Privacy Policy

Introduction

At TidyTrack ("we," "our," or "us"), operated by Slewsoft, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you use our cleaning operations platform at tidytrack.com and app.tidytrack.com, and related services (the "Service").

Information we collect

Account and workspace information

Information you provide directly to us, including:

• Name, email address and contact information
• Company or organization name and workspace settings
• Account credentials (managed by our authentication provider, WorkOS)
• Payment and billing information (processed by Stripe; we do not store full card numbers)
• Support communications and feedback

Cleaning operations data

Content your workspace creates while using the Service:

• Sites, areas, checklists, schedules, clients and invoices you configure
• Cleaning logs, including the team member a cleaner selects (or, where the workspace allows it, the name they type) when logging via a QR code, checklist items ticked, notes, flags and timestamps
• If you enable a public "last cleaned" status page for an area, recent cleaning information for that area becomes publicly visible at its status URL until you disable it

Anonymous QR logs and issue reports

Anyone with access to a QR poster can open its log page without an account. Guests can also use it to report a problem with an area; a report contains the description they write and, if they choose to give one, a name. When a cleaning log or an issue report is submitted from a QR page, we also record, to investigate abuse and filter automated submissions:

• A salted, one-way hash of the submitter's IP address. We do not store the IP address itself.
• The browser's user agent string
• The country, network (autonomous system number) and bot score that our hosting provider, Cloudflare, attaches to the request

Public QR endpoints are also rate limited by IP address. That check is performed by Cloudflare as the request arrives, and the address is not written to our database.

Cleaner identity verification

A workspace can require cleaners to confirm who they are before logging. In that case we email a six-digit code to the selected team member's address. We store only a hash of the code, and it expires after 10 minutes. Once the code is confirmed, a random device token is saved in that browser's local storage so later scans on the same device skip the code. We store only a hash of the token, and it expires after 30 days or sooner if the cleaner clears their browser data.

Usage information

Information collected automatically when you use the Service:

• Device and browser information
• Log files and system activity, including audit logs of actions taken in your workspace
• Error reports, described under "Error monitoring" below

Website forms

If you use the contact form or sign up for product updates on tidytrack.com, we receive the name, email address and message you submit.

How we use your information

• Providing and maintaining the Service
• Processing subscriptions and managing your account
• Communicating with you about your account and the Service
• Improving the platform and developing new features
• Ensuring security, preventing fraud and abuse of public QR endpoints
• Complying with legal obligations
• Sending product updates you have opted into (you can unsubscribe anytime)

Signing in with Google

If you choose "Sign in with Google", Google shares a limited set of profile information with us through our authentication provider (WorkOS): your name, email address and, where available, your profile picture and Google account identifier. We use this information solely to create and secure your TidyTrack account and to sign you in. We don't use it for advertising, and we don't share it with third parties other than the service providers below who help us operate the Service.

TidyTrack's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke TidyTrack's access at any time from your Google Account permissions page.

Error monitoring

We use Sentry to find and fix errors in the Service. When something fails, an error report is sent with technical details such as the request path, browser and error trace. We configure it not to collect personal information by default, and the tokens in QR poster and status page links are removed from reports before they are sent.

Service providers

We do not sell, trade or rent your personal information. We rely on a small number of service providers to run the Service, each of which processes data only as needed to provide their function:

• Cloudflare: hosting, storage, content delivery and rate limiting. The Service runs on Cloudflare's global network (Workers, D1, KV, Pages).
• WorkOS: sign-in, including Sign in with Google, and user and organization management for dashboard accounts.
• Stripe: subscription billing and payment processing.
• Resend: transactional email such as team invitations, verification codes and issue notifications.
• Sentry: error monitoring.
• YouTube: plays the product video on our homepage. Nothing loads from YouTube until you press play; the player is then served from youtube-nocookie.com under Google's privacy policy.

We may also disclose information:

• Legal compliance: when required by law or to protect our rights and safety
• Business transfers: in connection with a merger, acquisition or sale of assets
• Consent: when you have given us explicit permission

Data security

We implement security measures to protect your information, including:

• Encryption of data in transit (TLS) and at rest
• Workspace-level data isolation — your data is only queryable within your organization
• Access controls and authentication on all non-public endpoints
• Revocable QR codes: any area's code can be rotated at once, immediately invalidating the old one
• Hashing instead of storing raw IP addresses, verification codes and device tokens

Your rights and choices

Depending on your location (including under GDPR and PIPEDA), you may have the following rights regarding your personal information:

• Access: request access to your personal information
• Correction: request correction of inaccurate information
• Deletion: request deletion of your personal information
• Portability: request a copy of your data in a portable format
• Restriction and objection: ask us to limit or stop certain processing
• Opt-out: unsubscribe from marketing communications at any time

To exercise any of these rights, email [email protected]. If you are a cleaner whose name appears in a workspace's cleaning logs, we may direct your request to the workspace owner, who controls that data.

Data retention

We retain workspace data for as long as your account is active. Report history visibility varies by plan, but underlying logs are retained so upgrading restores access. If you delete your account, we delete or anonymize your personal information within a reasonable period, except where retention is required by law (for example, billing records).

International data transfers

We are a Canadian company, and the Service runs on Cloudflare's globally distributed network, which may process data in multiple jurisdictions. When data is transferred internationally, we ensure appropriate safeguards are in place in accordance with applicable privacy laws.

Children's privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will take steps to delete it promptly.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

Contact us

If you have any questions about this Privacy Policy or our privacy practices, please contact us: