How ProStamp handles your information.

This policy applies to the ProStamp apps for iOS and Android, the ProStamp website, Web Verifier, personal account services, the ProStamp Cloud Job archive, Job share links, Remote Client Acknowledgment, and Team Workspace. A Team workspace is controlled by the organization that invited its members. That organization decides why its evidence and member information is collected, who may access it, and how long it should be kept; ProStamp processes that information to provide the workspace.

The information involved depends on the features you choose and the permissions you grant. It may include:

• Capture and device information: photos, videos, microphone input for video, photo-library items, device settings, and technical information needed to create or export evidence.
• Location and job context: precise coordinates, altitude, compass heading, street address, weather, map context, work profiles, company logos, custom text, work sites, project details, and asset details.
• Account information: Clerk user identifiers, email address, name, sign-in provider, session and device labels, and account or plan status. The same ProStamp account is used for the personal version and for any Team workspaces you join; each workspace keeps its own membership, role and display name for you.
• Subscription information: product, entitlement, purchase, renewal, and restore status made available through Apple or Google Play. Apple and Google handle payment-card and store billing information for their platforms.
• Verification information: capture time, location, file hashes, embedded signatures, verification codes, results, and other metadata used to inspect whether evidence has changed.
• Job archive information: if you turn on the ProStamp Cloud Job archive, the original Job photos with their embedded metadata (including precise location), small thumbnails, Job records and report PDFs, signatures, and the saved clients, invoices, business details, checklist templates, and Job settings described below, plus a random device identifier and the device label you choose.
• Remote client acknowledgment information: a frozen work summary, sender display name, job title, client name, service address, completion time, work profile and checklist results, selected reduced-size evidence previews, request status and timestamps, and—if submitted—the recipient's typed name and drawn signature. Selected previews may retain information visibly rendered into their watermark pixels.
• Support and service information: messages you send, attachments, app version, device details, IP address, browser or request information, security events, and diagnostic details needed to operate and protect the services.

An account is not required for basic capture, local gallery, verification, and export. ProStamp stores local records and settings on your device. Saved media may also appear in Apple Photos or the Android system media gallery. If you enable supported iCloud features, Apple may sync items such as profiles or logos through your iCloud account according to your device and Apple settings. On Android, ProStamp excludes its app-private records, databases, and preferences from cloud Auto Backup. Android may still transfer eligible local app data directly during device setup; the device-bound secure account session is excluded from that transfer.

Local media is not automatically uploaded to ProStamp simply because you captured it. Once you turn on the ProStamp Cloud Job archive, however, photos you attach to Jobs are uploaded automatically, as described below. Media may also leave the device when you choose a network-dependent feature, share or export a file, verify a file on the web, turn on the ProStamp Cloud Job archive, publish a Job share link, create a remote client acknowledgment request, connect personal cloud backup, or capture under an active Team Project.

When you create or use an account, Clerk processes sign-in and identity information. ProStamp stores the account and session data needed to recognize you, show your plan, secure device access, and connect you to an invited Team workspace. Authentication may use Apple, Google, or email, depending on the options currently offered.

Apple or Google processes store purchases and provides ProStamp with product, purchase-token or transaction, and entitlement status needed to unlock, restore, link, and manage subscription features. ProStamp does not receive your full payment-card details from Apple or Google Play.

Personal cloud backup is optional. When you connect Google Drive or OneDrive, the app requests a limited scope intended to manage only files or the app folder created by ProStamp. Connection credentials are stored using platform-protected secure storage where the feature is available, and the connected account email and remote file identifiers may be stored on your device so the app can show status and avoid duplicate uploads.

Personal backup media travels directly from your device to your selected Google or Microsoft account; ProStamp servers do not receive those media bytes. The provider's terms, retention, and privacy policy apply to copies in that account. Disconnecting a provider removes ProStamp's stored connection credentials but does not automatically delete files already uploaded to your drive. The ProStamp Cloud Job archive, described next, is different: it stores Job data on ProStamp's own servers.

The Job archive is an optional ProStamp Pro feature for signed-in Personal Accounts. It is off until you turn it on, and when you do you choose which completed Jobs to include. It keeps your Jobs so they can be restored on another device. By default it uploads only on Wi-Fi; you can allow cellular data.

While it is on, ProStamp uploads to its private Cloudflare storage, linked to your account:

• The original, full-resolution photo attached to each Job, byte for byte. Its embedded metadata is not removed, because the photo's verification signatures depend on it: this includes precise GPS coordinates, altitude, heading, capture time, the street address, the verification code, and any client name recorded in the photo, as well as everything visibly stamped into the image. Videos are not archived.
• A small thumbnail of each photo, without metadata.
• A record of each completed Job: title, dates, status, notes, checklist results, client name, address and contact details, each photo's capture time, address and coordinates, the work profile name and logo, and any sign-off, including the signer's typed name, drawn signature and acknowledgment text. Job report PDFs you generate are archived too.
• Your saved clients (names, addresses, billing and service addresses, contact names, phone numbers and email addresses), invoices and their line items, invoice business details, custom checklist templates, and Job settings.
• A random identifier created for each device and kept on that device, its hardware model, and an optional device name you type. ProStamp uses them so only one device at a time edits your Jobs.

Only your signed-in account can read its archive. Client information in the archive is information you entered about your own customers; you are responsible for having the right to store it. Turning the archive off stops new uploads but does not delete what is already stored, and deleting a Job on your device does not remove its archived copy. See Retention and Deletion for how archived data is removed.

Remote Client Acknowledgment is optional and requires the ProStamp user to review and approve what will be shared. ProStamp uploads a frozen work summary and only the reduced-size evidence previews the sender selects. It does not upload the original full-resolution photos, separate EXIF or precise GPS fields, client phone or email, internal notes, technician notes, or voice recordings for this request. Visible information already rendered into a selected preview remains visible to the recipient.

The recipient does not need the app or an account. A complete private link acts as a bearer credential, so anyone who receives it may be able to view the shared package and submit a response. The page records viewed, signed, declined, expired, revoked, and superseded status as applicable. A signed response includes the typed signer name, drawn signature, and server time. ProStamp does not use the private link or Turnstile to verify the signer's legal identity.

Cloudflare D1 and a private R2 bucket (shared with Job share links, separate from the Job archive and Team data) store the request record and selected content. Cloudflare Turnstile processes connection and browser signals to prevent automated signing or declining; ProStamp validates its token on the server. After a valid private link is opened, ProStamp uses a strictly necessary, HttpOnly security cookie for up to 30 minutes so the browser can retrieve the package and submit the response. It is not used for advertising or cross-site tracking. ProStamp does not add advertising or third-party analytics to the private acknowledgment page.

When you publish a Job share link, ProStamp uploads the work summary, selected photos, and any notes or PDF report you explicitly include to private Cloudflare storage. Notes are off by default. A photo that is already small enough is uploaded as captured, with its embedded metadata, including precise location, the street address and any client name recorded in it; larger photos are re-encoded without metadata. Visible watermark information remains in every photo. The optional PDF contains the full Job report and may contain more evidence than the selected web gallery, including recorded client confirmation information. This feature is separate from a request for the client to sign an acknowledgment.

Anyone who receives or is forwarded the link can read the published content, including earlier published versions and the update notes you wrote for them, without signing in. Links last 7, 30, or 90 days, as selected by the sender. Publishing an update shows new content at the same link and starts a new validity period; earlier versions stay available to link holders while the link is active. When a link is pasted into a messaging app, that app's link-preview service may receive the Job title and sender name. The sender can disable a link from the Job sharing controls. Expiration, disabling the link, or deleting the owning account blocks subsequent content requests immediately; the stored files are then deleted within 30 days. Copies already downloaded by recipients cannot be recalled.

Link secrets are stored in the device Keychain and sent to our service for access checks; the server stores their hashes. The private viewing page does not use advertising or third-party analytics. An hourly cleanup process removes uploads that were never published after a one-hour grace period, and removes the stored content and lifecycle records of an expired or disabled link 30 days after it stops working, with retries if deletion fails.

When an authorized member captures under an active Team Project, ProStamp may upload the evidence file to Cloudflare R2 and store its associated record in Cloudflare D1. Team data may include the original media, thumbnail, capture time, uploader, device or upload status, project, work-site or asset, coordinates, address, verification result, notes, and audit activity.

Workspace owners, managers, and other authorized members can access Team evidence and related metadata according to their role and project permissions. The organization may export or otherwise use that evidence under its own policies. A Team Project Note uploads the final text you approve; the temporary voice recording used for on-device transcription is not uploaded to Team Workspace.

Your Team profile. Before you use a Team workspace, ProStamp asks for your first name, last name and phone number, and shows the email you signed in with. If you signed in with Apple's Hide My Email, you may add a contact email. This profile is stored for that workspace only. Your name appears to the workspace's members on the photos, time entries and activity you submit. Your phone number and contact email are shown only to that workspace's owners and managers, so they can reach you about work; they are not shown to other members, included in customer progress links, attached to evidence, or written to audit records.

Invitations. A workspace owner or manager may invite you by email or by creating an invitation link they send you themselves (for example by text message). When inviting, they may enter your name, phone number and job title in advance; you can correct your name and phone number when you join. Whoever opens an invitation link and signs in joins the workspace, so the workspace records the email of the account that accepted it, next to the address the invitation was sent to, if any.

The Web Verifier sends the file you select to ProStamp's Cloudflare-hosted verification service for the requested check. The service processes the file transiently and does not intentionally store the uploaded verification file after the response is produced. Standard security and request logs may still record technical details such as time, IP address, request status, and browser information, but not the uploaded file itself.

Cloudflare also processes ordinary website traffic to deliver pages, prevent abuse, and maintain service reliability. ProStamp does not use capture content for behavioral advertising.

ProStamp uses information to:

• Create, store, organize, verify, back up, and export evidence.
• Authenticate users and enforce workspace roles and access.
• Provide subscriptions, account status, and requested support.
• Deliver maps, addresses, weather, network time, catalogs, and other features you choose to use.
• Secure, troubleshoot, monitor, and improve ProStamp's apps and services, and comply with legal obligations.

ProStamp shares information only as needed to provide requested features, operate securely, follow your or your organization's instructions, complete a business transfer, or comply with law. The principal service providers and platform services include:

ProStamp does not sell personal information, share personal information for cross-context behavioral advertising, or allow third-party ad networks to use Team evidence or personal captures.

• Local content remains until you delete it from ProStamp, Apple Photos, the Android system media gallery, iCloud, an exported location, or the device. Removing the app may not remove copies saved elsewhere or data transferred during device setup.
• Personal account and session data is kept while the account is active and as needed to provide and secure the service. You may request account deletion from Account & Plan in the app or by contacting the privacy address below.
• Team data is kept while the workspace is active and according to the organization's plan, instructions, and applicable legal or contractual requirements. Workspace owners may request export or deletion. Removing a member does not necessarily erase evidence or audit records the member submitted for the organization. When you leave a workspace or are removed from it, the phone number and contact email you gave that workspace are deleted; deleting your ProStamp account deletes your Team profiles in every workspace.
• Verification uploads are processed transiently and are not intentionally retained as stored files after the verification response.
• ProStamp Cloud Job archive content is kept while your account has ProStamp Pro, so it can be restored. Turning the archive off or deleting a Job on your device does not delete it. If Pro ends, the archive becomes read-only for 90 days so you can still restore it, and is then deleted; renewing within those 90 days keeps it. Deleting your Personal Account deletes the archive records at once and removes its stored files by an automated cleanup, normally within hours. To remove archived content without deleting your account, contact the privacy address below.
• Job share links stop working when they expire, are disabled, or the account is deleted; their stored files are deleted within 30 days after that, and abandoned uploads within about an hour.
• Problem reports you send from the app, including attachments, are deleted after 90 days. They are not linked to your account. Attached photos are stored as you picked them and may contain embedded location data.
• Remote acknowledgment requests normally expire after seven days. Content for revoked, expired, declined, or superseded requests is scheduled for deletion within 24 hours; a content-free status tombstone may remain for up to 30 days. Signed content is scheduled for deletion seven days after the app confirms import, and no later than 90 days if import is never confirmed. Deleting the request or its Personal Job asks ProStamp to remove the server copy; deleting the Personal Account removes its remaining request records and stored objects, subject to temporary protected backups and legal requirements.
• Support, security, and transaction records are kept only as long as reasonably needed for support, fraud and abuse prevention, accounting, dispute resolution, and legal obligations. Residual copies may remain temporarily in protected backups before aging out under normal backup schedules.

After a valid deletion request, ProStamp deletes or de-identifies information it controls unless retention is required for security, legal compliance, transactions, disputes, or the rights of a Team organization. Copies controlled by Apple, Google, Microsoft, a Team organization, or a recipient you shared with must be managed with that party.

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information. The Privacy Choices page explains where to manage each type of ProStamp data. You can also:

• Change camera, microphone, photos/media, and location permissions in your device settings.
• Delete local records and media, subject to Apple Photos, Android media storage, iCloud, and exported-copy behavior.
• Disconnect Google Drive or OneDrive and revoke access with that provider.
• Turn the ProStamp Cloud Job archive off in Backup & Sync to stop new uploads, and ask the privacy address below to delete archived content.
• Disable a Job share link from the Job's sharing controls.
• Manage or cancel a subscription through your Apple Account or Google Play account.
• Request access to or deletion of your ProStamp personal account.
• Revoke or delete an active remote acknowledgment request from its Personal Job; recipients must manage copies they separately saved or received.
• Update your Team profile (name, phone number, contact email) in the Team version under Settings › Your Details. Workspace owners and managers can also correct your name and phone number.
• Contact your workspace owner about Team data; the owner may need to preserve business evidence even after your membership ends.

Send privacy requests to [email protected]. A remote acknowledgment recipient may use the same address and include the request ID if available, without sending the complete private link or signature by email. ProStamp may need to verify identity and authority before fulfilling a request.

ProStamp uses safeguards appropriate to the service, including encrypted network transport, scoped access, hashed session tokens, role checks, and platform-protected credential storage. No system can guarantee absolute security, so keep originals and report suspected account misuse promptly.

ProStamp and its service providers may process information in the United States and other countries where they operate. Those places may have different data-protection laws from your location.

ProStamp is designed for professional field documentation and is not directed to children under 13. ProStamp does not knowingly collect personal information from children under 13.

ProStamp may update this policy as its features and practices change. Material updates will be reflected by changing the date at the top of this page and, when appropriate, by providing additional notice.

Questions, privacy requests, and account deletion requests can be sent to [email protected]. For product support, contact [email protected].