Privacy Policy — ProofGrid

Last updated: 2026-09-14

Hosting note (TBD_PAGES): This policy is intended to be published at /privacy.html. GitHub Pages for has-deploy.github.io/proofgrid is not live yet.

This policy describes what data ProofGrid ("the app", also the ProofGrid web and API services operated by Anthony McMurtrey / HAS-Deploy) collects, stores, and shares. It is written to match the App Store Connect App Privacy nutrition label. If this document and the nutrition label ever disagree, tell us at support@hasdeploy.com.

What the app collects

ProofGrid collects account identifiers needed to run the product (Sign in with Apple subject, email, and/or phone used for OTP); job booking fields including service addresses and preferred service windows; job evidence photos/videos and related metadata; optional approximate capture location when you allow location; optional OCR/inferred field values (labeled INFERRED until you confirm); referral attribution tokens; and, when cash referrals are enabled after compliance clearance, Stripe Connect / customer identifiers. We also collect Product Interaction analytics events via PostHog (PortfolioAnalytics). Analytics events do not include raw photos, raw street addresses, phone numbers, email bodies, or OCR text dumps.

What the app stores

Account, job, referral, and evidence metadata are stored in our Postgres database. Evidence photos/videos are stored in private S3-compatible object storage and accessed via signed URLs. Share packs are capability-URL based and can be revoked. Entitlements for post-beta In-App Purchases are mirrored from Apple StoreKit when those products are live.

What the app transmits

Your device and browsers send account, booking, and evidence metadata to the ProofGrid API so contractors and homeowners on a job can use the product. Evidence binaries upload to private object storage via signed URLs. Share-pack links let intended recipients view a proof snapshot. Product Interaction events go to PostHog. When cash referrals are ON (currently OFF), payment identifiers are processed by Stripe. Apple processes In-App Purchases.

Third-party services

• Apple — Sign in with Apple; StoreKit / In-App Purchase (when live).
• PostHog — Product Interaction analytics (no raw photos/addresses in event props). See PostHog’s privacy policy.
• OTP provider (e.g. Twilio Verify or AWS SNS) — email/SMS one-time codes when you use OTP login.
• Stripe Connect — only when cash referral payouts are compliance-cleared and feature-flagged ON. Not used to unlock iOS digital features.
• Hosting — Vercel (web), Fly.io (API), managed Postgres, S3-compatible storage for private evidence.

Permissions we request (iOS)

• Camera — Take photos of the job for your ProofGrid evidence pack. If denied, you can still use the library or skip capture.
• Photo Library — Add existing job photos to your evidence pack. If denied, camera capture may still work.
• Location When In Use (optional) — Attach an approximate job-site location to your evidence. If denied, evidence still saves without geo.
• Notifications — Notify you about booking updates and job activity. If denied, the app still works; you won’t get push alerts.

We do not request HealthKit, Always location, or Contacts in V1.

Your controls

• Revoke permissions in iOS Settings → ProofGrid at any time.
• Settings → Delete Account initiates deletion/anonymization of personal data and evidence assets (Guideline 5.1.1(v)); processing typically completes within 24–48 hours.
• Revoke share packs from the job/share UI when available.
• Contact support@hasdeploy.com for privacy questions or data requests.

Children

ProofGrid is not directed at children under 13 and is not in the Kids Category. We do not knowingly collect personal information from children under 13. If you believe a child has used the app, contact us and we will delete the data.

Cash referrals

Cash referral rewards default OFF until compliance clearance. Attribution may still be recorded. Enabling payouts does not change this privacy policy’s rule that Stripe is not used to unlock digital iOS features (those use Apple IAP when live).

Changes

We’ll update this page when the data we collect changes. The "Last updated" date at the top reflects the most recent change. Material changes will also prompt an in-app notice on next launch when the app ships that path.

Contact

ProofGrid is published by Anthony McMurtrey / HAS-Deploy. Email: support@hasdeploy.com. ASC account contact: mcmurtrey.a@gmail.com (TBD_ASC — App Store Connect App ID PENDING_CREATE).