Privacy Policy

Effective 2026-05-28 · Last updated 2026-07-08

Overview

Field Punch is a field operations management platform for construction professionals, operated by Tupper LLC (“Field Punch,” “we,” “our,” or “us”). This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, and the choices you have.

By creating an account or using the Service, you agree to this Privacy Policy. If you don’t agree, please don’t use Field Punch.

1. Information we collect

Account and profile information

When you create an account, we collect:

Full name, email address, and password (stored as a bcrypt hash — we never see it)
Job title or role within your organization
Organization name, and the names and emails of team members or subcontractors you invite
Time zone preference

Project and operations data

The core data you create and manage inside Field Punch:

Job records: project name, street address, type, status, and certificate-of-occupancy information
Punch items: title, description, status, area, assignment history, and status-change log
Photos and documents you upload as deficiency evidence or project records
Comments, annotations, and notes attached to punch items or documents
Contact records: name, company, title, email addresses, and notes
Calendar events (inspections, deliveries, site visits) and their details
Requests submitted by property owners: if a homeowner uses a progress link shared by a GC to request a punch item, we store the name, note, and photos they submit with that request

Usage and technical data

IP address, browser type, and device information — used for fraud prevention, security monitoring, and to infer a default time zone
Error reports and diagnostic logs, retained by our hosting provider, used to diagnose failures. These are scrubbed of passwords and other sensitive credentials
Last sign-in timestamp — shown to your organization’s admins as a last-active indicator on the member list
Aggregate product analytics (e.g., feature usage counts) — never linked to individual identifiers outside of debugging sessions
Push notification subscriptions — if you turn on push notifications, we store the subscription your browser issues for that device (an endpoint URL and delivery keys) so we can deliver notifications to it

Location information

When you add or edit a job address, Field Punch offers address autocomplete powered by Google’s Places service — the text you type is sent to Google to return matching address suggestions. If (and only if) you grant your browser’s location permission, we also read your device’s approximate location (latitude and longitude) to bias those suggestions toward where you are. This location reading is used transiently for that search and is not stored on our servers or linked to your profile; you can decline or revoke the browser permission at any time without losing address search.

Information from third parties

When you connect a Google Calendar account, we receive OAuth tokens, your Google account email, and a list of your calendars. We use read-only access to display events from the calendars you select alongside your Field Punch calendar; those events are fetched when you view your calendar and are not stored on our servers. We never create, modify, or delete events in your Google Calendar. Separately, you can generate a private iCal feed URL to subscribe to your Field Punch events from any calendar app — anyone holding that URL can read your Field Punch calendar, and you can rotate or disable the URL at any time.

2. How we use your information

We use the information we collect to:

Provide and operate the Service — display jobs, punch items, photos, and contacts; send the email notifications you request; host your uploaded files
Authenticate and secure your account — verify your identity at sign-in, detect unauthorized access
Communicate with you — respond to support requests and send security and service-related notices. We do not send promotional marketing email without your separate opt-in
Improve the Service — diagnose bugs, analyze aggregate usage patterns, and make product decisions. We do not use your content to train AI models
Comply with legal obligations — respond to lawful requests from courts or regulators, enforce our Terms, and prevent fraud or abuse

We do not sell your personal information to third parties. We do not use your data for behavioral advertising or share it with data brokers.

3. Legal bases for processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

Contract performance — processing required to deliver the Service you signed up for (account management and feature delivery)
Legitimate interests — fraud prevention, security monitoring, and product improvement, where these interests are not overridden by your privacy rights
Legal obligation — compliance with applicable laws and response to valid legal process
Consent — any optional data processing you explicitly opt into (you can withdraw consent at any time)

4. Subprocessors and data sharing

We share personal information only with vendors who help us run the Service. Each subprocessor receives only the minimum data necessary for their function and is bound by data processing agreements:

Vercel (US) — application hosting and edge network. Processes server requests and serves the web application.
Supabase (US) — relational database, object storage for photos and documents, and authentication infrastructure.
Resend (US) — transactional email delivery. Receives recipient email addresses and email content for notifications, digests, and password resets.
Google— (a) address autocomplete via the Places service: receives the address text you type and, if you grant browser location permission, your device’s approximate coordinates to bias results; (b) calendar integration (optional, only when you connect a Google Calendar account): receives OAuth tokens and calendar write access scoped to the calendars you select.

We may also share information: (a) with your consent; (b) to comply with a legal obligation or lawful court order; (c) to protect the rights, property, or safety of Field Punch, our users, or the public; or (d) in connection with a merger, acquisition, or sale of all or part of our business, in which case the acquirer will be bound by this policy or notified of the need to obtain fresh consent.

We do not sell your personal information to any third party.

5. Cookies and local storage

Field Punch uses a minimal set of cookies and local storage:

Session cookie (strictly necessary) — issued by Supabase Auth to keep you signed in. This cookie is required for the Service to function; it cannot be disabled.

We do not use advertising cookies, cross-site tracking pixels, or any third-party analytics that follow you across the web. We do not use Google Analytics, Facebook Pixel, or similar tools.

6. Data retention

Active accounts: We retain your content for as long as your account is active and in good standing.
After deletion: When you delete your account, we retain a backup copy for up to 30 days to allow recovery in case of accidental deletion. After that window, personal data is permanently purged from our production systems.
System and audit logs: Aggregate security logs, access logs, and anonymized error reports may be retained for up to 90 days for security and compliance purposes.
Backups: Encrypted database backups may persist for up to 30 days in disaster-recovery storage; they are purged on a rolling schedule.

7. Your privacy rights

Depending on where you live, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you
Correction — ask us to correct inaccurate data (most data can be corrected directly in the app)
Deletion — request that we delete your personal data, subject to our legal retention obligations. You can delete your account and data yourself at any time; see how to delete your account.
Portability — request a machine-readable export of your data
Objection / restriction — object to or ask us to restrict certain processing activities
Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, email tsctupper@gmail.com with the subject line “Privacy Request.” We will respond within 30 days. We may need to verify your identity before fulfilling a request.

8. California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share it
Right to Delete — request that we delete personal information we have collected from you, subject to exceptions
Right to Correct — request that we correct inaccurate personal information
Right to Opt Out of Sale or Sharing — we do not sell or share your personal information for cross-context behavioral advertising
Right to Non-Discrimination — we will not discriminate against you for exercising any CCPA rights
Right to Limit Use of Sensitive Personal Information — we do not use sensitive personal information for purposes other than providing the Service

To submit a CCPA request, email tsctupper@gmail.com with the subject line “California Privacy Request.” We do not sell personal information to third parties and have not done so in the preceding 12 months.

9. Children's privacy

Field Punch is a business tool for construction professionals. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us immediately at tsctupper@gmail.com and we will take prompt action to delete it.

10. International data transfers

Field Punch is operated from the United States. Our servers, databases, and subprocessors are primarily located in the US. If you use the Service from outside the US — including from the European Economic Area, the United Kingdom, or Canada — your personal data will be transferred to and processed in the United States.

For EEA and UK users, we rely on standard contractual clauses (SCCs) and other appropriate safeguards to legitimize such transfers in accordance with GDPR and UK GDPR requirements.

11. Security

We protect your data with industry-standard measures, including:

Row-level security (RLS) policies on every database table — no query can return data outside your authorized organization
Encrypted connections (TLS 1.2+) between your browser, our servers, and all subprocessors
Bcrypt password hashing — your password is never stored in plaintext and our team cannot read it
Hashed, rotatable access tokens for passwordless Pro Portal links, with a 7-day expiry (each weekly digest email carries a fresh link) and instant rotation capability
Strict access controls limiting production database access to a minimal set of authorized personnel
Automated content-type validation on all uploaded files to prevent malicious file injection

No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to tsctupper@gmail.com. We will investigate and respond promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes to how we collect, use, or share personal information, we will notify you by email and by posting a notice inside the app at least 14 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact us

If you have questions, concerns, or requests related to this Privacy Policy, please contact us:

Tupper LLC d/b/a Field Punch
Email: tsctupper@gmail.com
Website: fieldpunch.app