Privacy Policy — HardHat Log
Effective 8 September 2026
HardHat Log ("the app") is a mobile app for creating construction site surveillance reports and exporting them as PDFs. It is developed and operated by CivilConstruct ("we", "us"). This page explains what information the app handles, where it goes, and the controls you have. Questions: support@civilconstruct.app.
- Your reports, photos, and account details are stored on your device and synced to our backend so your team can see them and you don't lose them.
- Location is read only to fetch the weather for a report, and is never stored.
- No ads, no analytics, no trackers — and we never sell your data.
- You can permanently delete your account and its data from inside the app.
Information the app collects
Account. Your email address, a display name, and a password (held only as a secure hash by our authentication provider — we never see it). If you sign in with Google or Apple instead, we receive your name and email address from them and no password is involved.
Content you create. Report details (project information, personnel and contractor names, plant, observations, weather values), photos you attach with their captions and timestamps, your company or team name and logo, and team invite codes. Frequently used entries are kept as autocomplete suggestions shared within your workspace.
Location — transient only. With your permission, the app reads your coordinates once when a report fetches the weather. The coordinates are sent to Open-Meteo (a weather service), used to fill in the weather fields, and discarded — they are never stored and never linked to your account. If you decline the permission, you can type the weather in manually.
Device permissions. Camera and photo library access are used only to attach photos to reports.
The app contains no advertising, no analytics or usage tracking, and no third-party tracking SDKs.
How we use it
Solely to provide the app: storing and syncing your reports, sharing them within your team workspace, generating PDFs on your device, and sending transactional email — signup confirmation codes and password reset codes — from noreply@civilconstruct.app. We do not send marketing email.
Where your data lives
On your device (the app works fully offline) and in our backend, hosted by Supabase in AWS Sydney (ap-southeast-2). Photos and logos are kept in private storage buckets, all database access is enforced per-workspace with row-level security, and connections use TLS encryption.
Who can see your content
Reports belong to a workspace. In your personal workspace, only you can see them. In a team workspace, your teammates (teams hold up to 25 members) can view your reports — though only you or the team owner can edit or delete them — and your display name and email address are visible to the team. PDF exports you share from the app go wherever you choose to send them.
Service providers
- Supabase — database, authentication, and file storage.
- Resend — delivers our transactional email.
- Cloudflare — our domain and the routing of support email to us.
- Open-Meteo — weather lookups; receives coordinates only, with no account identifiers.
- Google / Apple — only if you choose to sign in with them.
These providers process data only to run the service. Infrastructure providers keep short-lived operational logs (such as IP addresses) to operate and secure their systems. We do not sell personal information, and we do not share it for advertising.
Retention and deletion
Your data is kept for as long as your account exists. In the app, Settings → Delete account permanently deletes your account, your profile, your personal workspace, and every report in it, immediately — and the app wipes its local copy from your device. Reports you created in a team workspace remain with that team. Photo and logo files tied to the deleted workspace are permanently deleted from storage at the same time.
If you can no longer sign in, see how to request account deletion.
Your choices and rights
- Access and export — open any of your reports and export it as a PDF.
- Correction — edit your reports, profile, and workspace in the app.
- Deletion — delete individual reports, or your whole account, in the app.
- Permissions — camera, photos, and location access can be revoked at any time in your device settings.
For anything else, email support@civilconstruct.app.
Children
HardHat Log is a professional tool and is not directed at children. Do not create an account if you are under 16.
Changes to this policy
If this policy changes, we will update this page and its effective date, and flag material changes in the app.