Privacy Policy

EFFECTIVE 2026-04-15

SHORT VERSION

Your location history stays on your device. TradesTimer has no account system and does not run a server that receives your raw location data. The free app does not transmit any of your data to a third party.

If you subscribe to the optional Pro tier, your subscription status (never your location) is validated through RevenueCat. If you additionally opt in to Pro Cloud Backup, your history is encrypted on your device with a key only you hold and the resulting ciphertext is stored with a commercial cloud provider so you can restore it on a new phone. We cannot read it. The storage provider cannot read it. Only you — and anyone you choose to share your recovery key with — can.

1. Who we are

TradesTimer is an automatic time-tracking app for tradespeople, operated by Wishart Ventures Ltd. ("we", "our", "the app"). This policy describes what data TradesTimer collects, how it is used, and where it lives. You can reach us at support@tradestimer.com.

2. Data TradesTimer collects and stores on your device

When you grant location permission, TradesTimer records GPS fixes in the background so it can reconstruct your stops and drives. All of the following data is created and stored locally on your device, in the app's private storage:

Raw GPS fixes (latitude, longitude, accuracy, speed, timestamp)
Derived stops, drives, and gap blocks
Any labels, client names, billable flags, or notes you add
Your optional home zone coordinates and radius
App settings (billing increment, unit preferences, toggles)

This data is not transmitted to our servers, because we do not run any servers that receive your location data. It stays on the device until you delete the app or use the "Erase all captured data" control in Settings.

3. Data that leaves your device

There are exactly three circumstances:

3a. Reverse geocoding (address lookups)

When TradesTimer needs to turn GPS coordinates into a human-readable address (for example, to suggest a label for a new stop), it sends the coordinates to the operating system's built-in geocoder (Apple Location Services on iOS, Google Play Services on Android). If the OS does not resolve an address, TradesTimer may additionally send the coordinates to the public OpenStreetMap Nominatim service. These requests contain coordinates only — no name, account, or persistent identifier from the app.

3b. Subscription management (Pro only)

The free app does not communicate with our subscription provider. If and only if you choose to subscribe to TradesTimer Pro, purchase is processed by the Apple App Store or Google Play Store per their terms, and subscription status is validated by RevenueCat, which receives (a) an anonymous app user ID generated by us, (b) device information (device model, OS version, app version, country, IP address), and (c) your purchase receipts from the App Store or Play Store. RevenueCat never receives any of your location data, stops, drives, or labels — only the fact that your subscription is active. Their full privacy policy is linked above.

3c. Sharing you initiate

When you tap "Share" on an invoice preview or a day summary, the app hands plain text to your operating system's share sheet. You then choose where that text goes (email, messages, notes, etc.). TradesTimer is not involved in that transmission and does not retain a copy.

3d. Encrypted cloud backup (Pro subscribers, opt-in)

TradesTimer Pro includes an optional Cloud Backup feature. This feature is strictly opt-in: even as a Pro subscriber, nothing is uploaded until you explicitly enable backup in Settings. The free app never uploads backups of any kind.

End-to-end encryption. When you enable backup, your device generates an encryption key that never leaves your phone. Your tracking history is encrypted on your device using that key, and only the resulting ciphertext is uploaded. Neither TradesTimer, Wishart Ventures Ltd., nor the cloud storage provider we pay to hold the bytes can decrypt your backup. Industry terms for this arrangement are "end-to-end encrypted" and "zero-knowledge".

Who can read your backup. Only someone who holds your encryption key. In practice that means you, on your phone; and anyone you deliberately share your recovery key with (for example, a spouse or a bookkeeper you want to be able to restore your data if something happens to you). We cannot produce a decrypted copy on your behalf under any circumstances, because we do not have the key.

If you lose the key. If you lose your recovery key and lose access to your phone, your backup is cryptographically unrecoverable. We cannot reset it, un-encrypt it, or help you get back in. This is the direct tradeoff of zero-knowledge encryption — the same property that keeps the data private from us also makes it impossible for us to rescue it. The app will guide you through saving your recovery key when you enable backup.

What the storage provider sees. The cloud storage provider sees: the encrypted blob itself (opaque bytes to them); an anonymous backup identifier we generate per device; the size and timestamp of each upload; and your IP address at upload time, as with any internet request. Your location data, labels, addresses, and client names are all inside the encrypted blob and are not visible to them.

Deletion. You can delete your backup at any time from within the app. Deletion is propagated to the storage provider within 24 hours. Cancelling your Pro subscription does not automatically delete your backup — you control deletion explicitly.

Where it's stored. Encrypted backups are stored with Cloudflare R2, an object-storage service operated by Cloudflare, Inc. (San Francisco, California, USA). Cloudflare acts as our data-processing subcontractor under their standard terms and data-processing agreement, and receives only the encrypted blob plus the metadata described above. Cloudflare's own privacy practices are documented at cloudflare.com/privacypolicy. By default, backups are stored on Cloudflare's global network with no pinned jurisdiction; if you require EU-jurisdiction residency for compliance reasons, email us and we will migrate your backup to Cloudflare's EU-bound R2 jurisdiction at no cost.

4. Permissions we request

Location, including background ("Always") access. Required to reconstruct your workday. If you grant only "While Using", the app can still log fixes while you hold it open, but it cannot stitch together stops and drives in the background.
Notifications. Optional. Used only for informational alerts (for example, if the tracker has been silent for an unusually long time). No marketing, no push promotions.

5. Analytics and tracking

TradesTimer does not include third-party analytics SDKs that profile your behavior (no Google Analytics, no Mixpanel, no Facebook SDK, no Segment). Crash reporting is handled by Expo's built-in mechanisms and is limited to crash stack traces; it does not include your location data.

6. Data retention and deletion

Because your location data only lives on your device, you control retention directly:

Delete individual days, stops, or drives from the app UI.
Use Settings → Erase all captured data to wipe all events, edits, and place memory from the device.
Uninstalling the app removes all app-scoped storage.

To delete your subscription record from RevenueCat, contact us at support@tradestimer.com and we will submit a deletion request on your behalf.

7. Children

TradesTimer is not directed to children under 13, and we do not knowingly collect data from anyone in that age group.

8. Changes to this policy

If we materially change how the app handles data, we will update this page and note the new effective date at the top. Substantive changes that expand data collection will also be announced in-app.

9. Contact

Questions, deletion requests, or concerns: support@tradestimer.com.