Privacy Policy

1. SCOPE AND ACCOUNTABILITY

This Privacy Policy explains how TacRight collects, uses, discloses, stores, and deletes personal information in the TacRight app, support channels, and related services. It does not govern independent practices of Apple, Google, suppliers, or websites TacRight does not control.

TacRight is accountable for personal information under its control, including information processed by service providers. Customer Support is designated as the privacy contact and can receive questions, access or correction requests, consent withdrawals, complaints, and deletion requests at tacrightsupport@gmail.com.

2. INFORMATION TACRIGHT MAY COLLECT

Depending on the features you use, TacRight may collect:

ACCOUNT AND AUTHENTICATION: Supabase user ID, Apple or Google account identifiers, name, email, authentication provider, session and security information, device and app identifiers, account timestamps, and information supplied by the sign-in provider.

SHOP AND CONTACT PROFILE: shop or business name, your name, business email, phone, street address, city, province or state, postal code, country, currency, work types, website, and quote footer.

PRICING AND BUSINESS SETTINGS: owner pay target, labour and process rates, overhead, margin, productive hours, average job size, currency, user-entered location, and selected tax rate.

CUSTOMERS AND BUSINESS RECORDS: customer names, phone numbers, emails and addresses; quotes; job names and numbers; invoices; material selections; prices; time records; expenses; notes; statuses; PDFs; and related content.

RECEIPTS AND IMAGES: receipt photographs or uploads, file metadata, merchant, purchase date, items, material or fastener specifications, quantities, package sizes, prices, tax, currency, user-entered region, OCR text, AI-extracted fields, review status, and private storage paths. Receipts may incidentally contain names, addresses, customer details, payment information, or other personal information. Do not upload full card numbers, bank credentials, government identifiers, health information, passwords, or unrelated sensitive information. Redact unnecessary information where possible.

CATALOG AND RESEARCH: material or fastener selections, user-entered prices, suppliers, price feedback, region, consent choices, receipt-derived material evidence, confidence and quality flags, and authorized reviewer decisions.

PURCHASES AND SUBSCRIPTIONS: product, entitlement, transaction, renewal, cancellation, and purchase-status information received from Apple and RevenueCat. TacRight does not receive your full App Store payment-card details.

OPTIONAL ADVERTISING MEASUREMENT: In app versions where Meta measurement is enabled, and only after you allow tracking through Apple's permission prompt, TacRight may collect and share app installation and opening activity, Meta's app-generated identifier, a hashed form of your RevenueCat app user ID (the identifier used to associate your TacRight account with its subscription), permitted device advertising and vendor identifiers, IP address, basic device and app information, event timestamps, and TacRight subscription product, trial, purchase, renewal, currency, and revenue information. These subscription amounts are payments for TacRight, not amounts on your customers' quotes or invoices. Section 6 explains the recipients, purposes, and choices.

SUPPORT, PRIVACY, AND LEGAL RECORDS: messages, attachments, requests, complaints, accepted policy version, required acknowledgment, acceptance and withdrawal times, account-deletion requests, and related correspondence.

TECHNICAL AND SECURITY INFORMATION: IP address and information ordinarily included in authentication, database, storage, API, server, security, and error logs; app version; operating system; device type; timestamps; request status; and diagnostic information needed to operate, debug, secure, and prevent abuse of the service.

TacRight does not require precise GPS location. Country, province or state, city, postal code, currency, tax location, and regional pricing location are entered by you or derived from information you enter.

3. SOURCES

Information comes from you; people authorized to use or supply information to your business; Apple or Google sign-in; Apple and RevenueCat purchase systems; your device and the app; uploaded receipts and files; suppliers and public pricing sources; service providers; and lawful security, support, or legal processes. If you submit another person’s information, you are responsible for having authority and giving any required notice.

4. WHY TACRIGHT USES INFORMATION

TacRight may process information to create, authenticate, secure, support, and delete accounts; save and synchronize shop settings and records; provide quotes, jobs, invoices, PDFs, expenses, receipt storage, OCR, AI receipt extraction, catalog pricing, currency and tax fields, profitability reports, and subscriptions; perform shared material-price research when a user chooses to contribute; process purchases and entitlements; answer support and privacy requests; detect and investigate fraud, abuse, unauthorized access, errors, and security incidents; maintain, debug, audit, and improve reliability and accessibility; comply with law; enforce agreements; protect rights and safety; and establish or defend legal claims.

TacRight will not use personal information for a materially new purpose without notice and consent where required by law.

When you permit the optional advertising measurement described in section 6, TacRight also uses the limited information described there to understand which advertisements lead to installations, trials, and subscriptions and to improve delivery and performance of TacRight advertisements.

5. RECEIPT PROCESSING AND USER CHOICES

Core account and business-record processing is necessary to provide the TacRight features you request. You choose which profile fields, customers, receipts, and records to add. Submitting a receipt is voluntary, and you may enter an expense manually without a receipt.

AI RECEIPT EXTRACTION: Before the first receipt scan, TacRight explains the processing and asks for permission. When you then choose to scan or upload a receipt, TacRight sends the selected receipt image and up to 12,000 characters of on-device OCR text through a Supabase Edge Function to the OpenAI Responses API. The request asks OpenAI to extract fields such as merchant, purchase date, line items, material descriptions, quantities, prices, tax, total, currency, and confidence so you can review the result. Receipt images can contain names, addresses, customer details, partial payment-card details, loyalty information, or other incidental personal information, so redact information that is not needed before submitting a receipt. TacRight sends these API requests with storage disabled. Under OpenAI's default API data controls, API data is not used to train OpenAI models unless TacRight explicitly opts in, but prompts, images, outputs, and related metadata may be kept in abuse-monitoring logs for up to 30 days or longer where OpenAI states that law or service protection requires it. Review every result before saving or using it.

OPTIONAL SHARED MATERIAL-PRICE RESEARCH: Before the first receipt scan, you may separately choose whether minimized material-price information from future receipts contributes to shared price research. This choice is off until you enable it and can be changed later in Legal & Privacy settings. When enabled, TacRight's receipt worker retrieves newly saved receipt images from private Supabase storage and sends them to the OpenAI Responses API with storage disabled. OpenAI is asked to identify raw materials and zinc or stainless fasteners, specifications, quantities, package sizes, purchase date, currency, pretax line prices, and supplier country or province/state. A second AI comparison may compare the extracted material description with a limited set of catalog candidates. TacRight stores minimized evidence linked to the matched catalog item, including quantities, normalized prices, confirmed specifications, confidence, purchase date, currency, and region. The evidence does not intentionally include the receipt image, supplier name, customer identity, account identity, addresses, contact details, card details, or arbitrary receipt text. Authorized TacRight reviewers use weekly reports to approve or reject proposed catalog changes; AI never changes a shared catalog price automatically.

Turning research contribution off stops new research jobs and removes pending contribution evidence as technically and legally possible. It does not disable ordinary receipt scanning or manual expense entry and cannot recall processing already completed by a provider. Approved aggregate or de-identified prices and their audit records may remain when they no longer identify you.

6. SERVICE PROVIDERS, DISCLOSURES, AND INTERNATIONAL PROCESSING

TacRight uses providers for identified purposes, including Supabase for authentication, database, private storage, server functions, security, and synchronization; OpenAI for receipt extraction and shared material-price research; Apple and Google for authentication and platform services; and Apple and RevenueCat for subscription purchases and entitlement processing.

OPTIONAL META ADVERTISING MEASUREMENT: Where this feature is enabled, TacRight uses Meta's software development kit for app installation and opening events and RevenueCat's Meta integration for subscription events. With your tracking permission, RevenueCat can send trial starts, conversions, subscription purchases, and renewals to Meta, including renewals occurring while the app is closed. Meta may combine the advertising-measurement information listed in section 2 with information from other companies' apps and websites to measure and optimize TacRight advertising. Meta is an advertising-measurement recipient with its own privacy practices, not the provider of TacRight's private shop-record storage.

For subscription events sent through Meta's Conversions API, RevenueCat sends the hashed app user ID as an external identifier to help match events for advertising measurement. Hashing transforms the identifier rather than sending its original value, but it does not make the information anonymous or prevent Meta from linking it with other information. This sharing is subject to the tracking choice described below.

This advertising integration does not send your shop records, customer contact details, receipt images or contents, job descriptions, quote or invoice amounts, or precise location to Meta. TacRight does not add your sign-in email, name, or phone number as advertising-matching attributes. This does not prevent Meta from associating permitted identifiers with information it already holds.

YOUR TRACKING CHOICE: On iOS, you can decline Apple's tracking prompt without losing access to TacRight's features. Accepting this Privacy Policy or creating an account is not consent to advertising tracking. You can change your choice in iOS Settings > Privacy & Security > Tracking > TacRight. The app checks permission on launch or return to the foreground and before subscription attribution. After changing permission, reopen TacRight with an internet connection so the updated choice can reach RevenueCat. When the withdrawal is processed, TacRight stops new consent-based measurement events and instructs RevenueCat not to send further subscription events to Meta for that consent state. An offline device or failed connection can delay that update; contact tacrightsupport@gmail.com if you need help withdrawing consent. Withdrawal does not recall events already sent or processing already completed.

APPLE'S PRIVACY-PRESERVING MEASUREMENT: In versions where attribution is enabled, Apple's SKAdNetwork may report an installation or a coarse conversion signal, such as starting a trial or paid subscription, without an advertising identifier, including when you decline tracking. These reports do not contain your shop or customer records and are subject to Apple's reporting delays and privacy protections. This is separate from the consent-based Meta and RevenueCat event sharing above.

PROVIDER INFORMATION: Meta's privacy policy, including its retention and deletion practices and privacy choices, is available at https://www.facebook.com/privacy/policy/. RevenueCat's privacy information is available at https://www.revenuecat.com/privacy/. You can also contact TacRight about information shared through this integration. TacRight cannot promise that withdrawing tracking permission automatically deletes information already held by these providers.

These providers may process information outside your province, state, or country, including in Canada and the United States or other locations where they and their subprocessors operate. Information processed in another jurisdiction may be accessible to courts, law enforcement, or authorities under that jurisdiction’s laws. TacRight requires providers to protect data through contractual, organizational, and technical safeguards appropriate to their role.

TacRight may also disclose information when you direct it; to professional advisers under confidentiality; to protect users, rights, safety, and service security; to investigate misuse; to comply with law or legal process; to establish or defend legal claims; or to a successor in a lawful financing, reorganization, merger, or sale subject to appropriate safeguards and notice where required.

TacRight does not sell personal information for money. The optional cross-app advertising measurement described above can be considered sharing or processing for targeted advertising under some privacy laws. TacRight does not use your private business records for this purpose. You may decline or withdraw tracking permission as described above and contact TacRight to exercise applicable privacy rights.

7. SECURITY

TacRight uses measures such as account-scoped database policies, access controls, encrypted network transport, managed authentication, private receipt storage, service-role separation, and provider safeguards. Access to shared-price evidence is restricted to authorized reviewers. No system is completely secure. TacRight cannot guarantee that unauthorized access, loss, alteration, disclosure, or service interruption will never occur. Protect your device and sign-in account and promptly report suspected compromise to tacrightsupport@gmail.com.

8. RETENTION AND DELETION

Account information, shop settings, customers, quotes, jobs, invoices, expenses, saved receipts, and related business records are retained while your TacRight account is active unless you delete particular records earlier.

When you use in-app account deletion, TacRight removes your account and associated information from active production systems, including private receipt objects, subject to technical completion and information that must legally be retained. Deletion is irreversible, so export records you must keep before deleting.

Limited information may remain for up to one year after account deletion in encrypted backups, provider recovery systems, security records, consent and withdrawal records, subscription or accounting records, dispute records, fraud-prevention records, or legal holds. It will remain protected, will not be used for ordinary product functions, and will be deleted or de-identified when no longer required. Information may be retained longer only where law requires or permits it for a continuing legal obligation, claim, investigation, or security purpose.

Unapproved shared-price research evidence is retained for no longer than 180 days and is removed sooner when applicable following withdrawal or account deletion. Processing already completed by a provider cannot be recalled. Approved aggregate or de-identified price records and their audit history may be retained because they do not identify the contributing user.

Operational, authentication, and security logs are retained only as reasonably necessary and, unless a longer legal, security, fraud, or dispute need applies, no longer than one year after account deletion. Active production data and backup copies may be deleted on different schedules, but the maximum ordinary post-deletion period is one year.

For optional advertising measurement, TacRight retains consent and related support records under the limits above. Meta may retain information already received under its own privacy policy and retention criteria; TacRight's one-year post-deletion limit is not a promise about Meta's independent retention. Contact TacRight for help with an access or deletion request concerning this sharing. Deleting the app alone does not cancel a subscription or recall previously shared events.

9. ACCESS, CORRECTION, WITHDRAWAL, AND COMPLAINTS

Subject to applicable law, you may request access to or correction of personal information, ask how it has been used or disclosed, withdraw consent, delete a receipt or your account, or complain about TacRight’s privacy practices. You can disable shared material-price research without disabling ordinary receipt scanning. To stop AI extraction, do not scan or upload additional receipts and use manual expense entry. Contact Customer Support at tacrightsupport@gmail.com. TacRight may need to verify your identity and will respond within applicable legal periods. If a request is refused as permitted by law, TacRight will explain the reason and available review process.

You may also complain to the privacy regulator with jurisdiction, including the Office of the Information and Privacy Commissioner for British Columbia where applicable.

10. USERS AGED 16 AND OLDER

TacRight is intended for users aged 16 or older and for business use. If the law where a user lives requires consent from a parent, guardian, or other authorized person for a 16- or 17-year-old, that consent must be obtained before account creation. TacRight does not knowingly collect information from a person who cannot legally provide the required consent. Contact tacrightsupport@gmail.com if you believe such information was collected.

11. CANADA AND UNITED STATES

TacRight is offered to users in Canada and the United States. Local consumer and privacy rights may vary. Nothing in this policy limits a right that cannot legally be limited. Users outside the intended markets must not create an account unless TacRight expressly supports their location.

12. POLICY CHANGES

TacRight may update this policy for legal, security, service, or data-practice changes. The effective date and version will change. Material changes will be presented before they take effect, and fresh acceptance or consent will be requested when required. Earlier consent does not authorize materially new purposes.

13. CONTACT

Privacy questions, requests, and complaints:

Customer Support

Rylen Thompson, operating as TacRight

2132 Chilcotin Crescent

Kelowna, British Columbia V1V 2N9, Canada

tacrightsupport@gmail.com