Privacy, in plain words

The short version

• Every calculation runs on your own device. The numbers you type, the circuits you size and the sheets you produce are not sent anywhere in order to be calculated, on the web or in the app.
• An account is optional. Without one the app still calculates and still saves your sheets, on the device.
• With an account we hold your email address and the sheets you choose to save, so that they reach your other devices.
• Nothing about you is sold, rented or handed to advertisers. There is no advertising in the app.
• You can delete your account, and everything stored under it, from inside the app in two taps.

Who is responsible

The controller of the personal data described here, in the sense of the General Data Protection Regulation (Regulation (EU) 2016/679), is Pavel Aleshin, Rua da Camacha 10, Bloco B 1C, 2655-345 Ericeira, Portugal.

Questions, requests and complaints: hello@fishtape.website. A person reads it.

The website

The calculators on this site run entirely in your browser. What you type into them is never transmitted to us, and the printable sheet is produced on your own machine.

The only measurement on this site is Cloudflare Web Analytics, which counts page views and nothing else. It sets no cookie, stores no identifier that follows you from one site to the next, and is not used to build a profile of you. No cookie is set by fishtape.website at all, so there is no cookie banner to dismiss. There is no Google Analytics here and no advertising tag of any kind.

The site is served by Cloudflare, which records the ordinary details of each request, including your IP address, in order to deliver the page and to defend the site against attack. Those records are Cloudflare's, kept for their own short retention periods, and we do not combine them with anything else.

The waiting list

If you enter your email address in the waiting list form, we store that address, the wiring rules you told us you work to, the page you submitted it from, the country Cloudflare reports for the request, and the time. It is kept in Cloudflare's key value store. We use it once, to tell you when the app ships, and to decide which codes to build first. Ask us and it is deleted that day.

The app

Without an account

The app calculates and saves sheets on the device with no account and no connection. In that state we hold nothing about you at all.

With an account

Signing in is by a six-digit code sent to your email address, or through Apple or Google. We then hold:

• Your email address, with the name Apple or Google return if you sign in that way, and the profile picture if Google returns one. Apple sends no picture. If you use Apple's private relay address, that relay address is all we ever see.
• When the account was created and when it was last used.
• A session record for each device you sign in on: a random token, the IP address and the browser or app identification at the moment you signed in. This is what keeps you signed in and what lets you see a sign-in you did not make.
• A hash of the six-digit code while it is valid, which is ten minutes, against the address it was sent to. The code itself is not stored in a form anyone can read back.
• Counters against abuse, keyed on the IP address and the request, so that nobody can grind through codes or flood the service.
• The sheets you save, if you are signed in: the title, the job reference you give it, the name of the code it was calculated under, the text of the sheet itself and the times it was made and changed. We store that text and hand it back to your other devices. We do not read it for anything else, and nothing in it is analysed, mined or shared.

Calculations are still done on the device. Nothing you enter into a calculator is sent to the server in order to be worked out, whether you are signed in or not.

When you buy

The app and the code packs are sold through the App Store and Google Play. You pay Apple or Google, under their terms, and we never see your card or your billing address. So that what you bought reaches every device you sign in on, our server keeps, against your account: what you own (the app, and the date the code packs run until), which store sold it, the store's own identifier for the purchase, and when it last changed. The code packs you are entitled to are then kept on your device, so that they work with no signal until that date.

The receipts from the stores pass through RevenueCat, a service that checks them with Apple and Google and tells our server what you own. RevenueCat sees a random identifier for your account and the purchases made under it, not your email address. On a phone that has not signed in, the identifier is one RevenueCat makes up for that installation. When you delete your account, its record at RevenueCat is deleted with it.

Who else touches it

• Cloudflare, which serves the site and runs the account service and its database. The database is created in Cloudflare's Western Europe region.
• Resend, which delivers the email carrying your six-digit code. It sees your address and that message. Resend is in the United States, and that transfer rests on the European Commission's standard contractual clauses.
• Apple and Google, only if you choose to sign in with them, and only to the extent of that sign-in. Their own privacy notices govern what they do on their side.
• Apple and Google again as the stores that sell the app and the code packs. They process the payment as independent controllers, under their own terms and notices.
• RevenueCat, which checks purchase receipts with the stores on our behalf. It is in the United States, and that transfer rests on the European Commission's standard contractual clauses.

Nobody else. We do not sell personal data, we run no advertising network, and we have no third-party analytics inside the app.

Why we are allowed to hold it

• To give you what you asked for, article 6(1)(b): the account, staying signed in, and carrying your sheets between your devices.
• Our legitimate interest, article 6(1)(f), in keeping the service standing up: the abuse counters, the session records, and Cloudflare's request logs. The interest is a working service that is not being attacked, and it is weighed against how little the data says about you.
• Your consent, article 6(1)(a), for the waiting list. Withdraw it at any time by writing to the address above.

How long

• Account and sheets: until you delete them. Deleting the account deletes the sheets stored under it in the same operation.
• What you bought: as long as the account exists, and after that only where tax or accounting law obliges us to keep a record of a sale.
• Sign-in codes: ten minutes, then they expire and the record is cleared.
• Sessions: ninety days from the last use, unless you sign out sooner.
• Abuse counters: minutes.
• Waiting list: until the app ships, or until you ask, whichever comes first.
• Cloudflare's request logs: Cloudflare's own retention, which is days rather than months.

What you can do

Under the GDPR you may ask for a copy of what we hold, have it corrected, have it erased, have its use restricted, object to our relying on legitimate interests, and receive it in a portable form. Write to hello@fishtape.website. We answer within one month.

You do not have to write to us to delete the account: in the app, open You and choose Delete my account. The account, the sign-in records and every sheet synced to it are deleted from the server immediately. Copies already on your own device stay there, under your control, until you remove them.

If you think we have handled your data badly you may complain to a supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados, cnpd.pt. You may also complain to the authority where you live or work.

Children

Fishtape is a working tool for a licensed trade. It is not aimed at children and we do not knowingly hold data about them.

Changes

If this notice changes in a way that matters, the date at the top changes with it and, if you have an account, we tell you by email before the change takes effect. Ask us for an earlier version and we will send it.