Privacy Policy
Topcoat is a tool contractors use to build painting estimates and send them to their customers. This policy describes what information the product handles, why, and what happens to it. It is written to be read.
Information you give us
- Your account. Your email address, used to sign you in with a one-time code. There are no passwords.
- Your business profile. Business name, phone, license number, insurance status, and the rates and prices you set.
- Job information. What you capture during a walk-through: room details, notes, photos, and voice notes with their transcripts. Voice is transcribed on your device, not on our servers.
- Your customers' information. Names, addresses, phone numbers, and email addresses you enter so a bid can be built and sent. You are responsible for having a lawful basis to give us this information; we use it only to provide the service to you, and never to contact your customers for our own purposes.
Information we do not collect
There is no advertising, no sale or sharing of personal information for advertising, no cross-site tracking, and no third-party analytics in the product today. If that changes, this policy changes first.
Where information lives
- On your device. The app is local-first: your work is stored on your device and keeps working offline.
- Cloudflare. Our servers, database, and photo/voice storage run on Cloudflare's infrastructure. Data is encrypted in transit.
- Resend. Sign-in codes and bid emails are delivered through Resend, an email provider. It processes the recipient address and message content in order to deliver them.
Who can see a bid
When you send a bid, anyone who has its link can view the bid page you chose to share — that is what the link is for. The page shows only what you chose to show (for example, a total instead of an itemized price list), and never your costs, margins, or payment records.
Retention and deletion
We keep your information until you delete it. Deleting your account in the app (Settings → Delete account) permanently removes your account record, every visit and bid, your photos and voice notes, and all active sessions. This includes information about your customers. It cannot be undone.
If you are a homeowner whose contractor used Topcoat and you want your information removed, ask your contractor to delete the bid, or contact us at the address below.
Security
Sign-in codes and session tokens are stored only as cryptographic hashes. Every piece of data is scoped to the account that owns it, enforced on the server. All traffic uses TLS.
Children
Topcoat is a tool for working contractors and is not directed at children under 13. We do not knowingly collect information from children.
Changes
If this policy changes in a way that matters, we will say so on this page with a new effective date.
Contact
Questions or requests: hello@topcoat.build