Privacy Policy

Who this is for

Field Book is a private, invite-only work order tracker for a small property maintenance operation at velcinderfieldbook.com. The operator of Field Book is the business (sometimes called the “controller”) for personal information described in this policy. Companies that host or process data for us (such as our database provider) act as service providers or processors under their own terms.

Accounts are created by the administrator. There is no public sign-up. Only people the administrator invites may use Field Book.

Field Book is intended for use in the United States. We process and store information in the United States. The service is not intended for people in the European Union, the United Kingdom, or other places that require a different privacy regime.

Information we collect

Account information: email address, role (for example administrator, owner, or helper), and authenticator / multi-factor enrollment data needed to sign you in.

Gmail data accessed through Google OAuth with the gmail.readonly and gmail.send scopes: message metadata (sender, recipients, subject, date, thread ID, and message IDs) and the body of work order emails that match configured senders and subject patterns.

Work order details, and property and tenant or vendor contact details, that appear in those emails or that users enter into Field Book.

Photos and receipts that users upload to jobs.

Technical logs such as IP address, timestamps, and request logs, and session cookies. Cookies are strictly necessary to keep you signed in and to protect the service. We do not use advertising or analytics cookies.

How we use information

We use this information only to find work order emails, create and update jobs, send replies on those threads that a user configured or approved, and send job updates the administrator approves. If enabled, we may send emergency alert text messages to the administrator.

Email classification and suggested replies are a convenience. A person reviews them. We do not make automated decisions that produce legal or similarly significant effects about you.

Users are responsible for the accuracy of information they type in, and for information that arrives by email from other people. We cannot verify every third-party message.

Google user data and Limited Use

Field Book's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the Google API Services User Data Policy.

Limited Use means: we do not sell Google user data; we do not use it for advertising, including personalized or retargeted ads; we do not use it to train generalized artificial intelligence or machine learning models; we do not allow humans to read Gmail data unless we have the user’s consent, it is needed for security purposes, we must do so to comply with law, or it is necessary for internal operations and the data is aggregated and anonymized; and we do not transfer Google user data to others except as needed to provide or improve the user-facing features of the service, for security purposes, to comply with law, or as part of a merger, acquisition, or sale of assets with notice to users.

Storage and security

The service runs on infrastructure controlled by the operator. Database and file storage are provided by Supabase in the United States. Data is encrypted in transit with HTTPS. Google refresh tokens are encrypted at rest. Row-level access controls limit what each signed-in person can see based on their role. Multi-factor authentication is required to sign in.

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is 100% secure, and we do not guarantee that unauthorized access will never occur. You are responsible for the security of your own device, password, and authenticator. If a breach of personal information occurs, we will provide notice as required by applicable law.

Retention and deletion

Job records and attachments are kept while the service is in use for record-keeping. Email content is stored only as needed for the related job. Google tokens are deleted when Gmail is disconnected. Technical logs are kept up to 90 days.

We delete personal information within 30 days of a verified deletion request unless the law requires us to keep it, including a legal hold, an ongoing dispute, or a record we must retain. Backups may take a short additional period to roll off.

Sharing

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

We use service providers only as needed to operate Field Book: hosting and database (Supabase), Google (Gmail), an SMS provider if emergency texts are enabled, and Cloudflare for network security. Each provider handles data under its own terms. We may also disclose information if the law requires it, to protect rights and safety, or in a merger or sale of the operation with notice.

Do Not Track and Global Privacy Control

We do not sell or share personal information as those words are used in California law, so a Global Privacy Control (GPC) or Do Not Track signal does not change a sale or share that is not happening. We still honor GPC as a request not to sell or share.

How to disconnect Gmail

In Field Book, sign in and open Settings, then disconnect Gmail. You can also revoke Field Book’s access in Google Account permissions.

Your rights

You may request access to the personal information we hold about you, correction of inaccurate information, deletion, a portable copy, and to opt out of any sale or sharing (we do not sell or share). People whose information appears in work order emails — including tenants and vendors — may make these requests too, even if they do not have a Field Book account.

To submit a request, email [email protected]. We will verify the request (for example by confirming control of an email address) before we act. We will respond within 45 days as required by the California Consumer Privacy Act, as amended by the CPRA, or explain if we need more time. If we deny a request, you may appeal by emailing the same address and writing “Appeal” in the subject. We will explain our decision in writing.

California (CCPA / CPRA)

In the last 12 months we have collected these categories of personal information: identifiers (such as email address and online identifiers); customer records information (such as name and contact details that appear on a work order or account); electronic network activity (such as IP address, timestamps, and logs); and sensitive personal information limited to account log-in information (email plus authentication factors).

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than those allowed by California law (to provide the service, resist security incidents, and maintain the quality of the service).

California residents have the right to know, delete, and correct personal information, to limit use of sensitive personal information, and not to receive discriminatory treatment for exercising these rights. You may use an authorized agent if you provide proof of authorization and we can verify both you and the agent. Submit requests to [email protected].

Children

Field Book is not directed to anyone under 16. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, email [email protected] and we will delete it.

Changes

This policy is effective October 26, 2026. We may update it. We will change the effective date when we do. For material changes we will also give notice in the app.

Contact

Questions and privacy requests: [email protected].