browser’s identifier.

These first-party analytics records exclude private reports and approval pages, names, emails, customer records, IP addresses, browser fingerprints, referring URLs, and URL query strings. We do not use advertising cookies, session replay or automatic form capture. Website measurement respects Do Not Track and Global Privacy Control signals. Self-hosted fonts and images avoid third-party font or image requests. The hosting service still processes technical requests needed to operate the website.

Optional Google Analytics

If you choose Allow analytics, we also use Google Analytics on the public website to understand visits and clicks on app links and template downloads. Google’s tag and its cookies load only after you allow them. Google receives cookie identifiers, browser and device information, and network data, including your IP address when your browser connects to Google. This is separate from our first-party counts and is not connected to your app account or customer records.

We send only named public page addresses and titles and the named interactions described above. We remove query strings and fragments, exclude private documents, and limit referrers to public PoolTrail pages or recognized search and discovery sites’ origins. We do not send form contents, customer details or private links. Automatic enhanced measurement, Google Signals and advertising personalization are disabled. An app-link click is not an installation or purchase.

Choose No thanks to keep Google Analytics off. Use Manage analytics in the website footer to change your choice or turn it off later. Turning it off removes our Google Analytics cookies and reloads the page to stop the tag. Permission is saved in this browser’s local storage for up to six months before we ask again; an opt-out stays until you change it or clear that storage. If that storage cannot save your opt-out, we try a preference cookie lasting up to one year. Google Analytics cookies have a six-month lifetime that can renew with activity. Do Not Track or Global Privacy Control keeps Google Analytics off, even if you previously allowed it. Our limited first-party counts remain separate and also respect these browser privacy signals.

Google processes this information under its Privacy Policy. See how Google uses information from sites that use its services.

Private customer documents

A report or estimate link grants access to that specific document without a customer account. Anyone you share the complete link with may be able to read it. Keep links private. Private routes request no indexing, no browser caching and no referrer transmission, and have no marketing trackers.

Report content includes the operator’s identity, visit details, customer-visible work, readings, notes and photos. Internal notes and access instructions are excluded by the customer document contract. Opening an estimate does not submit a decision.

Local work and connected workspaces

You can explore fictional sample records or set up your business and save work on your phone without signing in. Choosing a connected feature, purchase or restore can create a private guest workspace using a random credential stored securely on your device. A guest workspace does not require your name, email or Sign in with Apple. Connecting transfers the business records selected by the app’s connection flow to the service; sample records remain separate.

Connected records include business and customer contact details, service addresses, schedules, readings, checklists, equipment, photos, recipient preferences, repair estimates and decisions. Internal notes and access instructions can sync to your private workspace even though they are excluded from customer documents. We use these records to provide the service, recover interrupted work and support your account.

Optional Sign in with Apple links an Apple account identifier to your workspace for recovery and access across devices. Apple provides the identity information you choose to share. We also process subscription identifiers and verified purchase status. Restoring a purchase does not by itself grant access to another workspace’s customer records.

Customer names, addresses, photos, note text, access codes and private links are not analytics content. The app does not require continuous location tracking for address-based navigation.

Service providers and access

PoolTrail uses Vercel for the website and API, Neon PostgreSQL for private connected records, and private S3-compatible object storage for images. Apple handles app purchases and optional Apple sign-in. Authorized Willow Glen Equity LLC personnel and service providers may process the data needed to operate, secure and support these services. Technical requests and service errors may be retained by the hosting providers; private records are not marketing analytics.

Resend processes transactional report and estimate emails. The delivery provider processes the recipient, sender, message and delivery status. A saved or queued report is not confirmation of delivery. PoolTrail does not sell service records or use them for cross-app advertising.

Repair decisions

A submitted decision records the stated customer name, choice, time and exact estimate version and amount. It documents the customer’s response to the operator’s proposed physical work. The website does not collect card details or payment for that work.

Export, deletion and retention

Settings includes export and deletion controls for connected guest and Apple-linked workspaces. A deletion request revokes private links and stops pending sends, then queues removal of hosted records and images and revocation of Apple credentials where applicable. Completion can require retries. Deleting an account does not cancel an Apple subscription; use Manage subscription to cancel renewal separately.

A separate setup saved only on your phone before connection can remain on the phone after the connected account is deleted. Purchase verification evidence, including product, original transaction, subscription status and the historical app account token, may remain detached from the deleted workspace so valid restores and revocations continue to work. It does not retain that workspace’s customer records.

Existing local records remain readable and exportable after a subscription lapses. There is currently no scheduled purge based on inactivity or subscription expiry. This is not a promise of permanent or free cloud storage. Export records you need to keep. Deletion removes records from the active service through a retryable background process. The production database retains a rolling 24-hour recovery history, so recently deleted records may remain in that history until it expires. Technical provider logs may follow separate security retention periods. Contact support if a deletion remains pending. Copies already received or saved by customers cannot be withdrawn from their inboxes or devices.

Questions

Use the support page for the current contact route, including privacy and deletion questions. TestFlight testers can also use TestFlight feedback. Do not include access codes or private customer links in ordinary feedback.