← Back to app

Privacy Policy

HQ Craftworks · Last updated: 10 August 2026

This policy is provided by Craftsworks ("we", "us", "the operator") and explains what data HQ Craftworks collects, why, where it's stored, and your rights under the Australian Privacy Principles (APPs).

1. What we collect

We only collect what's necessary to operate the app for you and your team:

• Account details: your name, email address, and a password (used to sign in). New members are invited by email and given a temporary password to set up their account.
• Profile information you choose to add: phone number, work groups or skills, qualifications, an emergency contact name and number, notes, and an avatar colour.
• Work data you enter: jobs and site details, tasks, schedules, site notes and job notes, time and materials entries, quoting information, and the addresses or client/builder names you choose to record against a job or note.
• Photos and files: images and documents you choose to attach to jobs or notes. These are stored in private cloud storage so your team can view them.
• Roles and permissions: the role (Owner, Admin, Manager, Worker) and permission settings assigned within a workspace, so the app knows what each person may do.

2. What we don't collect

We do not collect location or GPS data, advertising identifiers, tracking or analytics data, biometric data, browsing history, or anything outside the app. We do not use cookies for advertising.

3. Where your data is stored

• In our cloud database (Supabase — Sydney, Australia): your data is synchronised so your team sees the same information across devices. Our database is operated by Supabase Inc. and hosted in the Oceania (Sydney) region, so your data is stored in Australia.
• Cloud file storage (Supabase Storage — Sydney): photo and document files are stored in a private storage area scoped to your workspace. Files are not publicly accessible — a device can only retrieve a file after signing in, at which point our system issues a short-lived, single-file access link. Each workspace can only read, upload, or delete files within its own area.
• On your device: the app may cache a small amount of data in your browser's storage (for example, an in-progress note draft) so it's fast and you don't lose work when you switch screens. You can clear this at any time.

4. Third-party services

To deliver the app we use the following services. Each handles the data we send it under its own privacy policy:

• Supabase — cloud database and file storage (hosted in Sydney, Australia). Supabase privacy policy
• Resend — sends transactional emails on our behalf (for example, an invitation to join a workspace, or an assignment notification). Only the recipient's email address and the message content are sent to Resend; it is not used for marketing. Resend privacy policy
• Application hosting — the app's files (the pages and code that run in your browser) are served by our static hosting provider. Your data does not pass through the host; it travels directly between your device and Supabase.

We do not use any accounting integration, document-scanning/OCR service, analytics provider, or advertising network.

5. How we use your data

Solely to operate the app for you: showing your screens, synchronising information between your team's devices, storing your photos and files, and sending the occasional service email (such as an invitation or a notification). We do not use your data for marketing, advertising, training AI models, or selling to third parties.

6. Data retention and deletion

We keep your data for as long as you use the app. You can delete it at any time:

• Individual records — delete jobs, tasks, notes, photos, time entries and other records from within the app.
• Your own membership — a member who is not the workspace Owner can leave a workspace from the Members screen, which removes their access. Records they created remain as the workspace's own data.
• Removing a member — an Owner or Admin can remove another member from the workspace.

You can also email us to request access to, correction of, or deletion of your personal information, and we will action the request within 30 days. When a record is deleted, it is removed from our database, and any attached photo or file is deleted from cloud storage at the same time.

7. Security

• All connections use HTTPS / TLS.
• Passwords are hashed and managed by our authentication provider — we never store your password in plain text.
• Database access is protected by row-level security: every request is checked against your workspace membership, so one workspace cannot read or write another's data.
• Stored files (photos, documents) live in a private, per-workspace area and are served only via short-lived access links issued after sign-in.

No system is perfectly secure. Please keep your devices protected and avoid signing in on shared or public devices.

8. Your rights

Under the Australian Privacy Principles you have the right to:

• Access the personal information we hold about you;
• Request correction of information that is inaccurate;
• Request deletion of your information;
• Make a complaint about how we have handled your personal information.

To exercise any of these, contact us at the email below. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC).

9. Children

HQ Craftworks is a business tool and is not directed at, or intended for use by, anyone under 18. We do not knowingly collect data from minors.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects when it last changed. Material changes will be flagged within the app.

11. Contact us