CraftPilot

Privacy policy

Last updated: 5 October 2026 (time tracking)

This policy explains what data the CraftPilot Android app (package si.byteneststudio.bubble_level) processes, why, and what your rights are.

Who is responsible

CraftPilot is developed and operated by BytenestStudio, based in Slovenia, which is the controller for the data described here. Contact: bytenest.apps@proton.me.

Your work orders

Signed in: work orders, estimates and invoices, your customers’ details in them, their photos and floor plans are stored in your account (Google Firebase: Cloud Firestore and Cloud Storage) and kept as a copy on your phone, so they are backed up, available on every phone where you sign in, and work without internet. Only your account can access them; this is enforced by the database security rules.

Not signed in: work orders made before signing in stay only on your phone until you choose to save them to your account.

Signed in, your business profile, logo, tax rate, currency and favourite materials are also kept in your account, so a new phone gets them. Calculator settings stay on the device. PDFs you create are shared only where you send them.

When you enter customers’ personal data into work orders, you decide how it is used, so for that data you are the controller and responsible for handling it lawfully; we process it on your behalf only to store and sync it for you (Art. 28 GDPR).

Team projects

When you share a work order with your team, a copy of selected parts of it is stored as a project in Google Firebase (Cloud Firestore), and the people you invite with a code can see it in their app. They always see the customer’s name, the job description, the status and the floor plans. The customer’s phone, email and address, the material list and material prices are shared only if you turn them on. Photos of the work order are shared only those you select (with the Team plan); they are copied for the team like shared documents (see below). The work lines, document numbers and amounts of your work order are never shared. When you change the work order, the project is updated.

Everyone in a project sees the other members’ names (the company name from their profile, or their email address) and roles. Invite codes expire after 7 days.

You decide whom to invite and what to share, so for the customer data you share you remain the controller (see above). Legal basis for members’ names: providing the service you asked for (Art. 6(1)(b) GDPR).

Chat. With the Team plan, members can write messages and send photos in a project. They are stored in Google Firebase (Cloud Firestore and Cloud Storage) and seen by the project’s members. Photos in the chat are deleted after 12 months, together with the project, or when their message is deleted. To send notifications of new messages, we store a push token of your phone (Firebase Cloud Messaging) while you are signed in; you can mute a project or turn notifications off in Android.

Time tracking. With the Team plan, the owner of a project can turn on time tracking. Members then enter the hours they worked on each day of that project (as hours, or from–to with a break) and an optional note. Each entry is stored in Google Firebase (Cloud Firestore) with the member’s name and user ID. A member sees only their own hours; the owner sees everyone’s, can enter or change a member’s day (the member then sees that the owner did it and what it was before), and can add the hours to the work order as work lines. A day changed or deleted after that stays visible to the owner as changed, and the difference is added to the work order as a correction. The owner uses these hours to bill the job and, where they employ the members, for working time records, so for this data the owner is the controller and responsible for handling it lawfully; we process it on the owner’s behalf. Hours are deleted together with the project. When a member leaves, is removed or deletes their account, the hours they entered stay with the project, because the owner may need them for billing and records.

Documents. You can add links to documents (for example in Google Drive) to a work order and, with Pro, PDF files (up to 10 MB each, 1 GB in all). Files are stored in your account in Google Firebase, seen only by you, and deleted when you remove them, delete the work order or delete your account. When the work order is shared, you choose which documents the team sees; files are shared with the Team plan. Shared copies are seen by the project’s members and deleted when you stop sharing them, stop sharing the work order, and 3 months after your Team plan ends; the documents stay in your work order.

Reports. When a member reports a message, we receive the reason, an optional note, a copy of the message (text, author and photo names) and the reporter’s user ID, to handle it and prevent abuse (legitimate interest, Art. 6(1)(f) GDPR). We keep reports at most 2 years.

A member can leave a project at any time, and you can remove members. When you stop sharing or delete your account, the project is deleted and the team loses access. When a member deletes their account, they are removed from all projects.

Usage statistics

The app uses Google Firebase Analytics to learn which tools are used, for example “floor plan opened” or “PDF created”, together with the app version, device model, language and an app instance ID. We never send customer names, amounts, addresses or the content of your work orders. The advertising ID is not collected. Legal basis: our legitimate interest in improving the app (Art. 6(1)(f) GDPR).

Your account

An account is needed only for work orders. For it we process your email address, a user ID and how you sign in (email and password, or Google). With Google sign-in, Google shares your name, email and profile picture with Firebase Authentication. Passwords are handled by Firebase and are never visible to us. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR). You can delete the account at any time, see Delete your account.

Purchases (CraftPilot Pro)

Payments are handled by Google Play; we never see your card details. To know whether Pro is active on your account, we use RevenueCat, which receives your purchase details from Google Play, your user ID and your email address. Legal basis: performance of the contract and legal accounting obligations (Art. 6(1)(b) and (c) GDPR).

Feedback you send

When you send an idea or bug report, we receive your message, the email address you optionally enter (only to reply to you), the app version, language and platform, and a technical user ID. Messages are stored in Google Firebase and forwarded to us by email through Resend. We keep them as long as needed to handle them, at most 2 years.

Service providers

Some of them may process data outside the EU. In that case transfers rely on the European Commission’s adequacy decisions (EU–US Data Privacy Framework) or standard contractual clauses.

How long we keep data

Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, and to data portability. Write to bytenest.apps@proton.me. You can also complain to the supervisory authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si).

Children

CraftPilot is a tool for professionals and is not directed at children under 16.

Changes

If this policy changes, the new version will be published on this page with a new date.