Re-Roper

Re-Roper Privacy Policy

What Re-Roper collects and what it does with it. Effective October 12, 2026.

This policy covers Re-Roper, the calculator suite for elevator re-roping: the Re-Roper mobile app and the website re-roper.com. Both are run by Kristian Caroe Klausen, an individual in California, USA. The app and the website share the same accounts and the same jobs, so this one policy covers both.

The short version

  • We collect your email address, the jobs you sync to your account, and basic technical details such as your IP address and device type. If you sign in with Google, we also receive your name, your email address and whether Google has verified it, your profile picture link, your Google account ID, and, for a work or school account, its domain (see Google user data). If you sign in with Apple, we receive your Apple user ID, the email address you choose, and your name if you share it (see Sign in with Apple). If you subscribe to Re-Roper Pro, our monthly subscription, on re-roper.com, our payment processor Stripe takes your card details (we never see your full card number); in the iPhone app, Apple takes the payment, and RevenueCat, which runs our in-app purchases, receives your purchase record. Either way, we keep your subscription's status and a record of the terms you agreed to. Photos you add to a job stay on your phone or in your browser; we never receive them.
  • We use it to sign you in, to keep your jobs the same on your phone and on this website if you have Re-Roper Pro, to bill your subscription if you pay for one, and to email you about your account and your subscription.
  • We don't sell your information, show ads, track you across other apps and sites, or use your information to train AI models.
  • The app has no analytics or advertising code. On an iPhone it includes RevenueCat's code for in-app purchases, which we use only to sell and check Re-Roper Pro, not for ads or tracking. The website counts visits with Cloudflare Web Analytics, which uses no cookies.
  • You can delete any job at any time; without a subscription, a copy already synced to your account stays there until you subscribe again or delete your account. You can also delete your account and everything synced to it yourself, right away, in the app's Settings or on this website's Profile page, or ask us to delete it by email at support@re-roper.com, as Deleting your jobs and your account explains. If you subscribed, the record of the terms you agreed to is kept for at least 3 years, as California law requires. Deleting your account doesn't cancel a subscription bought in the iPhone app; cancel it in the App Store.

Who runs Re-Roper

Re-Roper is run by Kristian Caroe Klausen, an individual in California, USA. In this policy, “we,” “us,” and “our” mean Kristian Caroe Klausen. For any privacy question or request, email support@re-roper.com.

While the app is being tested

Anyone can open re-roper.com and create an account there. Some testers run the mobile app inside Expo Go, an app made by Expo, whose own privacy policy covers what Expo Go collects. While you test it that way, the app is loaded from our development computer, which sees your phone's IP address, what kind of phone and system it runs, and the messages and errors the app logs. If we test through Expo's tunnel instead of our local network, ngrok, the company that runs that tunnel for Expo, relays the connection.

What we collect

Everything Re-Roper collects, at a glance and then in detail:

Your account

Your email address, a password if you set one (stored only as a salted hash, a scrambled form that can't be turned back into the password), a random account ID, when the account was created, confirmed, and last signed in, and how you sign in.

From
You, or Google or Apple if you sign in with them.
Why
To sign you in, keep your account secure, and email you about it.
Kept
Until your account is deleted.
From Google

Your Google account ID, your email address and whether Google has verified it, your name, a link to your profile picture, and, for a work or school account, its domain.

From
Google, only if you choose Sign in with Google.
Why
To create your account, sign you in, add Google sign-in to an existing account with the same email address, and email you about your account and our policies. If you subscribe on re-roper.com, your email address is also the one on your billing record at Stripe, our payment processor. We store the name, picture link, and domain but don't use them. See Google user data.
Kept
Until your account is deleted.
From Apple

Your Apple user ID, the email address you choose (your own or a private relay address), whether it is a relay address, when you signed in, and your name the first time, if you share it.

From
Apple, only if you choose Sign in with Apple.
Why
To create your account, sign you in, add Apple sign-in to an existing account with the same email address, and email you about your account and our policies. If Apple sends your name, we store it but don't use it. If you subscribe on re-roper.com, Stripe, our payment processor, gets your email address unless it is a relay address. Buying in the iPhone app gives us neither your name nor your Apple Account's email address.
Kept
Until your account is deleted.
Your jobs

Job names and addresses, elevator IDs, contract numbers, equipment, rope, hoistway, and governor details, measurements, runby logs, notes, and when each record was created and changed.

From
You. Jobs made on the website while signed out stay in that browser until an account with Re-Roper Pro signs in there.
Why
To run the calculators and, with Re-Roper Pro, keep your jobs the same on your phone and on the website.
Kept
Until you delete them or your account. Without a subscription, a job you delete on a phone or in a browser stays in your account until you subscribe again and that device syncs, or until your account is deleted. A small marker stays for each deleted elevator until your account is deleted.
Your subscription

If you subscribe on re-roper.com: your Stripe customer and subscription numbers, the plan and price, whether the subscription is active, when it renews, when a payment failed, and when it was cancelled or ended. If you subscribe in the iPhone app: what Apple reports about it through RevenueCat (the product, Apple's transaction number, whether it is a test purchase, when you bought it, when it renews or expires, whether it will renew, and any billing problem, grace period, or refund, and Apple's link for managing it), and a log of each update RevenueCat sends us (your account ID or the random ID described under In-app purchases, the product, its price and currency, the App Store country, Apple's transaction numbers, and the dates). Either way, a record of the subscription terms you agreed to: their exact words and version, when you agreed and whether in the app or on the website, the app's version if you used the app, your account ID (or, if you bought in the iPhone app before signing in, the random ID until you sign in), your email address if you were signed in, the checkout or, for an App Store purchase, Apple's transaction number and the App Store country, and when you paid, when we emailed you a copy, and when the subscription ended. If we give your account free access, a note of it: your account ID or email address, why, and until when.

From
You, when you subscribe; Stripe, our payment processor; and Apple, through RevenueCat, which runs our in-app purchases.
Why
To check whether your account, or in the iPhone app your iPhone, has a subscription, send the emails the law requires, and keep proof of what you agreed to, as California law requires.
Kept
The subscription's status, and any note of free access: until your account is deleted. The record of the terms you agreed to: at least 3 years from when you agreed, or 1 year after your subscription ends if that is later, even after your account is deleted. A record for a checkout you opened but never paid for: at least 1 year. The log of RevenueCat's updates: for as long as tax law requires us to keep payment records, also after your account is deleted.
In-app purchases

In the iPhone app: an ID for you at RevenueCat (your account ID once you sign in, or a random ID before), your App Store purchase history and receipts, the product, its price and dates, and whether it renews, and, with each request the app makes to RevenueCat, your IP address, basic details of your phone, its system, and the app, and your language and App Store country.

From
The app on your iPhone, when you sign in or use it without an account and when you buy or restore, and Apple, through RevenueCat.
Why
To sell you Re-Roper Pro in the App Store, check whether your iPhone or your account has it, restore it, and link a purchase you made before signing in to your account. RevenueCat also shows us totals, such as how many people subscribe.
Kept
At RevenueCat, the record under your account ID: until your account is deleted, when we ask RevenueCat to delete it. A record under a random ID that was never linked to an account stays at RevenueCat while we use it, unless you ask us to delete it.
Payment details

On re-roper.com: your card number, expiry date, and security code, your name, your billing address, and your email address. In the iPhone app, Apple takes your payment, and we receive none of your payment details.

From
You, on Stripe's checkout page. Stripe keeps them, except the security code, in our Stripe account, where we can see your name, billing address, email address, and your card's brand, last four digits, and expiry date, but never your full card number.
Why
So Stripe can charge your card when you subscribe and each month after, and so we can handle refunds, disputes, and sales tax.
Kept
In our Stripe account for as long as tax law requires us to keep payment records, also after your subscription ends or your account is deleted. Stripe also keeps its own records under its own privacy policy.
Sign-in sessions

For each phone or browser you are signed in on: its latest IP address, its device or browser type, and when it was last used.

From
Your phone or browser, when it signs in and when it renews its sign-in.
Why
To keep you signed in and to spot misuse.
Kept
Until you sign out there while online, or your account is deleted. Changing your password ends your other sessions.
Server logs

For each request to our sign-in and database service: IP address, device or browser type, time, the web address asked for, and the rough location and internet provider the IP address points to. Sign-in logs add your email address, and your name if Google or Apple gave us one.

From
Your phone or browser, each time it contacts Supabase, our sign-in and database provider, even before you sign in.
Why
Security, fixing problems, and keeping the service running.
Kept
Supabase's logs: 7 days. Any record of your sign-in events kept in our database: until your account is deleted.
Website visits

Your IP address and browser details, which Cloudflare (our host) and Google Fonts (which supplies our typefaces) receive with each page. For visitor counts: the page, the page that sent you, how fast it loaded, your browser, operating system, device type, and country.

From
Your browser, when you open re-roper.com.
Why
To serve and protect the website, and to see how many people use it and how fast it loads.
Kept
Cloudflare's records of requests: we can see them for up to 31 days. Visitor counts: in full for 7 days, then a sample of about 1 in 10 for 6 months. Google Fonts: under Google's own privacy policy.
Emails

Your email address, copies of the account emails we send you, the subscription emails and notices we send you through Resend, a record of which notices we have sent you, and anything you write to us.

From
Our sign-in provider, which sends account emails through our mailbox; Resend, which sends our subscription emails and our notices about changes to our Terms of Use or this policy; and you, when you write to us.
Why
To confirm your address, reset your password, tell you about your account and about changes to our Terms of Use or this policy, send the subscription emails the law requires, and answer you.
Kept
Copies in our mailbox: while your account exists; we delete them within 30 days of your account's deletion. If you write to us without an account, only as long as we need them to answer you. Resend's copies stop being visible to us within 30 days. The record of which notices we sent you: until your account is deleted. The links and codes in our emails stop working after 10 minutes.
On your device

Your jobs, the photos you add to them, your settings, a sync record with your account ID, your subscription's status as last checked, your sign-in session: sign-in tokens (the keys that keep you signed in), your email address, how you sign in, and any name or picture link from Google or Apple, and, in the app on an iPhone, RevenueCat's ID for you and your purchase status.

From
The app and the website, as you use them.
Why
To work offline, keep you signed in, and open what your subscription covers without a signal.
Kept
Until you delete them, clear this site's data in your browser, or delete the app, or until a different account takes over that device. Signing out while online removes your sign-in session but keeps your jobs.

Our database provider also keeps a daily backup of the database for 7 days, so anything deleted from it can stay in a backup for up to 7 days.

Your account

Signing up with email asks only for your email address and a password, not your name or phone number. Supabase, our sign-in provider, stores the password only as a salted hash, so no one at Re-Roper can read it. If you sign in with Google or Apple instead, it can share your name, as the next part explains.

If Google or Apple sends a verified email address that already belongs to a Re-Roper account, our sign-in provider adds that sign-in to the same account and stores the details it sends with it.

From Google or Apple

Only if you choose Sign in with Google or Sign in with Apple. The app and the website show you only your email address and how you sign in; they never show or use your name or picture, and never download your picture. Google user data and Sign in with Apple say exactly what we receive and what we do with it.

Your jobs

What you enter about each job and elevator, as listed above. Re-Roper has no fields for people's names or phone numbers. Notes and other text fields hold whatever you type, so please don't put people's names, phone numbers, or other personal details in them.

If you subscribe

On re-roper.com, Stripe, our payment processor, takes the payment on its own checkout page, which opens from re-roper.com. There you give Stripe your card details, your name, and your billing address. Stripe keeps them, except the security code, in our Stripe account, where we can see your name, billing address, email address, and your card's brand, last four digits, and expiry date, but never your full card number; we use them only to bill you, email you about your subscription, answer you, and handle refunds, disputes, and sales tax. When you open checkout, we send Stripe your account ID and your account's email address (if it is a relay address from Sign in with Apple's Hide My Email, we leave it off, and Stripe's checkout asks you for an address instead). Stripe then tells us your customer and subscription numbers, the plan and price, whether the subscription is active, when it renews, when a payment failed, and when it was cancelled or ended. Stripe also uses payment information for its own purposes, such as preventing fraud, under its own privacy policy.

In the iPhone app, you buy through Apple's In-App Purchase. Apple sells the subscription and takes the payment under its own terms and privacy policy, and keeps your payment details; we never see them, and the purchase gives us neither your name nor your Apple Account's email address. RevenueCat, which runs our in-app purchases, receives the purchase from Apple and from the app, and tells our server, for your account: the product, Apple's transaction number, whether it is a test purchase, when you bought it, when it renews or expires, whether it will renew, any billing problem, grace period, or refund, and Apple's link for managing it. We keep that with your account, and a log of each update RevenueCat sends us, which also carries the price, the currency, and the App Store country.

You can buy in the app without an account. The purchase is then tied to a random ID that RevenueCat makes for that iPhone, and we keep the record of the terms you agreed to, and RevenueCat's updates, under that ID, with no email address. When you sign in to a Re-Roper account in the app, RevenueCat links that ID to your account ID, and we add your account to that record. When you sign out, the app goes back to a new random ID; the purchase stays with your Apple Account, and Restore Purchases brings it back.

Wherever you subscribe, we also keep a record of the subscription terms you agreed to: their exact words and version, when you agreed and whether in the app or on the website, the app's version if you used the app, your account ID (or the random ID, until you sign in), your email address if you were signed in, the checkout or, for an App Store purchase, Apple's transaction number and the App Store country, and when you paid, when we emailed you a copy, and when the subscription ended. California law requires us to keep it, so it stays after your account is deleted, as How long we keep it explains.

Messages you send us

If you email support@re-roper.com, we get your email address, the name your email shows, and whatever you write or attach. We use it to answer you and handle your request, and for nothing else, with one exception: if you send us an idea or suggestion for Re-Roper, we may use the idea, as our Terms of Use say, but not your personal details.

Technical information

  • The app contacts Supabase each time you open it or return to it, even while you are signed out, to check which sign-in options are on. When you use it without an account, it also checks whether subscriptions are on, and while you are signed in, whether your account has one. The website's sign-in page checks the sign-in options the same way, and its jobs and Subscribe pages check whether subscriptions are on, even before you sign in. Signing in, renewing your sign-in in the background, and every sync contact Supabase too. Each of these requests goes into Supabase's server logs, with the details listed above under Server logs; signing in and renewing your sign-in also update your sign-in session.
  • In the app on an iPhone, RevenueCat's code contacts RevenueCat when the app starts and while it runs, once you are signed in or using it without an account, to load the price and check whether your iPhone or your account has Re-Roper Pro, and when you buy or restore. Each request carries RevenueCat's ID for you, your IP address, and basic details of your phone, its system, and the app. The app gives RevenueCat no advertising identifier.
  • When you visit the website, Cloudflare (our host) and Google Fonts (which supplies our typefaces) receive your IP address and browser details. See how the website and our emails use analytics, cookies, and other services.

What we don't collect

Your precise (GPS) location, contacts, photos or camera images (the photos you add to a job stay on your device; see What is saved on your device), microphone, advertising identifiers, or your card or bank details (Stripe collects your card details when you subscribe on re-roper.com, and we never see your full card number; Apple keeps your payment details for a purchase in the iPhone app). Our providers work out a rough location from your IP address, such as your country, city, or postal code. The app contains no analytics, crash-reporting, or advertising code. On an iPhone it contains RevenueCat's in-app purchase code, which collects no advertising identifier and isn't used for ads or tracking.

How we use it

We use your information only to:

  • create your account, sign you in, keep you signed in, and keep your account secure;
  • add a Google or Apple sign-in to your existing account when its verified email address matches;
  • store your jobs and, with Re-Roper Pro, keep them in sync between your devices and this website;
  • if you subscribe: sell you the subscription, check whether your account or, in the iPhone app, your iPhone has one, link a purchase made before you signed in to your account, keep the record of the terms you agreed to, and send the subscription emails the law requires (a copy of the terms you agreed to, a notice after each monthly charge, a yearly reminder, and notice before a price change), plus a confirmation when you cancel or your subscription ends;
  • send the emails an account needs: confirmation links and codes, password resets, and a notice when your password or email address changes;
  • tell you about material changes to this policy or our Terms of Use;
  • answer you when you write to us;
  • keep Re-Roper working, find and fix problems, investigate misuse, enforce our Terms of Use, and meet our legal obligations;
  • count visits to the website and see how fast its pages load.

We don't send marketing email, use your information for advertising, or build profiles of you. We don't use your information, including Google user data, to develop, improve, or train AI or machine-learning models, and we don't sell it or give it to anyone to do so.

Google user data

Re-Roper's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data here means the information Google shares with Re-Roper when you choose Sign in with Google. If you don't sign in with Google, Re-Roper receives none. This part says how Re-Roper accesses, uses, stores, protects, shares, keeps, and deletes it.

What Re-Roper accesses

Re-Roper's Google sign-in uses only Google's three basic sign-in permissions, and no others:

  • email, which Google describes as “See your primary Google Account email address”;
  • profile, which Google describes as “See your personal info, including any personal info you've made publicly available”;
  • openid, which Google describes as “Associate you with your personal info on Google”. Our sign-in request names email and profile, and Google adds openid to every such sign-in; it lets Re-Roper recognize your Google account each time you sign in.

With them, Google shares with Re-Roper:

  • your Google account ID;
  • your email address, and whether Google has verified it;
  • your name;
  • a link to your profile picture;
  • for a Google Workspace (work or school) account, your organization's domain name.

Google's reply can also carry other basic profile details, such as your language preference and your first and last names separately; our sign-in provider doesn't keep them. Re-Roper gets no access to your Gmail, Google Drive, Contacts, Calendar, or any other data in your Google Account.

How Re-Roper uses it

  • To create your Re-Roper account, sign you in, keep your account secure, and recognize you each time you sign in with Google, so your synced jobs stay with your account.
  • To add Google sign-in to an existing Re-Roper account with the same verified email address.
  • To email you at that address about your account, such as a password reset you ask for or a notice that your password or email address changed, and about material changes to this policy or our Terms of Use.
  • If you subscribe: to send your subscription emails to it, and to keep it in the record of the subscription terms you agreed to, as California law requires; and, if you subscribe on re-roper.com, to bill your subscription, by giving that email address to Stripe, our payment processor, as the address on your billing record. The page where you subscribe asks for your agreement to this before Stripe receives your address.
  • To show you which account you are signed in with: your email address in the app's Settings and on the website's menu, home page, Jobs page, and Profile page, and its first letter as your avatar.
  • To keep sign-in working and safe: to find and fix problems, investigate misuse, and meet our legal obligations.

We store your name, picture link, and any work or school domain as Google sends them, but Re-Roper never shows or uses them and never downloads your picture. They come with the profile permission, which Supabase, our sign-in provider, always asks for together with email when you sign in with Google.

Re-Roper uses Google user data only for these purposes. We never sell it, use it for any kind of advertising, give it to data brokers or information resellers, or use it for credit or lending decisions. We don't use Google user data to develop, improve, or train AI or machine-learning models, and we don't give it to anyone to do so.

How Re-Roper stores and protects it

  • Supabase, our sign-in and database provider, stores it with your account, in its Canada (Central) region, in Montréal. Supabase's sign-in logs, which include your email address and name, and some of its processing can be in the United States or other countries.
  • Copies of the account emails we send to your Google email address sit in our Microsoft 365 mailbox, which may be stored in the United States.
  • If you subscribe, our record of the subscription terms you agreed to keeps your Google email address in the same database. If you subscribe on re-roper.com, Stripe keeps it on your billing record in our Stripe account, and also keeps its own copy under its own privacy policy.
  • Resend, which delivers our subscription emails and our notices about changes to this policy or our Terms of Use, stores copies of them in the United States.
  • Your phone or browser also keeps a copy in its saved sign-in session, until you sign out while online or clear the app's or the browser's data.
  • During sign-in, Google also gives Supabase a short-lived access token for the same permissions. Re-Roper never uses it. Supabase deletes its copy as soon as sign-in finishes, or after about a day if a sign-in is never finished. A copy can stay in the saved session on your device until that session next renews. Google's access tokens stop working after about an hour.
  • It travels only over encrypted connections (HTTPS/TLS). Supabase encrypts its database and backups on disk (AES-256), and Microsoft encrypts our mailbox on disk.
  • The database lets each account read only its own records, and the server enforces that.
  • No one at Re-Roper reads your Google user data unless you ask us to, it is needed to investigate a bug, a security problem, or misuse, it is needed to answer a dispute you raise with your bank about a charge, or the law requires it.

Who Re-Roper shares it with

Only with the service providers that run Re-Roper for us:

  • Supabase, which stores it as described above, and the subprocessors Supabase uses to run its service, which Supabase lists at supabase.com/legal/subprocessors (among them Amazon Web Services, Cloudflare, and Google Cloud).
  • Microsoft 365, which we buy through GoDaddy; GoDaddy also runs the sign-in to our mailbox. Microsoft delivers the emails we send to your Google email address and keeps copies of them in our mailbox.
  • Resend, which delivers our subscription emails to your Google email address if you subscribe, our notices about changes to this policy or our Terms of Use, and the email our server sends to our own mailbox when you delete your account in the app or on the website. That deletion email names your Google email address, so we can delete your emails from our mailbox. Resend stores them in the United States.
  • Stripe, our payment processor, if you subscribe on re-roper.com: it receives your Google email address as the address on your billing record, and uses it under its own privacy policy, including to prevent fraud.

Otherwise we disclose Google user data only to answer a dispute you raise with your bank about a charge, or when the law requires it. If Re-Roper changes hands, we will transfer your Google user data to the new owner only with your consent; if you don't consent, we delete it before the transfer. We never sell it, share it for advertising, or give it to data brokers or information resellers.

How long Re-Roper keeps it and how to delete it

  • We keep your Google user data for as long as your Re-Roper account exists. Supabase's sign-in logs, which include your email address and name, keep it for 7 days, and its daily backups for 7 days.
  • To delete it, delete your Re-Roper account, as Deleting your jobs and your account explains. In the app or on the website, the account and the Google user data stored with it are deleted right away, apart from the subscription records below; if you ask us by email, we delete them within 30 days of your confirming the request. Supabase's backups and logs that still hold it expire within 7 days after that.
  • Copies of the emails we have exchanged with you, which carry your email address, stay in our mailbox while your account exists. Within 30 days of your account's deletion, we delete those emails too, including any email about the deletion. Any copies Microsoft keeps for recovering deleted mail expire within 30 days after that. When you delete your account in the app or on the website, the email our server sends us about it goes through Resend. Resend's copies of that email, and of the subscription emails and notices it delivers to you, stop being visible to us within 30 days.
  • If you subscribed, the record of the subscription terms you agreed to, which includes your Google email address, is kept for at least 3 years from when you agreed, or 1 year after your subscription ends if that is later, even after your account is deleted, as California law requires. If you opened our checkout but never paid, that record is kept for at least 1 year. If you subscribed on re-roper.com, your billing record, with that email address, stays in our Stripe account for as long as tax law requires us to keep payment records, and Stripe keeps its own copy under its own privacy policy.

How to remove Re-Roper's access

You can remove Re-Roper at any time from your Google Account's third-party connections. Re-Roper then no longer has your permission to get your Google details, and signing in with Google again asks for it again. Removing access doesn't sign you out of Re-Roper or delete your account or jobs; to delete what we hold, see Deleting your jobs and your account. Deleting your Re-Roper account doesn't remove Re-Roper from your Google Account either, so remove it there as well.

Sign in with Apple

  • What Apple shares. We ask Apple for no more than your name and email address. Apple shares your Apple user ID and the email address you choose: your own, or a private relay address if you use Hide My Email. It also tells us whether the address is a relay address and when you signed in. The first time you sign in, it shares your name if you choose to share it.
  • How we use it. To create your account, sign you in, add Apple sign-in to an existing account with the same email address, and email you about your account and about material changes to this policy or our Terms of Use. If you shared your name, we store it but don't show or use it.
  • Relay addresses. With Hide My Email, Apple forwards our emails to your inbox, and we never see your own address unless you write to us from it or give it when you subscribe. If you turn off forwarding for Re-Roper, you won't get our account or security emails. If you subscribe on re-roper.com with a relay address, we don't give it to Stripe, because Apple's relay may drop Stripe's own emails; Stripe's checkout asks you for an address for your receipts and our subscription emails instead.
  • Buying in the app. Sign in with Apple and buying Re-Roper Pro in the App Store are separate. A purchase gives us neither your name nor your Apple Account's email address; our subscription emails about it go to your Re-Roper account's address, which is the relay address if you use one.
  • Tokens. When you sign in through Apple's sign-in page, Apple also gives Supabase an access token and a refresh token. We never use them. Supabase deletes its copy as soon as sign-in finishes, or after about a day if a sign-in is never finished. A copy can stay in the sign-in session saved on your device until that session next renews.
  • Storage, sharing, and keeping. The same as for Google user data: Supabase stores it, Microsoft 365 and Resend deliver our emails to your address, and we keep it until your account is deleted, apart from the log, backup, mailbox, and Resend copies, and the record of the subscription terms you agreed to, that part describes. Stripe never receives a relay address from us.
  • Removing access. If you sign in with Apple and delete your account in the Re-Roper app on an iPhone, Apple asks you to confirm, and our server then asks Apple to remove Re-Roper's Sign in with Apple access. Apple's confirmation gives the app a one-time code, which our server uses only for that request and doesn't keep. If the removal doesn't go through, for example because you closed Apple's confirmation and deleted without it, the app tells you to remove Re-Roper yourself. Anywhere else (on the website, in the app on Android, or by email), remove Re-Roper yourself in your Apple Account settings, under Sign in with Apple. You can also stop using Sign in with Apple with Re-Roper there at any time. Re-Roper then no longer has your permission, and signing in with Apple again asks for it again. That alone doesn't sign you out of Re-Roper or delete your account or jobs.

How syncing works

  • Syncing is part of Re-Roper Pro, whether you pay for it or we have given your account free access. Without it, no job is sent to or from our servers: your jobs stay on the phone or in the browser where you made them, and the jobs already synced to your account stay there until you delete your account, and sync again if you subscribe. Re-Roper Pro bought in the iPhone app without an account opens every page in the app on that iPhone, but nothing syncs until you sign in there. If we ever turn subscriptions off for a time, every account syncs as described below.
  • While you are signed out, your jobs stay on your device and are not sent to our servers.
  • While you are signed in with Re-Roper Pro, each change is saved to your account a moment after you make it. Changes from your other devices come in when you sign in, when you come back to the app or the website, and after each save.
  • Job photos never sync: they stay on the device that added them, and only your notes and what each photo shows go with the job (see What is saved on your device).
  • The first account with Re-Roper Pro to sign in on a phone or browser takes over every job already saved there that no account owns, including jobs made while signed out, and saves them to that account. An account without it leaves them as they are.
  • If a different account later signs in there, the jobs on that device are removed from it (they stay in the first account), and, with Re-Roper Pro, the new account's own jobs come in.
  • But if some of those jobs carry changes that never reached the first account, nothing is removed, and nothing syncs on that device until the first account signs back in there with Re-Roper Pro and its changes go up. Meanwhile, the account signed in can see and change those jobs, and anything changed or added on that device will be saved to the first account when it does. If the only unsynced changes are on jobs that never reached the first account and you delete them, the account signed in takes over that device instead.
  • Signing out keeps your jobs on that device. In the app, the sign-in screen covers them until someone signs in. Choosing to use the app without an account removes them from the phone first, after asking, once your account has every change to them. Until then the app asks you to sign back in first, or, if your account has no subscription and so cannot sync them, offers to keep them on the phone as jobs no account owns, or to remove them. On the website they stay in that browser, and anyone who can open the Jobs page there can open, change, or delete them. Changes made there while you are signed out are saved to your account the next time you sign in on that browser with Re-Roper Pro. On a shared computer, sign out and then clear the browser's saved data for re-roper.com.

What is saved on your device

  • What is saved. Your jobs, including every job synced from your account while you are signed in there. Your settings, such as units. A sync record with your account ID and which changes have already synced. And your sign-in session: sign-in tokens (the keys that keep you signed in), your email address, how you sign in, and any name or picture link from Google or Apple. While a sign-in is in progress, there is also a one-time check value that makes sure it finishes on the same device. Your subscription's status as that phone or browser last checked it (whether your account has access and why, its status and its renewal or end dates, and your account ID), whether subscriptions are on, and whether it has ever been told they are. In the app, whether you chose to use it without an account, and, on an iPhone, RevenueCat's ID for you and your purchase status, which RevenueCat's code keeps so Re-Roper Pro opens without a signal. When you go to Stripe from a job page on the website, the open tab also remembers that page so it can bring you back to it. The website also remembers, for the open tab only, where you scrolled on each page, and the app keeps the 30-minute security cookie our sign-in server sets (see cookies).
  • Job photos. Photos you take or choose on a job's Photos & Notes page are saved only on the phone or in the browser where you added them, cut down to 1600 pixels on their long side. Re-Roper asks for the camera or your photo library only when you tap to add a photo, and reads only the photos you pick. The pictures are never sent to our servers: with Re-Roper Pro, the job syncs your notes, which part of the elevator each photo shows, and each photo's size and the time it was added, but not the picture itself, so another device shows that a photo exists without it. Removing an entry or a photo, or deleting the job, deletes the picture from that device.
  • Job packets. A job packet is made on your device: a PDF the app hands to your phone's share sheet, or a page the website opens for you to print or save. It holds the job's facts, your notes and checklist, and, with Include Photos on, the photos on that device. Re-Roper doesn't send it anywhere; whoever you send it to has a copy.
  • Where. In the app's own storage on your phone, and in your browser's storage for re-roper.com.
  • No added encryption. Re-Roper doesn't add its own encryption to this storage, and never saves your password there. Protect your phone and computer with a screen lock or password.
  • Signing out keeps your jobs and settings on that device.
  • Removing it. Clearing this site's data in your browser removes all of it from that browser. Deleting the app removes it from your phone; while you test Re-Roper inside Expo Go, delete Expo Go or clear its data instead. Phone backups, such as iCloud, computer backups, or Android's backup to Google Drive, can keep copies.

Who we share it with

We don't sell your personal information or share it for cross-context behavioral advertising, as California law uses those words. We share it only in the ways below.

Service providers

Supabase, Cloudflare, Microsoft, Resend, Stripe, and RevenueCat are service providers: they handle your information to run their part of Re-Roper for us. Stripe also uses payment information for its own purposes, such as security, preventing fraud, and meeting its legal obligations, under its own privacy policy. Google Fonts is a public service that Google runs under its own privacy policy.

Supabase
Runs our sign-in and the database that holds your account and synced jobs, and sends our account emails through Microsoft 365. The database is in Supabase's Canada (Central) region, in Montréal. Supabase runs its service with the subprocessors it lists at supabase.com/legal/subprocessors, among them Amazon Web Services, Cloudflare, and Google Cloud, so its logs and some processing can be in the United States or other countries.
Cloudflare
Hosts re-roper.com, protects it from attacks, runs its cookieless visitor counts, shows us records of requests to it from the last 31 days, and serves the pictures in our emails.
Microsoft 365
Our email service, which we buy through GoDaddy; GoDaddy also runs the sign-in to our mailbox. Microsoft delivers our account emails from support@re-roper.com, keeps copies of them in our mailbox, and receives the emails you send us.
Resend
Delivers our subscription emails to you if you subscribe (such as the copy of the terms you agreed to, the notice after each charge, and the emails when you cancel or your subscription ends), our notices to every account about changes to our Terms of Use or this policy, and the email our server sends to our own mailbox when you delete your account in the app or on the website, so we know to delete your emails there. These emails carry your email address; the subscription emails also carry the plan, dates, and amounts, and the deletion email your account ID. Resend stores the data it handles for us in the United States, and its copies of these emails stop being visible to us within 30 days.
Stripe
Our payment processor. It takes the payment when you subscribe, keeps your card on file for renewals, tells us your subscription's status, and can email you receipts. It receives your account ID and, unless it is a relay address from Sign in with Apple, your email address from us, and your card details, name, and billing address from you on its checkout page. Stripe also uses payment information for its own purposes, such as security, preventing fraud, and meeting its legal obligations, under its own privacy policy.
RevenueCat
Runs our in-app purchases in the iPhone app. It receives your App Store purchases from Apple and from the app, checks them, tells the app and our server whether you have Re-Roper Pro, and shows us totals, such as how many people subscribe. It receives an ID for you (your account ID once you sign in in the app, or a random ID before), your App Store purchase history and receipts, the product, price, and dates, the version of the terms you agreed to and the app's version, which the app attaches to a purchase, and, with each request from the app, your IP address and basic details of your phone and the app. It never receives your name, email address, jobs, or payment details from us, and the app gives it no advertising identifier. RevenueCat's privacy policy explains how it handles this.
Google Fonts
Supplies the website's typefaces, and the ones our emails ask for. Your browser or email app gets them straight from Google, which receives your IP address and browser or email-app details under Google's own privacy policy.

Your account and synced jobs are stored in Canada. These companies may process your information in Canada, the United States, and other countries where they operate.

Sign-in services you choose

Google and Apple run their own sign-in services. If you choose one, its own privacy policy covers what it does, and Google user data and Sign in with Apple say what we receive. We don't send them your jobs.

Apple, for purchases in the iPhone app

If you subscribe in the iPhone app, Apple sells the subscription and takes the payment, under its own terms and privacy policy. Apple tells us, through RevenueCat, whether your subscription is active, its product, when it renews or expires, whether it will renew, any billing problem or refund, and the App Store country. We don't send Apple your jobs or your account details.

Other cases

  • If the law requires it. We may disclose information when the law or a valid legal process, such as a court order, requires it.
  • Payment disputes. If you dispute a charge with your bank, we and Stripe share the details of your subscription and its charges with your bank and the card network to answer it. Apple handles disputes and refunds for purchases in the iPhone app.
  • If Re-Roper changes hands. If Re-Roper is ever transferred to a company or another person (for example, if we form a company to run it), your account and jobs would move with it. The new owner would have to keep this policy's promises. We will tell you before that happens. Your Google user data moves only with your consent; if you don't consent, we delete it before the transfer.
  • While the app is being tested. When we test through Expo's tunnel, ngrok relays the connection between your phone and our development computer, as Who runs Re-Roper explains.

The website and our emails: analytics, cookies, and other services

  • Cookies. re-roper.com sets no cookies of its own. Cloudflare, our host, may set a strictly necessary security cookie if it has to check that a visitor is not a bot. Our sign-in server, auth.re-roper.com, which Supabase runs on Cloudflare's network, sets one such cookie, named __cf_bm, on its replies. The app keeps it, and your browser keeps it when it visits that server directly: during Google or Apple sign-in, or when you open a link in one of our emails. It expires after 30 minutes. We use no advertising or tracking cookies. Stripe's checkout and billing pages, which open on Stripe's own site when you subscribe or manage a subscription, use cookies and similar technologies to prevent fraud, under Stripe's own policies.
  • Visitor counts. We count visits with Cloudflare Web Analytics. It uses no cookies and saves nothing in your browser. For each page you view, it records the page address without anything after a “?”. On a job page, that address includes an elevator record's number, not the job's name. It also records the page that sent you, how fast the page loaded, your browser, operating system, and device type, and the country your IP address points to. Cloudflare says it doesn't fingerprint visitors, that is, identify a browser from its settings.
  • Hosting. Cloudflare receives your IP address and browser details with each request, and shows us records of requests to the website, which can include your IP address, browser details, the page address, and the rough location it works out from your IP address: our website's own request logs for up to 7 days, and a sample of individual requests in its security analytics for up to 31 days. If a page fails to load, your browser may send Cloudflare a short error report; Cloudflare says it keeps no personal information from these reports.
  • Fonts. The website loads its typefaces from Google Fonts, so your browser sends Google your IP address and browser details, and tells it only that the request came from re-roper.com, not which page you were on. Google says Google Fonts sets no cookies and that it doesn't use this information to build profiles or target ads. The app has its fonts built in.
  • Our emails. The pictures in our account emails are stored on re-roper.com. They are the same for everyone and carry nothing that identifies you or a particular email, and we don't use them to tell whether you opened an email. Our emails also ask your email app to load our typefaces from Google Fonts; if it does, Google receives your IP address and your email app's details.
  • Signing in. The website's sign-in page asks Supabase which sign-in options are on, even before you sign in, so Supabase receives your IP address and browser details. Its jobs and Subscribe pages ask Supabase whether subscriptions are on, also before you sign in. While you are signed in, the website also renews your sign-in with Supabase in the background and checks whether your account has a subscription.
  • No trackers. We use no advertising or tracking companies. Besides re-roper.com, the website contacts only Supabase (accounts, sync, and subscriptions), Cloudflare (visitor counts and error reports), and Google Fonts, plus Google or Apple if you choose to sign in with them, and Stripe's pages if you choose to subscribe or manage a subscription.

How long we keep it

  • Your account (your email address, password hash, sign-in details, and anything Google or Apple shared): until you delete it, or until we close it under our Terms of Use. In the app or on the website it is deleted right away; if you ask us by email, within 30 days of your confirming the request. Copies in Supabase's backups and logs last up to 7 days after that, as Deleting your jobs and your account describes.
  • Your synced jobs: until you delete them, or until your account is deleted. Without a subscription, a job you delete on a phone or in a browser stays in your account until you subscribe again and that device syncs, or until your account is deleted; email us and we will delete it sooner.
  • Deleted jobs: for each elevator you delete, a small marker stays until your account is deleted: its record number, which account it belonged to, when it was first saved, and when it was deleted. None of the job's contents stay. The markers count toward the record limit in our Terms of Use.
  • Your subscription (its status, plan, and dates, from Stripe or, for a subscription bought in the iPhone app, from Apple through RevenueCat, and any free access we gave your account or its email address): until your account is deleted.
  • RevenueCat's records (its ID for you and your App Store purchase history): under your account ID, until your account is deleted, when we ask RevenueCat to delete them. Under a random ID never linked to an account, while we use RevenueCat, unless you ask us to delete them.
  • The record of the subscription terms you agreed to (your email address if we have it, your account ID or, for a purchase in the iPhone app before you signed in, its random ID, the terms, and the dates): at least 3 years from when you agreed, or 1 year after your subscription ends if that is later, even after your account is deleted, as California law requires (Business and Professions Code section 17602(a)(6)). A record for a checkout you opened but never paid for: at least 1 year.
  • Payment records (your billing record in our Stripe account, with your name, billing address, email address, account ID, and payment history, the log of the updates RevenueCat sends us about purchases in the iPhone app, and any other payment and tax records): for as long as tax law requires us to keep them, also after your account is deleted. Stripe keeps its own records under its own privacy policy and the law.
  • Sign-in sessions (the latest IP address and device or browser type of each phone or browser you are signed in on): until you sign out on that device while online, or until your account is deleted. Changing your password ends your sessions on your other devices.
  • Supabase's logs (sign-in logs with your email address, IP address, device or browser type, and any name from Google or Apple; request logs with IP addresses, rough locations, and internet providers): 7 days. Any record of your sign-in events kept in our database is deleted with your account.
  • Supabase's backups: a daily backup, kept for 7 days. Deleted information can remain in a backup for up to 7 days.
  • Cloudflare's records of requests to the website: our website's request logs for up to 7 days, and a sample in its security analytics, which we can see for up to 31 days.
  • Cloudflare Web Analytics: each visit in full for 7 days, then a sample of about 1 in 10, which we can see for 6 months. It isn't linked to your account.
  • Emails: copies of the account emails we send you, and of the emails you send us and our replies, stay in our mailbox while your account exists. We delete them within 30 days of your account's deletion, and any copies Microsoft keeps for recovering deleted mail expire within 30 days after that. If you write to us without an account, we keep the conversation only as long as we need it to answer you. The links and 6-digit codes in our emails stop working after 10 minutes. The record of which notices we have emailed you is deleted with your account.
  • Resend: its copies of our subscription emails and notices, and of the email our server sends us when you delete your account in the app or on the website, which names your email address, stop being visible to us within 30 days.
  • On your devices: until you delete the jobs, clear the browser's saved data for re-roper.com, or delete the app, or until a different account takes over that device (see How syncing works).

Deleting your jobs and your account

Deleting your account

You can delete your Re-Roper account, and every job synced to it, at any time. Re-Roper, the app and the website re-roper.com, is run by Kristian Caroe Klausen. Deleting the account yourself, in the app or on the website, takes effect right away. You can also ask us to delete it by email.

  • In the app. Signed in to the account, tap the gear at the top right to open Settings. Under Account, tap Delete Account, type DELETE, and tap Delete My Account. On an iPhone, if you sign in with Apple, Apple asks you to confirm first (see Sign in with Apple).
  • On the website. Sign in at re-roper.com and open Profile from the menu at the top right. Under Delete account, choose Delete account, type DELETE, and choose Delete my account.
  • By email. Write to support@re-roper.com and ask us to delete it. Send it from the address on your account if you can (if you use Apple's Hide My Email, that address is shown in the app's Settings and on the website's Profile page). Either way, before we delete anything, we email the address on your account to confirm the request.

In the app or on the website, your account is deleted as soon as you confirm. By email, we delete it within 30 days of your confirming. Either way, we delete your account and everything stored with it. That means your email address (apart from the subscription records below), your password, the details from Google or Apple, and your sign-in sessions. It also means any record of your sign-in events kept in our database, all your synced jobs, the markers for deleted jobs, your subscription's status, any free access we gave your account or its email address, and the record of which notices we emailed you. If you asked by email, we email you when it is done. Deleting your account also cancels a subscription bought on re-roper.com (in the app or on the website at once, by email when we receive your request), and we email you that it has ended. The rest of that month is not refunded, so to use it, cancel first and delete your account after the month ends. It doesn't cancel a subscription bought in the iPhone app: only you can, in the App Store, so cancel it there first, or Apple keeps charging you. Apart from the subscription records below, if the law requires us to keep something, we keep only that, and only for as long as the law requires. If we close your account under our Terms of Use, we delete it and everything stored with it within 30 days of closing it, and the rest of this part applies the same way.

After that:

  • Supabase's backups can still hold a copy for up to 7 days, and its logs, including sign-in logs with your email address, for up to 7 days.
  • Cloudflare's records of your visits to the website stop being visible to us within 31 days; Cloudflare keeps its own records under its own privacy policy. Its visitor counts, which aren't linked to your account, are kept in sampled form for up to 6 months.
  • Within 30 days of your account's deletion, we delete from our mailbox the emails you sent us, our replies, and the copies of the account emails we sent you, including any email about the deletion. When you delete your account in the app or on the website, our server emails us, so we know to do this; if you asked by email, we do it once we have emailed you that the deletion is done. Any copies Microsoft keeps for recovering deleted mail expire within 30 days after that.
  • Resend delivers that email from our server to our mailbox, as it delivered any subscription emails and notices we sent you. Its copies stop being visible to us within 30 days, and Resend keeps its own records under its own privacy policy.
  • We ask RevenueCat to delete its record of your account and its App Store purchases: our server does it when you delete your account in the app or on the website, and we do it when you ask by email. RevenueCat keeps any copies under its own privacy policy.
  • If you ever opened our checkout or bought in the iPhone app, we keep the record of the subscription terms you agreed to: your email address if we had it, your account ID, the terms, and the dates. We keep it for at least 3 years from when you agreed, or 1 year after your subscription ends if that is later, as California law requires; a record for a checkout you never paid for, at least 1 year.
  • If you subscribed on re-roper.com, your billing record stays in our Stripe account (your name, billing address, email address, account ID, and payment history) for as long as tax law requires us to keep payment records, and Stripe keeps its own records under its own privacy policy. If you bought in the iPhone app, the log of RevenueCat's updates about it stays for as long, as a payment record.
  • Deleting your account in the app or on the website also removes the account's jobs from the phone or browser you delete it on. Anywhere else, jobs saved on your phones and in your browsers stop syncing and stay there until you delete them, delete the app, or clear the browser's saved data for re-roper.com.
  • If you signed in with Google, also remove Re-Roper from your Google Account's third-party connections; deleting your account doesn't do that. If you signed in with Apple, the app on an iPhone asks Apple to remove Re-Roper's access for you (see Sign in with Apple). Anywhere else, or if the app tells you to remove it yourself, remove Re-Roper in your Apple Account settings, under Sign in with Apple.

Deleting a job

  • You can delete a job at any time in the app or on the website, and, with Re-Roper Pro, one elevator in it (on Job Details). Re-Roper asks you to confirm first, then removes it from that device right away.
  • If it had synced, that device erases its contents from our servers the next time it syncs while signed in to the same account. A small marker for each elevator stays on our servers, so your other devices remove it too. Until then, it still shows on your other devices. Without a subscription nothing syncs, so a copy already synced to your account stays on our servers until you subscribe again (the deletion then syncs from that device) or delete your account; email us and we will delete it sooner.
  • If another of your devices changed the job after you deleted it, that newer version wins and the job comes back.
  • A job that never synced never reached our servers.

Security

  • Every connection between Re-Roper and Supabase or re-roper.com is encrypted (HTTPS/TLS), and Supabase encrypts our database and its backups on disk (AES-256). While you test the app in Expo Go, the app's own code is loaded from our development computer over a connection that may not be encrypted, but your account details, your jobs, and any Google user data still travel between the app and Supabase over HTTPS.
  • Passwords are stored only as salted hashes.
  • The database lets each account read and change only its own records, enforced on the server, so other Re-Roper accounts can't reach your jobs on our servers (on a shared phone or browser, see How syncing works).
  • The link in a confirmation or password-reset email works once. It signs you in only in the browser or app that asked for the email, but opening it anywhere still confirms your address or email change. The 6-digit code in the same email works on any device for 10 minutes, so never share it.
  • Changing your password ends your sessions on your other phones and browsers; they are signed out within about an hour, when their current sign-in key expires.
  • As the operator, we can reach the database through Supabase's dashboard, whose account list shows every account's email address and any name from Google or Apple. We look at account or job data only when you ask us to, to investigate a bug, a security problem, or misuse, to answer a dispute you raise with your bank about a charge, or when the law requires it.
  • Re-Roper doesn't add its own encryption to what it saves on your phone or in your browser, so use a screen lock.

No system is perfectly secure. If you think someone else has used your account, email support@re-roper.com right away. If we learn of a breach that affects your information, we will tell you as the law requires.

Children

Re-Roper is a work tool for elevator professionals and is not meant for children. Our Terms of Use require you to be at least 18, and we don't knowingly collect information from anyone younger, including children under 13. If you believe someone under 18 has given us information, write to support@re-roper.com and we will delete it.

Your choices and rights

Wherever you live, you can:

  • see and change your jobs in the app or on this website. With Re-Roper Pro, sign in here to see every job synced to your account; without it, you can open the jobs saved on that phone or in that browser in their hub and Guided Setup, and you can ask us for a copy of everything in your account;
  • delete any job yourself, and delete your account in the app's Settings, on this website's Profile page, or by asking us (see Deleting your jobs and your account);
  • set or change your password on the website's Profile page, or reset it from the sign-in screen;
  • stop syncing by signing out (the jobs already on that phone or in that browser stay there; the app can also be used without an account, with its jobs kept only on that phone);
  • remove Re-Roper's access in your Google Account or Apple Account settings;
  • ask us for a copy of the information we hold about you;
  • ask us to correct it, for example to change your email address.

You can withdraw your consent at any time: sign out to stop sending us your jobs, remove Re-Roper's access in your Google or Apple settings, or delete your account.

To make a request, email support@re-roper.com. We may ask you to confirm it from your account's email address. We answer within 45 days; if we need more time, we tell you why within those 45 days and answer within another 45. We won't treat you differently for using any of these choices.

California residents have the right to know what personal information we collect, use, and disclose; to get a copy of it; to correct it; to delete it; and not to be treated differently for asking. We don't sell or share personal information, so there is nothing to opt out of, and we don't disclose it to anyone for their own direct marketing. We use your password and other sign-in details only to sign you in and keep your account secure, and not to infer anything about you. You can make a request yourself or through an authorized agent. What we collect lists the kinds of personal information we collect, where it comes from, and why, and Who we share it with lists who receives it.

Do Not Track and Global Privacy Control. Re-Roper doesn't track you across other websites or apps, doesn't follow your activity over time for advertising or profiling, and doesn't sell your information, so it works the same whether or not your browser sends these signals. We don't let advertising or tracking companies collect information about your activity through Re-Roper. Cloudflare and Google Fonts also serve many other websites, and they receive your IP address and browser details when our website loads. Cloudflare says its visitor counts don't fingerprint visitors. Google says it doesn't use Google Fonts requests to build profiles or target ads.

Changes to this policy

When we change this policy, we post the new version here with a new effective date. Before a material change takes effect, such as a new use of your information, we tell you in the app, on the website, or by email. Before we use Google user data in any new way or for a new purpose, we will update this policy and ask for your consent, in the app, on the website, or by email.

Contact us

Kristian Caroe Klausen, the individual who runs Re-Roper, California, USA. Email support@re-roper.com.