Privacy

If you have a login — foremen, superintendents, project managers, finance, owners — the app holds your name, work email, phone, position, and the month and day of your birthday, which you set yourself on the Me screen. Your hourly rate is held apart from the rest.

The person you name in an emergency. On the Me screen, and once on your first morning, the app asks who it should ring if something happens to you on site, and for their number. Both boxes can be left blank and either can be cleared later. This is worth saying out loud because it is not your own data: it is somebody else's name and somebody else's phone number, usually a spouse, held here because you typed it and for no other reason. It is held as typed, it is never sent anywhere outside the app, and who can read it is answered below without hedging.

If you are on the crew without a login, the office enters your name, role, phone and birthday, and the field files your hours: the day worked, the task, the area, time in and out, break, regular and overtime. Those are wage-and-hour records, and they are the reason deletion cannot be promised without qualification.

If you do not work for ARK — a general contractor's staff, a supplier, a visitor — you may be in here because a foreman typed your name, company, role, phone or email into a job contact, an RFI, a punch item or a field ticket, or because you signed a ticket or a delivery sheet on his phone. That signature is kept as an image with the ticket it belongs to.

The app also records who did what: which account filed a report, edited a time card, reviewed a ticket or changed a line, and when.

Notes, captions and the lines about yourself are free text. Whatever a person types into them is held as typed — the app does not bound what can be written in a note.

Photographs of the work, marked-up drawings, delivery sheets, rental contracts and captured signatures are kept in one private storage bucket. There are no public links to it. A file is shown through a signed link that stops working after an hour, and the job a file belongs to is what decides who may open it.

Jobsite photographs routinely have people at work in them. That is what the photograph is for, and it is worth saying plainly.

A phone normally writes the spot a photograph was taken, the phone that took it and the moment, into the file beside the picture. The app re-encodes every camera frame down to a 1600 pixel long edge and strips that block, the Photoshop block and any embedded comment before the file leaves the phone. Two exceptions, said out loud rather than hidden: a HEIC image the browser cannot decode goes up as it arrived, and a document such as a PDF goes up whole and can still carry whatever the software that made it wrote inside.

Where you are. Location is off until you turn it on, on the Me screen. Turned on, the app asks the phone once for a position when you open a new daily, compares it against the coordinates of the jobs you are on on the phone, and fills in the nearest one. The position is not written down and is not sent anywhere.

What you say. Dictation runs between the tap that starts it and the tap that ends it. The words are worked out on the phone itself, no recording is kept, and no audio is sent to ARK or to anyone else.

What the phone asks you. These are the exact sentences iOS shows when it asks for a permission, and they are the promises the app is held to:

The roster is company-wide by design. Every active login can read every other person's name, position, phone, work email, birthday and the emergency contact they set for themselves. It is the company phone list.

An emergency contact is read by exactly that audience, and no narrower. The database has no way to show one column of a row to some people and hide it from others, so the name and number you put in that box reach everyone who can already see your own number on the Team screen — which is every active login at ARK. It is not restricted to the office, to owners or to your foreman, and nobody should be told it is. Fill it in knowing that, or leave it blank.

A job is a wall. Reports, tickets, photographs, contacts and the rest are readable by the people put on that job, and the rule is enforced by the database rather than by the screen.

Money is narrower still. Hourly rates and costs are held in separate tables that the database will not hand to an account that is not allowed to see costs.

Owners and admins can see the whole company, add and deactivate accounts, and issue a password.

The first password ARK gives you is kept so an owner or admin can hand it over again if you lose it. Change it on the Me screen, and do not use a password there that you use anywhere else.

Supabase holds all of it — the accounts, every table and the file bucket. Railway runs the app and keeps the server's own log lines, which are written as ids and counts rather than names, emails or photographs.

OpenStreetMap. When a job's address is turned into map coordinates the address is sent to Nominatim, run by the OpenStreetMap Foundation. That request goes out from the phone, so OpenStreetMap sees the device's IP address with it. Nobody's position is sent — only the job's address.

Notifications. On Android and on the desktop, a phone that has been switched on for notifications keeps its push credentials in the app, and only the person they belong to can read that row. The messages themselves carry counts and job names, nothing more. iPhones get no notifications from this app at all.

Crash reporting. It is on. When something in the app breaks, a report goes to Sentry: what broke, the line of code it broke on, the last few things tapped, the page it happened on, the version of the app, and in the iPhone app the make and model of the phone, the iOS version, the version of the web view it draws in, and whether it is a simulator rather than a real phone. The report carries your account id, so it is tied to you and not anonymous — the id alone, never your name and never your email. Emails, phone numbers, photograph data, tokens, query strings and rows echoed back from the database are stripped before it is sent, and nothing you typed into a note goes with it. It is read to fix the fault and for nothing else.

Log forwarding. The server's own log lines can also be forwarded to Axiom, which is off unless it has been configured for the build. In a forwarded log line a person is an id and nothing else.

That is the whole list. The browser is told which addresses the app may reach, so a seventh destination could not be added without changing the app itself.

No advertising, no analytics SDK, no third-party cookies, no tracking.

No AI or language model is called with any of it.

Nothing is sold, and nothing is shared with anybody for their own purposes.

There is no sign-up, and no login through Google, Apple or anyone else.

Nothing is deleted on a timer. There is no purge job in the app: what is written stays until a person deletes it by hand. That is the honest position, and it is stated rather than dressed up as a retention schedule the app does not run.

Two things cannot simply be deleted on request. Hours worked — the crew rows on a daily, the time cards, the labour on a ticket — are payroll records, and ARK has to keep them for as long as the law requires. And the edit history of a daily report can only be added to, never rewritten, because a filed daily is evidence in a delay claim and a history that could be edited afterwards would be worth nothing.

To see what is held about you, correct it, or ask for something to be removed, write to Lucas Raffa, owner, at lraffa@arkwoodwork.com. If you are on the crew without a login, the office can show you your own record and correct it.

Ask by name and by phone number if you can. Crew names are typed on the day rather than picked from a list, so the same person can appear with more than one spelling across jobs, and finding everything about a person is a search rather than a lookup.

If this page changes, the date at the top changes with it.