Legal

Privacy Policy

Last updated September 30, 2026

HardNumber is an estimating and quoting app for contractors. It is operated by Thiering and Sons Construction, based in Muscatine, Iowa (“HardNumber,” “we,” “us”). This policy explains what information we collect, why, who we share it with, and the choices you have. It applies to hardnumber.app, the HardNumber app, and the customer quote pages the app creates.

The short version: we collect what we need to run the app and take payments, we don’t sell personal information, we don’t run ads, and we don’t use advertising or analytics trackers.

• Who this covers
• What we collect
• How we use it
• Your customers’ information
• Who we share it with
• Payments
• Cookies and local storage
• How long we keep it
• Security
• Your choices and rights
• Children
• Changes and contact

1. Who this covers

• Contractors: people who create a HardNumber account, and the team members they invite (owners, estimators, and viewers).
• Customers: homeowners and other people who receive a quote link from a contractor, view it, sign it, or pay a deposit.
• Visitors: anyone browsing hardnumber.app.

You can use the app on one phone without an account. In that “local only” mode, your jobs, photos, and settings stay in your browser’s storage on that device and are not sent to us, except when you choose to send a quote link (which needs an account).

2. What we collect

Information you give us

• Account: your name, email address, and password. We store only a salted, one-way hash of your password, never the password itself.
• Company profile: business name, phone, email, city, license number, quote terms, tax rate, deposit percentage, and margin settings.
• Price book and jobs: your assemblies, sell prices and costs, and for each job the customer’s name, address, and phone, the scope of work, line items, options, notes, photos, and any signature captured on your device.
• Support messages: what you send us when you email [email protected].

Information collected when customers use a quote link

• That the quote was opened, when, and how many times.
• When a customer accepts: the name they type as their electronic signature, an optional finger-drawn signature, the option they chose, the date and time, their IP address, and their browser’s user-agent string. These are kept as the record of the signature.
• Whether a deposit was paid (see Payments).

Your costs and margins are never shown on the customer’s quote page.

Information collected automatically

• Security and service logs: IP address, browser user-agent, and timestamps when you sign in, sign up, ask for a password reset, or make requests to our servers. We use these to keep accounts secure (for example, to rate-limit password guessing) and to fix problems.
• Session information: when you sign in we record the session’s start time, IP address, and user-agent so you stay signed in and so we can detect misuse.

We do not use third-party analytics, advertising pixels, or social-media trackers.

3. How we use information

• To provide the app: store and sync your jobs across your devices and team, build PDFs and quote links, show quote status, and enforce plan limits.
• To process subscriptions and, if you turn them on, customer deposits through Stripe.
• To send service emails, such as password reset links and security notices. We don’t send marketing email without your permission.
• To secure the service: prevent fraud and abuse, rate-limit sign-in attempts, and investigate problems.
• To respond to support requests and improve the app.
• To comply with law and enforce our Terms of Service.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4. Your customers’ information

When a contractor enters a customer’s details or sends a quote link, HardNumber stores and processes that information on the contractor’s behalf so the contractor can quote, get a signature, and collect a deposit. The contractor decides what customer information goes into HardNumber and is responsible for having the right to share it and for giving any notices the law requires.

If you are a customer and have a question about your information, or want it corrected or deleted, please contact the contractor who sent you the quote. You can also email us at [email protected] and we will work with the contractor to help.

5. Who we share information with

We share information only as described here:

• Within your company: people your company’s owner invites can see the company’s jobs and settings according to their role.
• With your customer: a quote link shows the customer the information in that quote (your business details, their job, prices, photos you attached, notes, and terms).
• Service providers who run parts of HardNumber for us under contracts that limit how they may use the data:

  Provider	What they do
  Cloudflare, Inc.	Hosting, database (including job photos), content delivery, security, and DNS for hardnumber.app.
  Stripe, Inc.	Subscription billing, the customer billing portal, and customer deposits (see Payments).
  Our email delivery provider	Sends password reset and security emails to the address on your account.
  cdnjs (Cloudflare) and jsDelivr	Serve the open-source PDF library the app downloads; they see a normal web request from your device but receive none of your HardNumber data.

• Legal reasons: if required by law, subpoena, or court order, or when we believe in good faith it’s necessary to protect the rights, property, or safety of HardNumber, our users, or others.
• Business transfers: if HardNumber is sold, merged, or reorganized, information may transfer to the new owner, who must honor this policy for information collected under it.

6. Payments

Subscriptions. When you buy Pro or Team, you pay on a checkout page hosted by Stripe. Stripe collects and stores your card details; we never see or store your full card number. We receive and keep your Stripe customer and subscription IDs, your plan, billing interval, number of users, and subscription status.

Customer deposits. If a contractor turns on deposits, the contractor connects their own Stripe account. A customer who pays a deposit pays on a Stripe-hosted page, and the money goes to the contractor’s Stripe account. Stripe collects the customer’s payment details; we receive only whether and when the deposit was paid and the Stripe session reference. Stripe’s use of information is governed by the Stripe Privacy Policy.

7. Cookies and local storage

• One sign-in cookie (hn_session) keeps you signed in for up to 30 days. It is required for the app to work and is not used for tracking.
• Browser local storage on your device holds a working copy of your jobs, settings, and sync queue so the app works with no signal. Signing out clears it from that device.
• Cloudflare may set strictly necessary security cookies to protect the site from bots and attacks.

We don’t use advertising or analytics cookies, so there is nothing to opt out of. Our site does not respond differently to “Do Not Track” signals because we don’t track you across sites.

8. How long we keep information

• Account, company, and job data: for as long as your account is active. If you delete a job, it is removed from sync and its photos are deleted.
• Signed quote records (signature name, time, IP, chosen option): for as long as the contractor’s account is active, because they are the contractor’s record of the agreement, unless deletion is requested and the law allows it.
• Sign-in attempt logs: about 24 hours. Sessions: up to 30 days. Password reset links: expire after 30 minutes and are purged within a day.
• Billing records: as long as needed for tax and accounting law (often up to 7 years).

When you ask us to delete your account, we delete or de-identify your information from our active systems within 30 days, except what we must keep for legal, tax, fraud-prevention, or dispute reasons. Copies in backups age out on their normal schedule.

9. Security

We use HTTPS everywhere, store passwords as salted PBKDF2 hashes, store only hashes of session, invite, and password-reset tokens, rate-limit sign-in and reset attempts, block cross-site requests, and limit each team member to what their role allows. Customer quote links use long random addresses that can’t practically be guessed. No system is perfectly secure, so please use a strong, unique password and tell us right away at [email protected] if you think your account has been compromised. If a breach affects your personal information, we will notify you as required by law, including Iowa Code chapter 715C.

10. Your choices and rights

• Access and export: you can see and edit your information in the app at any time, and download a copy of your data with Company → Backup JSON.
• Correction: edit your company profile, jobs, and price book in the app, or ask us to fix anything you can’t change yourself.
• Deletion: email [email protected] from your account’s email address to delete your account. Cancel any paid subscription first (see the refund and cancellation terms).
• Email: service emails (like password resets) can’t be turned off while you have an account, but we won’t send marketing email without your consent.

Depending on where you live (for example, California, Iowa, or another state with a consumer privacy law), you may have additional rights, such as the right to know what we collect, to get a copy, to correct or delete it, and to opt out of sale or targeted advertising (we don’t do either). We honor these requests for all users regardless of state. We may need to verify your identity before acting on a request, you may use an authorized agent, and we will not discriminate against you for exercising your rights. If we decline a request, you can appeal by replying to our decision; if you’re unhappy with the result, you may contact your state attorney general.

11. Children

HardNumber is a business tool for adults. It is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.

12. Changes and contact

HardNumber is operated from the United States and your information is stored and processed in the United States and on Cloudflare’s global network. If we change this policy in a way that matters, we will update the date above and, for significant changes, notify account owners by email or in the app before the change takes effect.

Questions or requests: [email protected]
Thiering and Sons Construction (operating HardNumber), Muscatine, Iowa