Privacy Policy

FieldPunch is a field operations management platform for construction professionals, operated by Tupper LLC (“FieldPunch,” “we,” “our,” or “us”). This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, and the choices you have.

By creating an account or using the Service, you agree to this Privacy Policy. If you don’t agree, please don’t use FieldPunch.

We use the information we collect to:

• Provide and operate the Service — display jobs, punch items, photos, and contacts; send the email notifications you request; host your uploaded files
• Authenticate and secure your account — verify your identity at sign-in, detect unauthorized access
• Communicate with you — respond to support requests and send security and service-related notices. We do not send promotional marketing email without your separate opt-in
• Improve the Service — diagnose bugs, analyze aggregate usage patterns, and make product decisions. We do not use your content to train AI models
• Comply with legal obligations — respond to lawful requests from courts or regulators, enforce our Terms, and prevent fraud or abuse

We do not sell your personal information to third parties. We do not use your data for behavioral advertising or share it with data brokers.

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

• Contract performance — processing required to deliver the Service you signed up for (account management and feature delivery)
• Legitimate interests — fraud prevention, security monitoring, and product improvement, where these interests are not overridden by your privacy rights
• Legal obligation — compliance with applicable laws and response to valid legal process
• Consent — any optional data processing you explicitly opt into (you can withdraw consent at any time)

We share personal information only with vendors who help us run the Service. Each subprocessor receives only the minimum data necessary for their function and is bound by data processing agreements:

• Vercel (US) — application hosting and edge network. Processes server requests, serves the web application, and retains operational and diagnostic logs.
• Supabase (US) — relational database, object storage for photos and documents, and authentication infrastructure.
• Google — address autocomplete via the Places service: receives the address text you type.

Optional Spanish reports use OpenAI, directly or through Vercel AI Gateway. Choosing Spanish sends the report narrative and room labels for translation; photos are not sent. Receipt costs are entered manually. English reports remain available. We request translation responses without provider response storage; this does not promise that the provider keeps no operational records.

We may also share information: (a) with your consent; (b) to comply with a legal obligation or lawful court order; (c) to protect the rights, property, or safety of Field Punch, our users, or the public; or (d) in connection with a merger, acquisition, or sale of all or part of our business, in which case the acquirer will be bound by this policy or notified of the need to obtain fresh consent.

We do not sell your personal information to any third party.

FieldPunch uses the following strictly functional browser and app storage:

• Website session cookies — issued by Supabase Auth to keep you signed in and refresh your authenticated website session.
• iOS app authentication storage — the bundled app keeps its Supabase session in app-private local storage so it can authenticate field API requests and refresh the session between launches.
• Device-local field data — FieldPunch can store tenant-scoped job, contact, and activity snapshots plus queued changes and attached photo data in an on-device database so supported field work remains available during a lost connection. In the bundled app, access is locked on sign-out, and a different user signing in clears the prior user’s stored field data.
• Functional preferences — small local values remember interface state and connection/sync behavior. They are not used for advertising or cross-site tracking.

We do not use advertising cookies, cross-site tracking pixels, or any third-party analytics that follow you across the web. We do not use Google Analytics, Facebook Pixel, or similar tools.

• Active accounts: We retain your content for as long as your account is active and in good standing.
• After deletion: When you delete your account, we retain a backup copy for up to 30 days to allow recovery in case of accidental deletion. After that window, personal data is permanently purged from our production systems.
• System and audit logs: Aggregate security logs, access logs, and anonymized error reports may be retained for up to 90 days for security and compliance purposes.
• Backups: Encrypted database backups may persist for up to 30 days in disaster-recovery storage; they are purged on a rolling schedule.

Depending on where you live, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate data (most data can be corrected directly in the app)
• Deletion — request that we delete your personal data, subject to our legal retention obligations. You can delete your account and data yourself at any time; see how to delete your account.
• Portability — request a machine-readable export of your data
• Objection / restriction — object to or ask us to restrict certain processing activities
• Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, email tsctupper@gmail.com with the subject line “Privacy Request.” We will respond within 30 days. We may need to verify your identity before fulfilling a request.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share it
• Right to Delete — request that we delete personal information we have collected from you, subject to exceptions
• Right to Correct — request that we correct inaccurate personal information
• Right to Opt Out of Sale or Sharing — we do not sell or share your personal information for cross-context behavioral advertising
• Right to Non-Discrimination — we will not discriminate against you for exercising any CCPA rights
• Right to Limit Use of Sensitive Personal Information — we do not use sensitive personal information for purposes other than providing the Service

To submit a CCPA request, email tsctupper@gmail.com with the subject line “California Privacy Request.” We do not sell personal information to third parties and have not done so in the preceding 12 months.

FieldPunch is a business tool for construction professionals. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us immediately at tsctupper@gmail.com and we will take prompt action to delete it.

FieldPunch is operated from the United States. Our servers, databases, and subprocessors are primarily located in the US. If you use the Service from outside the US — including from the European Economic Area, the United Kingdom, or Canada — your personal data will be transferred to and processed in the United States.

For EEA and UK users, we rely on standard contractual clauses (SCCs) and other appropriate safeguards to legitimize such transfers in accordance with GDPR and UK GDPR requirements.

We protect your data with industry-standard measures, including:

• Row-level security (RLS) policies on every database table — no query can return data outside your authorized organization
• Encrypted connections (TLS 1.2+) between your browser, our servers, and all subprocessors
• Bcrypt password hashing — your password is never stored in plaintext and our team cannot read it
• Strict access controls limiting production database access to a minimal set of authorized personnel
• Automated content-type validation on all uploaded files to prevent malicious file injection

No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to tsctupper@gmail.com. We will investigate and respond promptly.

We may update this Privacy Policy from time to time. If we make material changes to how we collect, use, or share personal information, we will notify you by email and by posting a notice inside the app at least 14 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you have questions, concerns, or requests related to this Privacy Policy, please contact us:

Tupper LLC d/b/a FieldPunch
Email: tsctupper@gmail.com
Website: fieldpunch.app

See also our Terms of Service.