Privacy Policy

Last updated October 25, 2026

This policy explains how CloseoutGate handles your project data, the information you send us when you ask for access or write to us, and the records we keep when your company signs an agreement with us or is invoiced. CloseoutGate is operated by Practical Byte Apps LLC (“we”). It is a work tool for businesses and is not meant for anyone under 18. Your company’s workspace and everything in it belong to your company; your company decides who is invited and what is collected on each job.

What we collect

• Account: your email address, your name (if you give one), and the company workspace and role you belong to.
• Project data you enter: projects, locations, templates, notes, readings and crew assignments.
• Files you upload: photos, documents, customer prints and OTDR trace files.
• When and where: each piece of proof keeps the time it was captured, the time it reached us, the phone’s position and the GPS accuracy the phone reported.
• Position: when you use “Set position”, and each time a proof form is open (for up to about a minute), the app reads your phone’s location and saves it with that location or proof; if a location has no map pin yet, it may be used to set one. Photos also keep their own embedded GPS position (see below). Without location, proof is saved without a position; photo proof needs the camera.
• On your phone: the app keeps proof you captured but has not uploaded yet (photos, readings, notes, with the time and GPS position) and the last job list it loaded, so it works with no signal. Unsent proof is removed when it uploads, when you discard it, or when you delete your account. The job list and the saved app page are removed when you sign out, when you delete your account, or when we find you are no longer signed in. Unsent proof stays on the phone when you sign out and uploads only when the same account signs in again; it is never sent under another account, and signing in as someone else does not show it.
• Sign-in records: described below.
• Requests for access: if you ask for access on our site or in the app, we collect the name, company, work email, crew size and note you type. They are sent by email (through Cloudflare Email Service) to our company mailbox and are not saved in the CloseoutGate database, and no account is created. We use them only to reply to your request. We delete these emails within 12 months of our last reply, unless your company starts using CloseoutGate, in which case we keep them with your company’s records. You can ask us to delete yours sooner.
• Invoices and payments: if your company is invoiced for CloseoutGate, we keep the name, work email, company name and address we send invoices to, what each invoice was for, its amount and dates, and whether it was paid. We use them only to send invoices, follow up on unpaid ones, record payments, handle payment disputes and keep our tax and accounting records. When you pay through Stripe, card or bank details are entered on Stripe’s own pages, not given to us; we do not receive or store full card or bank account numbers (Stripe shows us only limited details, such as the card type and last four digits). We keep these records for as long as we need them for tax, accounting and legal purposes, and at least as long as the law requires; Stripe keeps its own copy under its own privacy policy.
• Owner choices about extra closeout packages: we keep records of the workspace owner’s choices about extra closeout packages: which option they chose (add the package, move up to the next level, or cancel it), which project it was for, who chose it and when. We use these records to invoice your company correctly, and keep them with the invoice records above.
• Signed agreements: when your company signs an agreement with us electronically, we use an e-signature service. It receives the agreement, the signer’s name, email address and signature, and the details it records at signing, such as the time and IP address. If an agreement is signed another way, such as a signed copy sent by email, we keep that copy the same way. We keep the signed copy with our business records while the agreement runs and afterward for as long as we need it for legal, tax and accounting records.
• Hosting logs: our hosting provider (Cloudflare) keeps request and error logs for up to 7 days. They may include your IP address and browser details.
• Usage measurement: our public web pages (the pages you can open without signing in, such as the home, sign-in, privacy and support pages) use Cloudflare Web Analytics to count page views and page load times. For each page view it records which page was viewed, the website you came from, your country (worked out from your network address), and your browser, operating system and device type. It sets no cookies, saves nothing in your browser’s storage, is not linked to your account, and is not used for advertising or to follow you to other websites. It is not used inside the signed-in CloseoutGate app or in the Android and iOS apps.

Photos

When a photo is uploaded we remove its hidden metadata and keep only the time it was taken, its GPS position and altitude if the phone recorded them, and its orientation. Camera make, model and serial number, lens, software, owner name, maker notes, thumbnails and comments are removed before the photo is stored. The record for the photo also keeps what it said about itself (time, position, camera name) and the phone’s position when it was added.

Signing in

• Sign-in codes are stored only as a hash. They last 10 minutes, work once, and the row is deleted 24 hours after it was made. They are sent by email through Cloudflare Email Service.
• In our database, network addresses are stored only as a hash, never as the address itself (a keyed hash since October 8; older records use an unkeyed hash until they expire). They are used only to limit repeated sign-in attempts, wrong crew codes and repeated access requests. Refused-attempt records keep the reason and the hash, not your email, and are deleted after 30 days. Access-request limit records keep only the hash and the time and are deleted after about an hour.
• A sign-in session keeps a hashed token, your browser name and the hashed network address. It lasts 90 days unless you sign out or are removed from the workspace. The session cookie is HttpOnly and is used only to keep you signed in.
• Short-lived HttpOnly cookies are also used, only during the Google sign-in and Google Drive connection steps.
• If you sign in without an invitation, you get an account with no workspace and no data. It becomes eligible for deletion after 7 days without a sign-in and is removed automatically soon after. Accounts of removed crew members, and of anyone who tried a crew code, are kept.
• If you sign in with Google, we ask Google only for your email address and basic profile (name).

Google Drive (optional)

A workspace owner can connect Google Drive. CloseoutGate asks Google only for access to files and folders it creates (the “drive.file” permission); it cannot see anything else in your Drive. While a project is open, each proof file is stored with us first and then copied to the job’s Drive folder. At close-out, once every Drive copy is confirmed, our per-file copies are deleted and your Drive holds the only copy of the individual files. We never delete files in your Drive. A locked copy of the final package stays with us until the project is deleted and purged.

Packages and exports

Closing out a job produces packages and exports: a report, a ZIP of files, a spreadsheet, a Word handoff and a photo index. They include who added each piece of proof (their email address), when it was captured, when it was received, and the position recorded with it, including the photo’s GPS. Your company decides who receives its packages, for example its customer. Once your company sends a package, what the recipient does with it is up to them.

Where it is stored, and who handles it

• Data is stored with Cloudflare (database, file storage, sign-in emails and logs). Backups are also on Cloudflare, in a separate bucket the app itself cannot reach.
• Access requests and emails you send us are received through Cloudflare Email Routing and kept in our company mailbox.
• Data travels over encrypted (HTTPS) connections.
• Stripe sends our invoices and takes payments. It receives the invoice contact’s name and email address, the company name and address, what each invoice is for and its amount, and the card or bank details the payer enters on Stripe’s own pages. Stripe also collects details about the device used to pay, to help prevent fraud, and keeps its own payment records under its privacy policy.
• An e-signature service we use to sign customer agreements receives the agreement, the signer’s name, email address and signature, and the signing details it records, such as the time and IP address. It may keep its own copy under its own privacy policy.
• We keep invoice and agreement records in our company mailbox and business records. We share them with our accountant or attorney when we need their advice, and with tax or other authorities when the law requires.
• Cloudflare handles data only to run CloseoutGate for us, under a data processing agreement that requires it to protect the data. This includes the usage measurement on our public web pages described above.
• Google handles sign-in and the Drive connection only if you or your company use them.
• We do not sell personal information or use it for advertising.

Keeping your company’s data separate

Every request is checked on our server for the signed-in person’s membership in the company that owns the data. A crew member sees only what their role and assignments allow.

Our service providers

Cloudflare, which stores your data for us, is bound by contract to protect it. Stripe uses the invoice and payment details it receives under its own privacy policy, including for fraud prevention and legal duties. Google and our e-signature service use the data they receive under their own privacy policies.

How long we keep it

Except where a different time is given above, project data and files are kept until your company deletes the project or workspace. Your account is kept until you delete it or ask us to delete it. Accounts with no workspace are removed as described under Signing in.

Turning off access

You can turn off location or camera access at any time in your phone’s settings. Without location, proof is saved without a position; photo proof needs the camera. An owner can disconnect Google Drive on the Integrations screen (Disconnect).

Deleting data

• You can delete your own account in the app (Crew, Delete my account) or by following the steps on the account deletion page. Your sign-in, name and email are removed at once and your name and email come off your company’s job records. Proof you added stays in your company’s job records, shown as Former crew member. Names your company typed into job fields, and copies it already exported or sent, are not changed. This includes the locked close-out package we keep for your company and packages saved to your company’s Google Drive. Your company keeps this proof as its work record and controls it; to ask for it to be removed, contact your company or write to us and we will pass the request on. Unsent proof and the saved job list are also removed from the phone when you delete your account.
• An owner can delete a project. For 30 days it can be restored; then its records and files are purged. Backup copies and database recovery points age out within 30 days after that.
• Whole-workspace deletion is a request an owner sends from the app (Crew, Delete this workspace); we carry it out by hand, within 30 days. A company’s only owner who deletes their own account is asked to confirm that the company is deleted too, and that sends the same request.
• Sessions and sign-in codes are left out of our daily backups. The database’s built-in 30-day point-in-time recovery covers all tables.
• A log of deletions is kept (counts only, no contents).
• Anyone can write to us to ask for a copy of the personal information we hold about them, to correct it, or to have it deleted. We may keep what we need for tax, accounting or legal reasons, such as invoices and signed agreements; Stripe and our e-signature service may keep their own copies under their own policies.

Contact

support@practicalbyteapps.com or 720-498-8400. More help is on the Support page.