Privacy Policy

Effective date: October 24, 2026 · Last updated: October 24, 2026

This policy explains what Zip Takeoff (“Zip Takeoff,” “we,” “us”) collects on ziptakeoff.com (the “Site”) and app.ziptakeoff.com (the “App”), and how we use it.

1. What we collect

• Account information. Name, email address, organization name, and authentication data, handled by our sign-in provider (Clerk).
• Your content. Plan documents you upload and the takeoff data you create (measurements, conditions, pricing, annotations, exports). Processed and stored so the App can function.
• Usage data. Pages visited, features used, device/browser type, and approximate location derived from IP address, collected via cookies and analytics tools on the Site and App.
• Error and diagnostic data. When something breaks, error reports (including browser and request details) are collected so we can fix it.
• Ad click data. If you reach the Site by clicking one of our ads, the ad click identifier and campaign tags in that link (for example, Google’s gclid, Microsoft’s msclkid, and utm parameters) and the page you landed on.
• Payment data. Paid plans are billed through a payment processor; we do not store card numbers.

2. Cookies and tracking technologies

• Essential cookies: sign-in sessions and security (Clerk). The App does not work without these.
• Analytics: product analytics (e.g., PostHog) to understand feature usage, error monitoring (Sentry), and, on the marketing Site, Google Analytics loaded through Google Tag Manager to understand which pages visitors read.
• Session recordings (App only): PostHog records how the App is used, including the sign-up and sign-in screens, so we can find and fix problems. A recording captures page changes, clicks, scrolling, and what was shown on screen at the time, which can include plan sheets and measurements you were viewing. Text typed into form fields is masked and not recorded. Recordings are viewed only by us and processed by PostHog as our service provider. We do not record the marketing Site.
• Advertising pixels (Site only): the Meta (Facebook) Pixel, Google advertising tags (loaded through Google Tag Manager), and the TikTok Pixel may collect identifiers and browsing events on the marketing Site to measure ad performance and build advertising audiences. These providers may combine this data with other data they hold. We do not run advertising pixels inside the App.
• Ad click cookie (Site and App): with your consent, we keep the ad click data described in Section 1 in a first-party cookie for up to 90 days. Both the Site and the App can read it, so we can tell whether an ad visit led to an account. It is deleted if you withdraw consent.
• Conversion reports from the App: if you arrived through one of our ads on Google or Microsoft Bing with that cookie in place, then when you create an account or start a paid plan we send that ad platform (Google Ads or Microsoft Advertising) a report that the ad click led to a signup or purchase. The report contains the ad click identifier, the event and its time, the amount paid for a paid plan, and, where the platform accepts it, a hashed (SHA-256) version of your account email address. Hashing turns the address into a fixed code that the platform compares with its own records to match the report to the ad click, under its terms for advertiser-provided data. Hashed data still relates to you, so we treat it as personal information. We do not send your name, plan documents, takeoff data, or pricing. We send no report if you did not arrive through one of our ads, declined advertising cookies, or had Global Privacy Control turned on.

You can control cookies in your browser settings, and opt out of personalized advertising at the ad platforms (Meta, Google, Microsoft, and TikTok each provide controls). Where required by law, we request consent before setting non-essential cookies, and you can change your choice at any time using “Cookie settings” in the Site footer. We also honor the Global Privacy Control browser signal as an opt-out. To stop conversion reports tied to an existing account, email [email protected].

3. How we use information

• Provide, operate, and secure the Site and App.
• Process uploads into viewable pages, measurements, and exports.
• Improve the Services, including machine learning. We use content and usage data to develop, train, and fine-tune features such as automated plan reading and measurement suggestion. Where practical this uses de-identified or aggregated data. Trained models do not make your documents or pricing available to other customers.
• Respond to support requests and send service communications.
• Measure and improve our marketing, including whether an ad click led to a signup or a paid plan.
• Comply with law and enforce our Terms.

4. How we share information

We do not sell your personal information. We share it only with:

• Service providers that run the product on our behalf: authentication (Clerk), hosting and compute (Railway), content delivery and storage (Cloudflare, including Cloudflare R2), error monitoring (Sentry), product analytics (e.g., PostHog), and payment processing (for paid plans). Each receives only what it needs.
• Advertising platforms (Meta, Google, Microsoft, TikTok) as described in Section 2: browsing events from Site visitors and, for accounts that arrived through a Google or Microsoft Bing ad with consent, signup and purchase reports that may include a hashed email address.
• Your organization: content and activity in a team workspace are visible to that team per its roles.
• Legal: if required by law, or to protect the Services and users.
• Business transfers: if we are acquired or merge, data transfers with the business under this policy’s protections.

5. Retention

Account data is kept while your account is active. Deleted projects and documents enter a 30-day recovery window, then are purged from active systems. Ad click identifiers and campaign tags are deleted from our systems 90 days after they are collected, or sooner if you delete your account. Session recordings are deleted after 30 days. Backups age out on a rolling schedule. De-identified and aggregated data (including data used to train machine-learning features) may be retained after deletion, but is no longer associated with you.

6. Security

Data is encrypted in transit, access is restricted by organization membership and roles, and infrastructure is hosted with providers maintaining industry-standard security programs. No system is perfectly secure; report concerns to [email protected].

7. Your rights

Depending on where you live (including under the California Consumer Privacy Act and the EU/UK GDPR), you may have rights to access, correct, delete, export, or restrict processing of your personal information, and to opt out of targeted advertising. To exercise any of these, email [email protected]. We respond within the timeframe the applicable law requires. We do not discriminate for exercising privacy rights.

8. Children

The Services are for business use by adults. We do not knowingly collect data from anyone under 18.

9. International visitors

We operate from the United States and process data there. If you use the Services from elsewhere, you consent to processing in the United States.

10. Changes

We may update this policy; material changes will be announced through the Services or by email before they take effect.

11. Contact

Zip Takeoff · [email protected]