Privacy Policy
Last updated 16 October 2026
Stainback Build is job-site software used by Stainback Construction and its team, subcontractors and clients. This policy covers the website at build.stainbackconstruction.com and the Stainback Build mobile app.
What we collect
Your account. Your name, email address and a password. The password is never stored — only a scrypt hash of it, which cannot be reversed into the password you chose.
Your work. The projects, schedules, tasks, task updates, notes, messages, selections and documents you or your team enter. This is the point of the product; it is your company’s business record.
Files and photos. Documents and photographs uploaded to a job, including photos added to a task through the app. The app resizes and re-encodes a photo on your device before upload, which removes the location data your camera records. A file uploaded any other way carries whatever information is in it, including any location data.
Sharing. When someone sends a file out of Stainback Build or makes a link to one, we record who did it, which file, which project, when, and how (sent from the device or as a link). When a shared link is opened, we record the time and the IP address it was opened from. These records are an audit trail for the business: the workspace owner can see them, and nobody else. A link stops working after 7 days, or sooner if it is withdrawn or the person who made it can no longer open the file. A photo sent out is a copy with its location data removed.
Contacts you enter. Names, phone numbers and email addresses for subcontractors, vendors and clients, entered by your team or imported from a file you provide.
Technical. A session identifier so you stay signed in, and ordinary server logs (IP address, request time, error detail) kept for security and troubleshooting.
Sign-in attempts. Every time a password is checked we record the email address that was typed, the IP address it came from, whether it succeeded, and when. This is what lets us slow down someone guessing at your password, and it is used for nothing else. The email address is recorded whether or not it belongs to an account, so a mistyped address is recorded too. We never record the password itself, right or wrong.
Reports and blocks. When you report a message or task update, we store what you reported, when, and any reason you give. When you block someone, we store that too. Only the workspace owner and administrators see reports, and the person reported is never told who reported them. A block is seen by nobody but you.
What we do not do
- No advertising, and no advertising identifiers.
- No analytics or tracking scripts. The site loads no third-party code.
- We do not sell, rent or share your data with anyone for their own purposes.
- We do not track you across other apps or websites.
- We do not use your data to train machine-learning models.
Who can see what
Access follows your role, and it is enforced on the server rather than hidden in the app. An owner, administrator or project manager sees the whole workspace. Field crew see live projects. A subcontractor sees only the job they were invited to, its schedule and the files shared with their trade — never internal notes, financial information or team messages. A client sees their own build.
Where it is kept
The application and its database run on Fly.io in Dallas, Texas. Uploaded files are stored in Amazon S3 in Ohio (us‑east‑2). Outbound email, when enabled, is sent through Amazon SES. All traffic is encrypted in transit. Everything is held in the United States.
Cookies
Three, all necessary for the site to work, none used for tracking or advertising: sb_session keeps you signed in,sb_company remembers which workspace you are viewing, andsb_view_as holds the role-preview setting available to administrators. There are no analytics or advertising cookies to consent to.
The mobile app
The app asks for the camera and photo library only when you add photographs to a task, and only for that. It does not use location services, contacts, the microphone or your calendar. Your sign-in token is kept in the device keychain. Signing out removes it, along with any files cached for offline use.
How long we keep it
Your company’s job records are kept for as long as the workspace exists, because a build’s history is the reason the record is made. A web session expires after 30 days, a mobile session after 90, and signing out ends it immediately.
Records of shared files and of links being opened are kept for as long as the workspace exists, like the rest of the job record.
Sign-in attempt records are deleted after about 30 days. “About” is honest rather than vague: the clear-out is opportunistic rather than scheduled, so in a quiet period a record may sit a little longer before it goes.
Deleting your account
Write to us at the address below and we will delete your account immediately: your email address, name and password are erased, and every signed-in device is logged out. You can also do it yourself in the mobile app, under More, then Account. Deleting from the app also removes everything the app kept on that phone.
Work you authored stays on the job, attributed to “Former team member”. A task update or a photo of the work is the record of what happened on a site — it belongs to the build rather than to the person who added it, and removing it would erase the project’s history along with your account. If you need something you wrote removed as well, write to us and we will do it.
Security
Passwords are hashed with scrypt. Session tokens are stored only as SHA‑256 hashes, so a copy of the database hands out nothing usable. Files are served through short-lived signed links rather than public URLs.
Children
Stainback Build is a tool for construction professionals. It is not directed at children and we do not knowingly collect information from anyone under 16.
Your rights
You can ask for a copy of your personal information, ask us to correct it, or ask us to delete it. Write to the address below and we will respond within 30 days. If you are a subcontractor or a client, the builder who invited you controls the job records you appear in; we will put you in touch with them.
Changes
If this policy changes we will update the date at the top. Anything that materially changes how your information is used will be notified in the app before it takes effect.
Contact
Stainback Construction
Dallas, Texas
info@stainbackconstruction.com