Privacy Policy
Effective August 5, 2026
This policy explains what Hunter Webb collects when you use DryPlans, why, and what control you have over it. It covers both account holders and anyone who scans a QR placard.
The short version
- We collect the minimum needed to run the Service.
- We do not sell your data, and we do not run advertising.
- There are no third-party analytics or advertising trackers on any page.
- Scanning a QR placard does not identify you — no account, no cookie, no IP address stored.
- Delete your account and your data is deleted with it.
If you have an account
We collect and store:
- Account data — your email address, your name if you provide it, and a one-way hash of your password. We never store your password itself. If you sign in with Google we receive your email, name, and profile image from Google.
- Company profile — company name, phone, contact email, license number, and logo, if you choose to enter them. These appear on your public job pages, which is their purpose.
- Job site data — job names, addresses, permit numbers, and descriptions you enter.
- Documents — the files you upload, along with their filename, size, and type.
- Billing data — your plan, subscription status, and Stripe customer and subscription identifiers. Card numbers go directly to Stripe and never touch our servers.
- Session cookie — a single cookie that keeps you logged in. It is strictly necessary for the Service to function and is not used for tracking.
If you scanned a QR placard
You do not need an account, and we do not create one for you. When a public job page loads, we record one row so the builder can see that their placard is being used. That row contains:
- which job site was viewed;
- the time it was viewed;
- a truncated, one-way hash of your browser’s user-agent string.
That is all of it. We do not store your IP address, we do not set a cookie, and we do not use any third-party analytics service. The hash exists only so that a builder can distinguish “ten scans” from “one person refreshing ten times”; it cannot be reversed and cannot be linked to you across job sites, sessions, or devices.
The builder who owns the job site sees only aggregate counts — how many scans their job received. They do not see who you are.
Why we process this data
- To provide the Service — hosting and serving your documents is the whole product. (Contract.)
- To bill you — for paid plans. (Contract.)
- To secure the Service — rate limiting and abuse prevention. (Legitimate interest.)
- To email you about your account — password resets, receipts, and service notices. (Contract.)
Who we share it with
We share data only with the vendors that run the Service, and only as needed to run it. We do not sell personal data to anyone, for any price.
- Vercel — application hosting.
- Neon — database hosting.
- Cloudflare R2 — storage of uploaded documents.
- Stripe — payment processing for paid plans.
- Resend — delivery of transactional email.
We may also disclose data if legally required to, or to protect our rights or someone’s safety.
How long we keep it
- Account, job, and document data: until you delete it or delete your account.
- Scan records: retained while the job site exists, and deleted with it.
- Backups: purged on rotation, within 30 days of deletion.
- Billing records: retained as long as required for tax and accounting.
Security
Traffic is encrypted in transit with TLS. Documents are stored in private object storage with no public bucket access — every download is served through the application after a visibility check. Passwords are hashed with bcrypt. Public page addresses use long random identifiers rather than sequential ones, and public pages are marked noindex so search engines do not list them.
No system is perfectly secure. Treat a public job page as public: anyone with the link can open it. See the corresponding section of our Terms of Service.
Your rights
You can access, correct, export, or delete your data at any time from your dashboard, or by contacting us support@dryplans.com. Depending on where you live, you may also have the right to object to or restrict certain processing, or to complain to a data protection authority. We honor these requests regardless of where you live, and we will not charge you or degrade your service for exercising them.
Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.
International transfers
The Service is operated from the United States. If you use it from elsewhere, your data is transferred to and processed in the United States.
Changes
If we make a material change to this policy we will notify account holders by email or in the app before it takes effect.
Contact
Privacy questions or requests: reach us support@dryplans.com.