Privacy

What the App Touches

Photos are held on your phone (in the browser's own storage) until they upload. SiteStash only ever opens, adds to or changes its own folders: SiteStash (or Fieldline Camera, or Fieldline Cam, on phones set up before a rename), or the main folder you name, and the project and batch folders inside it.

• OneDrive: the Files.ReadWrite scope. Photos go to the app's own folder, which Microsoft makes under OneDrive/Apps, or to a main folder you name at the top of your OneDrive (Pro), which is why Microsoft asks for access to your files. SiteStash does not read, list or change anything outside its folders. Connections made before this change have the narrower Files.ReadWrite.AppFolder scope until they sign in again.
• Google Drive: the drive.file scope. This app can only see files and folders it created itself, plus your email address, to show you which account is connected.

What Never Happens

• Your own photos go from your phone straight to OneDrive or Google Drive, not through a server.
• Your photos and captions are never stored anywhere but your own phone and your own drive.
• The exceptions are the features you choose to use, each explained below: Shared projects, where photos pass through this server on their way to the project owner's drive; reading a packing slip; and the support chat.
• Nothing is sold, shared, or used to train anything.
• You are never emailed news or tips unless you ticked the box asking for them.

App Store and Google Play Notice

If you ask on the Download page to be told when SiteStash is in the App Store or Google Play, we keep your email address, which phone you picked, and when you asked. It is used for one email, when the app is out, and for nothing else: it is not the news-and-tips list. It is stored in the same database as accounts. To be taken off, email the address below.

Feature Requests and Surveys

If you ask for a feature or answer our survey, we keep your answers and when you sent them, to decide what to build and what it should cost. An email address is only kept if you type one in, and is only used to reply to you. If you say we may quote you, we use your first name and trade only. Answers are stored in the same database as accounts and never sold or shared. To have yours deleted, email the address below.

Your Account

Signing in with Microsoft or Google to send photos to your drive makes a SiteStash account. So does signing up with just your email, which keeps your photos on your phone only: for that, your phone makes a random key that only it holds, and we keep a scrambled copy of it to know it is you. The account holds your email address; the profile you fill in when you first sign in (your name, phone number, company, industry, role, province or state, and company size); which of the two you signed in with, and the other one too if you connect it as a second drive, so either opens the same account; when you joined and were last seen; and whether you asked for news and tips by email. Your profile is used to know who uses SiteStash and to contact you about your account. It is never sold or shared. Each time that answer changes, the date and the exact wording you saw are kept as the record Canada's anti-spam law (CASL) asks for. It is stored in a Postgres database (Supabase, hosted in Canada) that only Fieldline Solutions Inc. can read. Today that is the people who run Fieldline Solutions Inc., and nobody else.

SiteStash needs an account to use. Your account is kept until you delete it, which you can do any time in the app under Settings, Account, or at sitestash.app/delete-account. It is removed straight away, along with its consent records and anything it holds in Shared projects; the database host's own short-term backups clear themselves within 30 days. If you can't sign in, email the address below and we delete it for you.

Location

Only if you turn on Photo locations: each photo's GPS position is kept with it on your phone, to show on a map. To name the street, the coordinates, rounded, are sent through this server to OpenStreetMap, which turns them into an address; the map itself is drawn from OpenStreetMap too. Nothing else about you goes with them.

Shared Projects

Only if you use Shared projects. When you share a project with people, their photos are filed into your drive. To do that, this server keeps your drive's refresh token for that project, encrypted, in the database, so it can file another member's photo without handing them access to your drive. For OneDrive that token can reach your whole OneDrive, though the app only ever files into the project's own folder. Each of their photos passes through this server on its way to your drive and is not kept here. The database also holds the project's name, the email addresses you invited, who joined, and the names of the batches and photos sent. PDFs added to a project work the same way: filed into your drive, in the project's Documents folder, passing through this server when someone adds or opens one and not kept here; the database holds each PDF's name, size and who added it. Stopping sharing deletes the stored token and the project; the photos and PDFs stay in your drive.

Packing Slips and the Support Chat

Only when you use them. When you scan a packing slip under Back orders, that one photo is sent through this server to Anthropic, whose AI model Claude reads the item lines so the app can list what is still owed. When you use the chat under Support, what you type is sent to Anthropic the same way so Claude can answer. SiteStash does not keep the slip photo or the chat on its server; the back-order list stays on your phone. Anthropic processes them in the United States, keeps them only for a limited time under its commercial terms, and may not train its models on them. A slip can carry names and delivery addresses, so scan only slips you are allowed to share. Nothing else about you goes with them.

Business Cards

A business card you scan under People is read on your phone; the photo is not sent anywhere to be read. The card's photo and the details are kept on your phone, and a copy of each goes to your own drive, in a Business Cards folder. When you tap Add to Phone Contacts, the contact passes through this server once so your phone can open it, and is not kept here. Only scan cards people have given you.

How Much the App Is Used

While you are signed in, the app counts what you do with it, by the day: that you opened it, sent a batch and how many photos were in it, made a report, scanned a document, and the like. Only the number and the day are kept, with your account. Never the photos, captions, names, projects or anything you typed. The counts tell us which features people use and whether they keep using the app, and are seen only by Fieldline Solutions Inc. They are not used for advertising, not shared, and deleted with your account.

When Something Goes Wrong

If the app hits an error, or a send to your drive fails, it sends a short problem report to this server so it can be fixed: what went wrong and where in the app's code, which screen, your phone's browser, whether it had signal, and when. If you are signed in, it is linked to your account so we can ask you about it. It never includes a photo, a caption, or anything you typed, though an error can name a batch or file. Reports are kept for 90 days, deleted with your account, and seen only by Fieldline Solutions Inc.

What the Server Does Hold

Signing in requires a refresh token from Microsoft or Google. That token is encrypted and kept in an HttpOnly cookie on your own phone, not readable by the page's own JavaScript, for up to 90 days at a time. Disconnecting in Settings deletes it. The one exception is Shared projects, above: a project owner's token is also kept, encrypted, in the database while the project is shared.

Questions

privacy@fieldlinesolutions.com