PunchLog

Privacy Policy

Last updated: August 10, 2026

PunchLog is a construction punch-list app. This policy explains what the app stores and why, in plain language.

PunchLog is listed on the App Store in the United States and Canada, and this policy is written for those two countries. The app is not listed anywhere else. This website — including the registration page — is reachable from anywhere, so if you register from outside the United States or Canada, everything described in this policy still applies to what you enter.

Who is responsible for your data

PunchLog is operated by Ilya Vidyaev, 36 James St, Suite 5, Middletown, NY 10940, USA ("we", "us"). We are the data controller for everything described here — meaning we decide what is collected and why, and we are the party you can hold to it. You can reach us any time at kubiknyc@gmail.com.

What we store

  • Account details you provide — email address, name, and optionally your phone number, company, and trade. Used to sign you in and show teammates who did what.
  • Project content you create — punch-list items, comments, status history, floor-plan pins, and photos you capture or attach. This is the product's purpose: a shared record of defects and their closeout.
  • A profile photo, if you choose to add one.
  • A push-notification token, if you enable notifications, so we can deliver alerts about assignments, reviews, mentions, and closed items. Delivery runs through Apple's and Google's push services, which necessarily see the token and the notification. You can turn each notification type off in Settings; the token is cleared when you sign out — or, if your device happens to be offline at that moment, replaced the next time anyone signs in on it.
  • Crash reports and a launch ping — when the app crashes or hits an unexpected error, a diagnostic report is sent to Sentry, our error-monitoring provider. It contains the error and the code path that produced it, plus technical details about your device such as model, operating system version and app version. Sentry also receives a short session ping each time the app starts or returns to the foreground, recording how long that session lasted, so we can tell what share of launches are crash-free. Both carry a random identifier for your app installation — not your account. We configure the crash reporter to leave out the app's internal log lines, its network requests and your screen taps, so that your content is not swept up with the fault. On Android, the crash reporter's own built-in record of taps and device events is not switched off in this build and may still be attached to a crash; it identifies interface elements and device state, not what you wrote. Nothing in any of it is tied to your name or email address.
  • Abuse reports you file — if you report a photo, comment or item, we store who reported it, what was reported, and the reason you typed, and we email that report to our support address so a person can act on it. Hiding a photo or blocking a person, on the other hand, never leaves your device: those lists are kept only in your app's local storage.
  • Daily counters that stop abuse — how many AI descriptions and how many abuse reports your account has asked for today, so neither can be run up without limit. Registration is rate-limited the same way, counted against a scrambled form of the email address and network address used, which we cannot read back; those counters are dropped after a week.
  • An update check — on launch the app asks Expo's update service whether a newer version is available, sending the app version, release channel and a random installation identifier. No account data is involved.

Why we are allowed to use it

We name a reason for each use rather than leaving it implied. Ours are:

  • To provide the service you signed up for — your account details and everything you create in the app. Without these there is no product. (Performance of a contract.)
  • Because you asked for it — the AI description feature runs only when you tap the button that asks for it, and your device asks separately before the app may use the camera or your photo library. (Consent.)
  • To deliver the notifications the app is built around — your device asks whether to allow notifications, and only if you allow them is a push token registered, so that assignments and reviews reach you. Each type of notification can be switched off in Settings; assignment and mention alerts start switched on, and the daily digest starts off. (Consent for the permission itself, then performance of a contract for the delivery.)
  • To keep the app working and safe — crash reports, the launch ping, the update check, and acting on abuse reports. We have a genuine need to fix faults and to remove content that should not be there, and we have kept the data involved to the minimum that serves it. (Legitimate interests.)

How long we keep it

  • Your account — until you delete it. Deleting it removes your sign-in and personal details immediately, as described below. One exception: if you are the only administrator left in a company that other people are still using, the app asks you to hand that role to someone else first, so the company is not stranded without anyone who can run it.
  • Project content — we do not delete punch-list items, comments or photos on a schedule; they stay with the project. A superintendent or company administrator can delete an individual item or comment from inside the app at any time, and that removes it permanently for everyone, photos included. Whole projects have no delete button today — if you need one removed, write to us and we will do it by hand. Keeping the rest is deliberate: a punch list is a shared construction record, and one person leaving should not erase it. After you delete your account, your contributions remain but are attributed to "Deleted user" rather than to you.
  • Crash reports and launch pings — Sentry keeps these for 30 days, then deletes them.
  • Abuse reports — kept indefinitely today, so that a repeat pattern is still visible; we have no automatic purge. A report records who filed it, and that record is not removed when the person who filed it deletes their account. Ask us and we will remove a report.
  • Photos sent for an AI description — the copy we send Anthropic is not kept by us beyond generating the draft. Anthropic applies its own retention to what it receives, which we do not set. Nothing is sent unless you press the button.
  • Email we send you — Resend keeps a log of the messages it delivers on our behalf, including their contents, under its own retention schedule.

What we deliberately do not do

  • No location tracking. Photos are stripped of GPS and other camera metadata on your device before they are uploaded.
  • No advertising, no ad trackers, no marketing analytics. We do not sell your data, share it for marketing, or build a profile of you.
  • No product analytics. We do not record which screens you visit or how long you spend on any part of the app, and there is no analytics product in PunchLog. The only exceptions are the ones described above: the launch ping, and the daily counts of AI descriptions and abuse reports that exist to stop those two buttons being run up without limit.

Where your data lives

Data is stored with Supabase (Postgres and object storage), and the database itself enforces who can read what. A superintendent sees the projects they are assigned to, and a company administrator sees every project belonging to their company. A subcontractor sees only the items assigned to them — unless they are also an administrator of the company that owns the project, in which case they see all of that company's projects. Data is encrypted in transit (TLS) and at rest. A copy of your project data is cached on your device so the app works offline. Signing out clears your session, the record of which project you had open, and your hidden-content and blocked-people lists. The offline copy of the project data itself stays on the device until a different account signs in, at which point the app erases it before fetching anything — we keep it that long so that signing out and back in does not throw away work you captured with no signal. Your theme choice belongs to the device rather than to you, and stays. On a phone or tablet several people share, treat what is cached as visible to whoever holds the device.

If you use the AI description feature, the photo you just captured is sent to Anthropic's Claude API, along with the room, floor and trade shown on the form, to draft the defect description. It is used only to generate that draft.

Who else processes your data

We use the following providers, and we sell your data to no one. Most act purely on our instructions and receive nothing for their own purposes. Apple and Google are the exception: push notifications travel over their networks under their own platform terms, which they set and we do not, so what they do with a token or a message is governed by those terms rather than by ours.

  • Supabase — the database, file storage and sign-in behind the app.
  • Anthropic — only when you use the AI description feature, as above.
  • Sentry — crash reports and the launch ping.
  • Expo — app updates, and routing notifications to Apple and Google.
  • Apple and Google — delivering push notifications to your device.
  • Resend — sending our email: invitations and confirmations, notification and digest mail that can carry punch-item titles, and the abuse reports described above, which include who reported what and the reason they gave.
  • Vercel — hosting this website, including the registration and password pages.

These providers process data in the United States. The ones your device talks to directly — Supabase, Sentry, Expo, Apple, Google and this website's host — see your IP address as an unavoidable part of making the connection, and we do not use it to identify you. Anthropic and Resend are different: the app never contacts them, so what reaches them comes from our servers and carries our address, not yours.

If you are in Canada, that means your data is stored and processed outside Canada, in the United States, and is subject to United States law — including lawful access requests there. We are a United States operation. These providers publish data-processing terms that use recognised safeguards — the European Commission's Standard Contractual Clauses, or the EU-US Data Privacy Framework, depending on the provider — and where they do, those terms are what the providers commit to. Be aware that those particular instruments were written for Europe, and each provider sets their scope, so they may not extend to Canadian data at all; they are simply the published protection we can point to. Push delivery is different: Apple and Google carry notifications under their own platform terms, not under an agreement we set. If you need to know exactly what covers a particular provider before you use PunchLog, write to us first and we will tell you what we have.

Your choices

  • Edit or remove your profile details and photo in Settings at any time.
  • Control every notification type in Settings.
  • Delete your account directly in the app: Settings → Delete account. This removes your sign-in, name, contact details, profile photo, and notification token immediately. Punch-list items, comments, and the photos you attached to them remain with their projects — a shared construction record — attributed to "Deleted user". Crash reports and launch pings are not removed by account deletion, because they were never linked to your account in the first place; Sentry retains them under its own schedule — it deletes them after 30 days. Some other things outlive the account: a minimal record keyed to your old account id, so your past contributions stay attached to "Deleted user" rather than becoming orphaned; any abuse reports you filed; and the daily counters described above, which are tied to that same record and so are not swept away with the rest. You can also contact us at the address below.

Your rights

Wherever you live, you can ask us to do any of the following, and we will not charge you or treat you differently for asking. Write to kubiknyc@gmail.com and we will respond within 30 days.

  • See what we hold about you, and get a copy of it in a portable format.
  • Correct anything wrong. Most of it you can edit yourself in Settings.
  • Delete your account — in the app, or by asking us. See the note above about what stays with the project.
  • Object to, or ask us to pause, a particular use — including anything we do on the basis of legitimate interests.
  • Stop the optional parts. Turn off any notification type in Settings, or simply stop using the AI description button — it only ever runs when you press it. Stopping does not undo anything already done.

If you are in Canada and you think we have got this wrong, you can complain to the Office of the Privacy Commissioner of Canada, or to your province's privacy commissioner. We would rather you told us first so we can put it right.

If you are in California: we do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either.

Children

PunchLog is a tool for people working on construction sites. It is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, write to us and we will remove it.

Contact

Questions, rights requests or deletion requests: kubiknyc@gmail.com
Ilya Vidyaev, 36 James St, Suite 5, Middletown, NY 10940, USA

We will update this page if our practices change; the date above reflects the latest revision.