Privacy Policy

1.1 Information You Provide Directly

When you create an account and use Stroyka, you provide us with:

• Account information: your name, email address, password, company name, and phone number (optional)
• Project data: project names, descriptions, budgets, addresses, and associated financial targets
• Time entries: worker hours logged per project, including date, duration, and task description
• Material and expense records: purchase descriptions, costs, vendor names, categories, and dates
• Photos: images of receipts, materials, or job site conditions uploaded through the app
• Supply requests: material requests submitted by workers, including item descriptions and quantities
• Daily work logs: daily notes, weather conditions, safety observations, and crew activity summaries
• Fuel trip records: vehicle information, mileage, fuel costs
• Task assignments: task descriptions, priorities, statuses, and assigned workers
• Communication data: any messages or feedback you send to us via email or in-app support

1.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Device information: device type, operating system, browser type, screen resolution
• Usage data: pages visited, features used, actions taken, timestamps (collected via PostHog analytics)
• Error and crash data: application errors, stack traces, and performance metrics (collected via Sentry)
• IP address: collected as part of standard server logs and authentication

1.3 Location Information

If your company enables the optional GPS time-clock feature, Stroyka collects your device's precise location only at the moment you clock in or clock out, to verify you are at the assigned job site (geofence verification):

• Location is captured only at clock-in and clock-out — never continuously, and never in the background.
• Each captured location (latitude, longitude, and accuracy) is stored with the corresponding time entry and is visible to your company's administrators (the “Boss” role) for job-site verification.
• Location capture relies on your device permission. If you decline, you can still clock in and out — the entry is simply recorded as location-unverified.
• We never use your location for advertising or for tracking you across other apps or websites.

1.4 Information We Do NOT Collect

• We do not collect your location in the background, or at any time other than when you clock in or out
• We do not collect biometric data
• We do not collect financial account numbers, bank details, or credit card numbers (payment processing is handled entirely by Stripe)
• We do not collect Social Security numbers or government-issued ID numbers

We use the information we collect for the following purposes:

• To provide and operate the Service: storing your project data, processing time entries, generating reports, and enabling collaboration between Boss and Worker users
• To authenticate users: verifying your identity when you log in and managing role-based access within your Company Account
• To verify job-site attendance: when the optional GPS time-clock feature is enabled, using the location captured at clock-in and clock-out to confirm a worker was at the assigned job site
• To send transactional emails: account verification, password resets, worker invitations, and subscription-related notifications (sent via Resend)
• To monitor and improve the Service: analyzing usage patterns to identify bugs, improve performance, and prioritize feature development
• To provide customer support: responding to your questions, feedback, and support requests
• To enforce our Terms of Service: detecting and preventing abuse, fraud, or unauthorized access

We do not sell your personal information. We do not share your data with advertisers. We do not monetize your data in any way.

We share your information only with the following categories of service providers, strictly for the purpose of operating the Service:

• Supabase (infrastructure): hosts our database (PostgreSQL on AWS), authentication system, file storage, and serverless functions. Data is stored in the US region.
• Sentry (error tracking): receives error reports and crash data to help us identify and fix bugs. Sentry does not receive your project data, financial data, or personally identifiable information beyond a user ID.
• PostHog (analytics): receives anonymized usage analytics (user ID, company ID, role, page views, feature usage). PostHog does not receive your name, email, project data, or financial data.
• Meta Platforms (advertising measurement): receives an event when someone visits the marketing website or clicks to get the app, via the Meta pixel. Marketing website only; it is not present in the app. Meta Privacy Policy
• Resend (email delivery): processes transactional emails including account verification, password resets, and worker invitations. Resend receives the recipient email address and email content.
• Stripe (payment processing): handles all subscription billing and payment processing. Stripe receives your payment information directly. Stroyka does not store or have access to your credit card numbers.
• Vercel (hosting): hosts the Stroyka marketing website and web application. Vercel may process standard web server logs including IP addresses.

We may also disclose your information if required by law, legal process, or government request, or if we believe disclosure is necessary to protect the rights, property, or safety of Stroyka, our users, or the public.

Stroyka is a multi-tenant platform. Each Company Account's data is strictly isolated from all other Company Accounts at the database level through Row Level Security (RLS) policies. This means:

• No user from one company can view, access, or modify another company's data
• Data isolation is enforced by the database engine itself, not just application code
• Stroyka employees access customer data only when necessary for support purposes and only with the customer's explicit permission

5.1. Your data is stored on servers located in the United States, hosted by Amazon Web Services (AWS) through our infrastructure provider, Supabase.

5.2. Data in transit is encrypted using TLS 1.2 or higher.

5.3. Data at rest is encrypted using AES-256 encryption.

5.4. Offline data stored on your device is encrypted using SQLCipher (sqlite3mc) with device-specific keys stored in secure OS storage (Keychain on iOS, Keystore on Android).

5.5. Database backups are performed automatically by Supabase and are encrypted.

5.6. We implement role-based access controls, rate limiting, input validation, and audit logging as part of our security practices.

5.7. While we implement industry-standard security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6.1. Active accounts: We retain your data for as long as your account is active and your subscription is in good standing.

6.2. Canceled accounts: After subscription cancellation, your data remains accessible and exportable for 30 calendar days. After 30 days, all data associated with your Company Account is permanently deleted from our servers and backups.

6.3. Terminated accounts: If your account is terminated for violation of our Terms of Service, data deletion follows the same 30-day timeline unless legal preservation is required.

6.4. Transactional emails and support correspondence may be retained for up to 12 months for quality assurance and legal purposes.

6.5. Anonymized, aggregated analytics data (which cannot be used to identify any individual or company) may be retained indefinitely for product improvement purposes.

Depending on your location, you may have the following rights regarding your personal information:

All Users

• Access: You can view all data stored in your account through the app at any time
• Export: You can export your data in CSV and PDF formats at any time
• Correction: You can update your personal information through the app settings
• Deletion: You can request deletion of your account and all associated data by contacting support@getstroyka.com

California Residents (CCPA)

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you
• Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions
• Right to Opt-Out of Sale: We do not sell personal information. This right does not apply.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise your CCPA rights, contact us at support@getstroyka.com. We will respond to verifiable requests within 45 days.

European Users (GDPR)

• Right to Access, Rectification, Erasure, and Portability of your personal data
• Right to Restrict Processing or object to processing of your personal data
• Right to Withdraw Consent at any time
• Right to Lodge a Complaint with your local data protection authority

The legal basis for processing your data is: (a) performance of a contract (providing the Service), (b) legitimate interests (improving the Service, preventing fraud), and (c) consent (where applicable, such as marketing communications).

8.1. The Stroyka web application uses essential cookies for authentication and session management. These cookies are strictly necessary for the Service to function and cannot be disabled.

8.2. Our marketing website (getstroyka.com) uses analytics cookies via PostHog to understand how visitors interact with the site — pages viewed, referrer, and which buttons are clicked. We do not record your screen or your session.

8.3. Our marketing website also loads the Meta (Facebook) advertising pixel, which sets third-party cookies and reports to Meta that a visit or a sign-up click happened, so we can measure whether our ads work. It runs on the marketing website only — never inside the Stroyka app, and never on your project, time, or financial data. If you would rather not be measured this way, your browser’s tracking protection or an ad blocker will stop it, and the website works normally without it.

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices or content of these third parties. We encourage you to read the privacy policies of any third-party services you access.

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated Privacy Policy.

If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your information, please contact us:

Dalen Meridian LLC (d/b/a Stroyka)
Email: support@getstroyka.com
Website: getstroyka.com

For data protection inquiries, please include “Privacy” in the subject line of your email.