Privacy Policy

Effective 14 October 2026

This policy explains what information the ConstructorPro mobile app and its server ("ConstructorPro", "we", "us") collect, how we use it, and the choices you have. It covers the iOS and Android apps and this website.

1. Who uses ConstructorPro

ConstructorPro is used by businesses that track building costs. Each business has one owner, who creates the account, may connect a Google account and may subscribe to ConstructorPro Pro, and may have workers, whose accounts the owner creates.

2. Information we collect

Account information

• Name, email address and, optionally, phone number and profile picture.
• Company name (owners), and the names and items of any expense sections the owner adds.
• Your password, which we store only as a salted one-way hash (bcrypt). We never store or see your password in readable form.
• If you sign in with Google, we receive your name, email address and profile picture from Google to create or find your account.
• Owners give us the name and email address of each worker they add, and set the worker's initial password.

Entries you record

Expenses (item, sub-item, supplier, date, amount, payment method, notes, receipt photo) and deposits (amount, date, notes). Where they are kept depends on the choice the owner made for each building:

• Buildings kept in the app: the entries are saved in our database and the receipt photos on our server.
• Buildings kept in Google Sheets: the entries are written to the owner's Google Sheet and the photos to the owner's Google Drive. They are not saved in our database; see section 3.

Camera and photos

The app uses the camera or photo library only when you choose to photograph or attach a receipt. The selected photo is sent to our server and converted to a compressed JPEG, which is then kept on our server (buildings kept in the app) or uploaded to the owner's Google Drive (buildings kept in Google Sheets), in which case we do not keep a copy.

Subscriptions

If the owner subscribes to ConstructorPro Pro, the purchase is handled by Apple (App Store), Google (Google Play) or, on our website, by RevenueCat with Stripe as the card processor. We receive the subscription status (for example, the plan and when it renews or ends), never your full card number. See section 5.

Technical information

• To block abuse, our server keeps IP addresses in memory for up to 15 minutes to limit repeated sign-in attempts. Our server logs record which address of our API was called, not who called it.
• Our hosting and website-security providers process IP addresses to deliver and protect the service.

We do not use advertising, analytics or tracking tools, and we do not track you across other apps or websites.

3. Google user data

Connecting Google is optional and only needed for buildings kept in Google Sheets. This section describes how ConstructorPro accesses, uses, stores and shares data from your Google account.

What we access and why

• Email address and basic profile (openid, email, profile): to sign you in with Google and to show the owner which Google account is connected.
• Google Drive files created by the app (https://www.googleapis.com/auth/drive.file): to create a "ConstructorPro" folder with one folder per building, create each building's spreadsheet in it, read and write that spreadsheet's expense and deposit rows, and upload the receipt photos you take. This permission only covers files the app creates. We use it to show entries, totals and balances in the app and to add, edit or delete the rows you choose.
• Google Sheets (https://www.googleapis.com/auth/spreadsheets): requested only if the owner chooses to link a spreadsheet made outside the app by pasting its link. We use it to read and write the expense and deposit rows of the spreadsheets you link. We do not list, open or read any other spreadsheet in your account.

Receipt photo links

What we store

• The email address of the connected Google account, and which of the permissions above Google granted.
• A Google OAuth refresh token, encrypted with AES-256-GCM before it is saved, so our server can update the owner's sheets when team members add entries.
• For each building kept in Google Sheets: its name, the IDs and links of its spreadsheet and Drive folders, and a summary (total expenses, total deposits, balance, number of entries and date of the latest entry) so the building list loads quickly.

Sheet contents are read from Google when you open a building and kept in our server's memory for up to 15 seconds. They are not saved to our database.

Use for your team

When a worker adds an entry to a building kept in Google Sheets, our server writes it to the owner's sheet using the owner's connection. Workers never receive the owner's Google credentials or direct access to the owner's Google account.

Sharing

We do not sell Google user data and do not use it for advertising. We do not transfer it to anyone except as needed to run ConstructorPro (our hosting provider stores the data listed above), when required by law, or with your consent. People at ConstructorPro do not read your Google data unless you ask us to for support, it is needed to investigate abuse or a security incident, or the law requires it. We do not use Google user data to develop, improve or train generalized artificial-intelligence or machine-learning models.

ConstructorPro's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing our access

The owner can tap Settings → Disconnect in the app at any time. We then revoke our access with Google and delete the stored token. You can also remove ConstructorPro at myaccount.google.com/permissions. Your spreadsheets and photos stay in your Google Drive; they belong to you. Buildings kept in the app are not affected.

4. How we use information

• To create and run your account and your team's accounts.
• To save your buildings' entries and keep their sheets up to date, and to show their figures in the app.
• To know whether your business subscribed to ConstructorPro Pro, and how many buildings it may add.
• To email verification and password-reset codes. We do not send marketing emails.
• To secure the service and prevent abuse.
• To answer your support requests.

5. Service providers

• DigitalOcean: hosts our database (United States).
• Sucuri: website firewall that protects our server.
• Resend: delivers verification and password-reset emails.
• Google: Google Sign-In, Google Sheets and Google Drive, under your own Google account; and Google Play billing for subscriptions bought on Android.
• Apple: App Store billing for subscriptions bought on iPhone or iPad.
• RevenueCat: manages subscriptions across the App Store, Google Play and our website. It receives your ConstructorPro account ID and the purchase details from the store.
• Stripe: processes card payments for subscriptions bought on our website, through RevenueCat. Stripe receives the payment details you enter there.

These providers process data only to provide their service to us, under their own privacy policies. Your information may therefore be processed in the United States and other countries where they operate.

6. How long we keep information

• Account and business information: while the account exists. Deleting the account in the app removes it from our database immediately; copies in database backups expire within 30 days. Requests by email are completed within 30 days, unless the law requires us to keep the information.
• Entries and receipt photos of buildings kept in the app: until you delete the entry or the building, or the account is deleted.
• Google token: until the owner disconnects Google or the account is deleted. After disconnecting we keep only the Google email address, so a reconnect can be checked against the same account.
• Records of buildings kept in Google Sheets: until the building is removed from the app or the account is deleted. Removing such a building from the app does not delete its spreadsheet.
• Subscription records: kept by Apple, Google, RevenueCat and Stripe as their policies and the law require.
• Verification codes: deleted automatically after they expire (5 minutes).

7. Your choices and rights

• View and correct your name and phone number in the app.
• Choose where each building is kept: in the app or in Google Sheets (owners).
• Disconnect Google from Settings at any time (owners).
• Manage or cancel your subscription in your App Store or Google Play account settings, or for web purchases from the link in your receipt email.
• Delete your account: in the app, open Settings → Delete account. This deletes your account right away and, for an owner, also the business profile, its worker accounts, its buildings with the entries and receipt photos kept in the app, and the stored Google token, and revokes our access to your Google account. Deleting the account does not cancel a store subscription; cancel it in your store account. If you can't use the app, email info@ma3lomatkw.com from the address of your account and we will delete it within 30 days. Spreadsheets and photos in your Google Drive are not deleted; you can delete them in Google Drive.
• Depending on where you live, you may have other rights, such as asking for a copy of your data or objecting to its use. Contact us and we will respond within 30 days.

8. Security

Data travels over HTTPS. Passwords are hashed with bcrypt, Google tokens are encrypted with AES-256-GCM, and the app keeps your session in the device's secure storage (iOS Keychain, Android Keystore). Receipt photos kept on our server are reachable only through long, random links that we never publish. Signing out or resetting your password ends your sessions. No system is perfectly secure, but we work to protect your information and will notify affected users of a breach as required by law.

9. Children

ConstructorPro is a business tool and is not directed to children under 16. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

10. Changes to this policy

We will post any change on this page and update the date above. If a change is significant, we will also tell you in the app before it applies.

11. Contact

Email info@ma3lomatkw.com with any question about this policy or your data.