Privacy Policy
Effective 27 August 2026. This page describes what PinPoint collects, where it is kept, who can see it, and how to get rid of it.
PinPoint is a construction punch-list and site-inspection tool. You use it to record defects on a building: a pin on a floor plan, a photo, sometimes a voice note, and a short description of what is wrong. This policy covers the PinPoint app and the website at www.pinpointpunch.com.
What we collect
Your account. Your email address, your name if you enter one, and a password (stored only as a hash, never in readable form). Sign-in is by email and password; we do not use social sign-in.
The work you record. Projects, floor plans, punch items, inspections, comments, and the roster of people you invite to a project. This is your content and we treat it as yours.
Photos, video, and voice notes. Media you capture in the app or attach from your device. Voice notes are audio recordings; if you use dictation, the transcript is produced by your device or browser, not by us.
Precise location. When you take a photo or video inside PinPoint, the app records the device's GPS coordinates and accuracy alongside it, and it does the same when you position a floor plan on a map. This is deliberate: knowing exactly where on a site a defect was photographed is the point of the tool. Location is attached to the media you capture. We do not track your location in the background, and we do not track you between sessions or across other apps and websites.
Technical information. Ordinary server logs from our hosting providers, such as IP address, timestamp, and browser type, kept for security and debugging.
What we do not do. We do not sell your data. We never give your projects, photos, floor plans, or location to an advertiser or an ad network — the work you record in PinPoint is not used to target anyone, here or anywhere else.
We do advertise PinPoint on Facebook and Instagram, and that uses a tracker on this website. It is described in full in the next section, including what Meta receives.
Analytics and advertising
PinPoint runs two analytics services on www.pinpointpunch.com and in the web app. This section says exactly which, and what each one sees.
- Google Analytics 4 — how many people visit, which pages they open, and which site or search sent them. It sets its own cookies. We have not enabled Google Signals, ads personalisation, or sharing your data with Google for advertising or product improvement.
- Microsoft Clarity — heatmaps and session recordings, which show where people tap and where they get stuck. Clarity masks text content by default and we leave that masking on, so the words in your punch items are not recorded.
- Meta Pixel — this one is an advertising tracker, and it is on the website so we can measure and target Facebook and Instagram ads for PinPoint. It records that a browser visited pinpointpunch.com and which pages it opened, and Meta can match that to a Meta account. If you would rather it did not, Meta's own Off-Facebook Activity controls turn it off at their end, and any browser tracking-protection or ad blocker stops it at yours.
What none of them get. Your projects, photos, floor plans, punch items, and location are never sent to Google, Microsoft, or Meta. These tools see how the marketing site and the interface are used — not what you recorded with them.
If we add, remove, or change any of this, we will update this page and the effective date at the top.
Where your data is stored
- Supabase hosts the database and the file storage that holds your photos, video, and audio.
- Vercel hosts the website and app.
- Resend delivers transactional email, such as project invitations and password resets.
Google and Microsoft also receive the analytics described above. They get usage data about the interface — not your projects, photos, plans, or location.
These providers process data on our behalf under their own security and privacy commitments. Data is stored in the United States. If you use PinPoint from outside the United States, you are sending your data there.
PinPoint also keeps a copy of your recent work on your own device so the app keeps working with no signal on a job site. That local copy is removed when you sign out or delete the app.
Who can see your data
People you invite. Anyone you add to a project can see that project's items, photos, and notes, according to the role you give them.
Anyone holding a share link. PinPoint lets you create a read-only link to a project so a subcontractor or an owner can see the work without an account. Anyone who has that link can open it. Treat a share link like a key: forward it only to people who should see the project, and revoke it in the app when they should not.
An honest note about photo links. Photos, video, and floor plans are served from URLs that contain a long random string. The URL is not guessable, and we do not publish it, but the file behind it is not protected by a password or a login. Anyone you send a direct photo link to can open it, and so could anyone they forward it to. This is how the app can show a plan and its photos to someone with no account, and it is the trade-off that makes share links work.
Nobody else, except where we are required by law to disclose something, or where a provider listed above processes it to run the service for us.
How long we keep it
We keep your account and your projects for as long as your account exists. A punch list is a record of work owed on a building, so we do not delete it on our own initiative or hold it hostage if a subscription lapses.
Deleting your account
You can delete your account from inside the app: open your profile and choose Delete account. Deletion removes your account, your personal details, and the projects you own, including their photos, video, and audio. It cannot be undone, so export or download anything you want to keep first.
If a project you own has other people working on it, the app tells you what will happen to it before you confirm.
You can also request deletion by emailing Admin@pinpointpunch.com from your account's email address. We action requests within 30 days.
Your rights
You can ask us to show you what we hold about you, correct it, export it, or delete it. Email Admin@pinpointpunch.com. Depending on where you live, you may have these rights by law, including under the California Consumer Privacy Act and, in Europe and the UK, the GDPR. We do not charge for these requests and we will not treat you differently for making one.
Security
Traffic is encrypted in transit with TLS. Access to project data is enforced at the database level, so a signed-in user can only read the projects they belong to. Passwords are hashed. No system is perfect; if we ever discover a breach affecting your data, we will tell you.
Children
PinPoint is a tool for construction professionals. It is not directed at children and we do not knowingly collect data from anyone under 16.
Changes to this policy
If we change how we handle your data we will update this page and change the effective date at the top. Material changes will also be announced in the app.
Contact
Questions about this policy, or about your data: Admin@pinpointpunch.com.