Privacy Policy

Back To The Grind ("we", "us", or "the operator") respects your privacy. This Privacy Policy explains what information we collect when you use our platform, how it is used, how it is stored, and the choices you have over your data. This policy applies to the web application, its mobile builds, and any connected integrations offered through the platform.

By creating an account or using the application, you consent to the data practices described in this policy. If you do not agree, you should not use the application.

Account information: Your name, email address, and authentication credentials when you register or sign in. When you use "Continue with Google", we receive the email and basic profile details Google shares with us.

Business data: Information you enter while running your business — customers, contacts, estimates, invoices, work orders, materials, inventory, financial records, documents, and communications. You own this data; we process it only to provide the service to you.

Connection data: When you connect an integration (e.g. Gmail, Google Calendar, Google Drive, Facebook, Instagram), limited credentials and the data you authorize are used to sync that service on your behalf, scoped to your account only.

Payment information: Subscription payments are processed by Stripe. We do not store your full card number on our servers — Stripe handles payment card data under its own PCI-compliant infrastructure. We retain your subscription plan, billing period, and transaction records.

Usage and device data: Basic analytics such as pages viewed, features used, device type, and approximate location derived from IP address, used to improve and secure the service.

• Provide, operate, and maintain the application and its features
• Authenticate your account and keep your session secure
• Process subscription payments and manage your billing
• Run the AI assistants and autonomous workflows you enable, on your data and on your behalf
• Sync connected integrations (email, calendar, social, storage) when you authorize them
• Send service notifications, summaries, and account-related communications
• Detect, prevent, and address technical issues, fraud, and abuse
• Improve features, performance, and user experience over time

We do not sell your personal information or business data to third parties. Data you enter is not shared with other users — each account is isolated (see Data Security below).

Your data is stored on secure, access-controlled infrastructure. The platform enforces Row-Level Security (RLS) and ownership-based isolation: each user account is segregated, and you may only read, update, or delete records associated with your own account email. One user cannot access another user's records.

Connected integrations are resolved per user — OAuth tokens for email, calendar, and social services are scoped to the individual who authorized the connection and are not shared across accounts.

While reasonable technical and organizational measures are in place, no system is completely secure. You acknowledge the inherent risks of digital data storage and agree to protect your login credentials and maintain your own backups of critical information.

We retain your account and business data for as long as your account is active. Rolling hourly snapshots of your account data are retained for approximately 24 hours to enable point-in-time recovery, and full scheduled backups can be configured in your Backup & Recovery settings. You may export and download your data at any time.

If you cancel your subscription, your data is retained for a limited grace period to allow reactivation, after which it may be permanently deleted. You may request deletion of your account and associated data at any time by contacting us.

The application relies on third-party services that may collect and process data under their own policies:

• Google — sign-in, Gmail, Google Calendar, Google Drive, Google Sheets
• Stripe — subscription billing and payment processing
• Meta (Facebook & Instagram) — social media publishing and messaging, when connected
• AI providers — to power assistants and document generation features you enable

When you connect a third-party service, you consent to that service's terms and privacy policy. We process only the data you authorize and only to deliver the feature you connected.

When you sign in with Google or connect your Gmail account, Back To The Grind requests only the scopes needed to deliver the features you enable. The scopes we may request are:

• openid, email, profile — to authenticate your sign-in and identify your account.
• https://www.googleapis.com/auth/gmail.send — to send estimate and invoice emails to your customers on your behalf.
• https://www.googleapis.com/auth/gmail.readonly — to sync your inbox into the app, import supplier quotes, and detect customer replies to messages you sent.

How we use Gmail data:

• Display your inbox and threads inside the app's Email module so you can read and reply without leaving the platform.
• Send estimates, invoices, payment receipts, and follow-up messages to your customers using your "From" address.
• Parse supplier quotes and invoices you receive so pricing can be imported into your materials and financial records.
• Match inbound customer replies to the messages you sent so drafts and reminders can be prepared for your review.

Human reading of your messages: Back To The Grind's staff do not read your email content. Message bodies are processed automatically by software to deliver the features above. A message is surfaced to a person only when you explicitly open it in the app's inbox view, or when you request support and authorize us to inspect a specific message to resolve your issue.

Sharing and transfer: Gmail data is never sold or shared with third parties. It is used solely to provide the features you enabled. It is not transferred outside the platform except to the AI provider that powers assistants and drafting features you turn on, which processes data under its own terms for the sole purpose of generating the content you requested.

Limited Use compliance: Our use of Google user data conforms to Google's Limited Use requirements. Data obtained through the Gmail API is used only to provide or improve user-facing features that are prominent in the app's interface, is not used for serving advertising, and is not disclosed to any third party except as described in this policy.

You can disconnect Gmail at any time from your Account Connections settings, which revokes the app's access to your mailbox going forward.

The application uses browser local storage and session storage to maintain your authentication session, remember your theme and preferences, and improve performance. We do not use advertising cookies or trackers. You can clear stored data at any time through your browser settings, which will sign you out.

• Access & export: View and download your data at any time via the export tools in the app.
• Update: Correct or update your account and business information at any time.
• Disconnect: Revoke any connected integration from your Account Connections settings at any time.
• Delete: Request deletion of your account and associated data by contacting us.
• Opt out: Disable AI assistants, proactive messaging, and autonomous workflows in your settings.

The application is intended for business use and is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above when changes are made. Continued use of the application after any changes constitutes acceptance of the updated policy. We encourage you to review this page periodically.

For any questions or requests regarding this Privacy Policy or your personal data, please contact us at backtothegrind.dev@gmail.com.