Privacy Policy

Effective date: October 15, 2026

TradeReady ("we," "our," or "the app") is a job management and invoicing tool for independent tradespeople. This policy explains what data we collect, how we use it, and your choices.

1. Information We Collect

• Account: your email address when you sign up.
• Business profile: business name, contact name, phone, address, and trade type — entered by you in Settings.
• App data: jobs, invoices, customers, expenses, and notes you create inside the app.
• Calendar busy times (optional): if you turn on calendar checks, the app reads the calendars you choose on your device and sends us only the start and end times of busy periods in your booking window (up to about two months ahead), together with a random identifier for that app installation, so your booking page doesn't offer those times. Event titles, locations, notes and attendees never leave your device. Each update replaces the last one, and turning calendar checks off deletes them from our servers. If you turn on "Add my jobs to a TradeReady calendar", the app writes your scheduled jobs into a calendar on your device (your calendar account, such as iCloud, may sync it); our servers aren't involved.
• Notification preferences: your invoice reminder rules and, if you grant permission, a device push token used to deliver local notifications.
• Subscription status: when you subscribe to TradeReady Pro, we receive your subscription state (active, trial, expired) and purchase receipts from Apple or Google via RevenueCat. We never see or store your card number — payment is handled entirely by the app stores.
• Optional API keys (Groq, Anthropic): if you choose to use your own AI keys (Settings → AI Assistant → Advanced), they are stored exclusively in your device's iOS Keychain or Android Keystore and never leave your device to TradeReady servers.
• Estimate and change-order signature records: if you send your customer a link to approve or decline an estimate or change order, and they act on it, we store: their decision; on approval, their typed name, their drawn signature if they add one, and the email address they enter if they ask for a signed copy (used only to send that copy); the version of the electronic-records disclosure they agreed to; a server timestamp; their IP address and browser user-agent; and a log of when the link was sent, opened, signed and downloaded (with IP address and browser for the customer's actions). Each signature record is sealed and kept for as long as your account exists, and is deleted with your account. Your customer keeps the copies they downloaded or were emailed.
• Customer requests: when your customers send you a request through your booking link, your customer portal or an estimate page (for example a booking request, a change request, or a request for an updated estimate), we store what they enter, such as their name, contact details, job address, a description of the work, preferred timing or a short note, so you can see and respond to it in the app.
• Referral links: a business that uses TradeReady may give you a personal booking link to pass along. The link contains a random code with no personal information in it. When someone books through it, the code is saved with their request so the business can see who referred them. TradeReady's servers don't look the code up. The person booking is never shown who referred them, and TradeReady never contacts the person who shared the link. Any thank-you or credit is recorded by the business in its own records; TradeReady doesn't send gifts, credits or money.
• Automatic-payment records: if your customer turns on automatic payments, we store the card brand, last four digits and expiry date (never the full card number, which stays with Stripe), Stripe identifiers, the authorization text they accepted, and the time, IP address and browser user-agent of that authorization, plus a record of each automatic charge attempt.

2. How We Use Your Information

• To provide, sync, and maintain the TradeReady service across your devices.
• To send local push notifications about upcoming or overdue invoices (only with your explicit permission).
• To generate AI-assisted estimates, outreach messages, chat responses, pricing suggestions, and receipt scans (reading a receipt photo you attach to pre-fill the expense form). By default these requests go through TradeReady's secure backend using our own AI provider accounts; you may instead supply your own API keys.
• To verify your TradeReady Pro subscription and unlock the features you've paid for.

3. Data Storage

Your app data is stored locally on your device and, if you are signed in, synced to Supabase (supabase.com), a managed database service hosted on AWS infrastructure in the United States. Your API keys for Groq and Anthropic remain on-device only and are never synced to the cloud.

4. Third-Party Services

TradeReady integrates with the following services. Each processes data according to its own privacy policy.

• Supabase — authentication and cloud data sync. supabase.com/privacy
• Stripe — payment collection from your customers through your own connected Stripe account (Stripe Connect), and payment-link generation, including saving your customers' payment methods for automatic payments they authorize. stripe.com/privacy
• Resend — email delivery. Invoices, reminders, receipts and other emails TradeReady sends for you, and notifications sent to you (such as new booking requests), go through Resend, which receives the recipient's email address and the message, including any attached invoice PDF. resend.com/legal/privacy-policy
• Cloudflare — hosting for TradeReady's backend and file storage. Requests from the app, and from your customers' estimate, booking, portal and payment pages, are handled on Cloudflare (which processes IP addresses to deliver them), and invoice PDFs and photos you share are stored there. cloudflare.com/privacypolicy
• RevenueCat — subscription management for TradeReady Pro. RevenueCat receives purchase receipts from Apple/Google and an app user identifier so we can verify your subscription. revenuecat.com/privacy
• Anthropic — AI-generated estimate messages, pricebook pricing suggestions, and receipt scanning. Relevant job, invoice, or service details are sent to Anthropic to generate the text — by default through TradeReady's backend, or directly if you supply your own API key. When you attach a receipt photo to an expense, that photo is sent to Anthropic to read the merchant, total, and date; receipt photos you attach without scanning, and all other photos, never leave your device. anthropic.com/legal/privacy
• Groq — AI chat assistant. Your chat messages and a summary of your business data (revenue, overdue invoices, active jobs) are sent to Groq to generate responses — by default through TradeReady's backend, or directly if you supply your own API key. groq.com/privacy-policy
• Expo / EAS — app delivery and over-the-air updates. expo.dev/privacy
• PostHog — anonymous product analytics (screen views, feature usage). No personal data is sent; only anonymized event names and timestamps. posthog.com/privacy
• Sentry — crash and error reporting. When the app encounters an error, a diagnostic report (stack trace, device model, OS version) is sent to Sentry to help us fix bugs. No business data (jobs, invoices, customer names) is included. sentry.io/privacy
• OpenStreetMap / Nominatim — address geocoding for the route-planning feature. When you view a customer's address on a map, the address text is sent to the Nominatim API to resolve coordinates. osmfoundation.org/wiki/Privacy_Policy

AI features send data to the providers above only when you actively use them — generating a message, asking the chat assistant, requesting a pricing suggestion, or attaching a receipt photo to an expense. Nothing is sent in the background. Requests routed through TradeReady's backend are authenticated and rate-limited; TradeReady does not store the content of AI requests or responses (including receipt photos) on its own servers.

5. Data Sharing

We do not sell, rent, or share your personal information with third parties for advertising or marketing purposes. Data is shared only with the service providers listed above as necessary to operate the app.

If you create an API key, services you give it to can read the data types you chose. We log each API request (time, key, endpoint, IP address) for 90 days for security.

6. Data Security

All data in transit is encrypted via HTTPS/TLS. Sensitive credentials (API keys, payment tokens) are stored in your device's platform keychain. Cloud data is protected by Supabase's row-level security policies, which restrict each user to their own records.

7. Your Rights and Choices

• Delete your account and data — in the app: go to Settings → Delete Account. This permanently deletes your cloud account and every record we hold about you (jobs, invoices, customers, expenses, settings) and clears the app's local data. Deletion is immediate and cannot be undone. If you can't access the app, email us at [email protected] and we will delete your account for you.
• Subscriptions are cancelled separately: deleting your account does not cancel an active TradeReady Pro subscription. Cancel it in your Apple ID or Google Play subscription settings — otherwise the store may continue to bill you.
• Retention: we keep your cloud data only for as long as your account exists. When you delete your account, your records are removed from our live database immediately. A few copies live slightly longer, then expire on their own: encrypted database backups are overwritten on a rolling schedule and are gone within 30 days; crash and diagnostic reports expire after at most 90 days; and emails you've sent to support are kept as ordinary business correspondence. If a law requires us to keep a specific record longer (for example, tax or accounting rules), we keep only that record, only for as long as required.
• Sign out only: signing out from Settings clears local data from your device but leaves your cloud account intact for your next sign-in.
• Notification permissions: revoke at any time through your device's system Settings.
• AI features: used only when you invoke them — nothing is sent to AI providers in the background. Prefer full control? Supply your own API keys under Settings → AI Assistant → Advanced and requests go directly from your device to the provider.

8. Your California, EU & UK Privacy Rights

Depending on where you live (including California under the CCPA/CPRA, and the EU/UK under the GDPR), you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information (you can edit your business profile and records directly in the app);
• Delete your personal information (see "Delete your account" above);
• Export your data in a portable format — email us and we will provide your records;
• Know what categories of data we collect and why (sections 1–4 of this policy).

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for targeted advertising. We will never discriminate against you for exercising a privacy right. For EU/UK users: we process your data to perform our contract with you (providing the app) and for our legitimate interest in keeping the service reliable and secure; you may lodge a complaint with your local supervisory authority.

To exercise any of these rights, use the in-app tools described above or email [email protected]. We respond within 30 days.

9. Location & Mapping Data

The app may use your device's platform geocoding service (Apple Maps on iOS, Google Maps on Android) to look up or display address information. Address strings are processed by Apple or Google according to their respective privacy policies. This data is not transmitted to or stored by TradeReady.

10. Children's Privacy

TradeReady is not directed to children under the age of 13. We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. The effective date at the top of this page will reflect any changes. Continued use of the app after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

Questions or requests regarding your privacy? Email us at [email protected].