Privacy Policy

Effective 10 June 2026 · Controller: SPJ Set Building LTD, United Kingdom

This policy explains what Cutlist collects, why, and how we handle your data. It applies to the Cutlist iOS, Android, and web apps and the API at spjsetbuilding.org.

1. Data we collect

• Account — email address, bcrypt-hashed password, display name, measurement preference (mm vs inches).
• Project data you create — projects, materials, sheet sizes, and the dimensions / specs you enter for cut lists.
• Subscription state — whether you hold a premium entitlement and when it expires. We do not store card numbers or any other payment details; those are held by Apple, Google, or RevenueCat depending on platform.
• Server logs — IP address, request path, and timestamps for at most 14 days, for abuse prevention and debugging. Not joined to your account.

2. Why we collect it

• To provide the service you signed up for (your projects).
• To authenticate you across devices and keep your data in sync.
• To honour your premium subscription if you have one.
• To respond if you email us.

3. Processors we use

We share the minimum data necessary with the following processors, bound by their own privacy and security commitments:

• Fly.io — application hosting and PostgreSQL. Receives your account and project data so we can serve it.
• Mailpace — transactional email (password reset, magic link). Receives your email address only at the time of sending.
• RevenueCat — subscription management. Receives a stable per-account identifier so subscription state can be synchronised across your devices.
• Apple App Store / Google Play — payment processing. We never see card numbers; they tell us only whether a purchase succeeded.

4. What we don't do

• No third-party analytics or tracking pixels.
• No advertising. We have no ad partners.
• No selling, renting, or sharing of personal data with anyone outside the processors listed above.

5. Your rights

Under UK GDPR you can request a copy of your data, ask us to correct it, or ask us to delete it. To do any of these, email hello@spjsetbuilding.org from the address on your account. We respond within 30 days.

6. Deleting your account

You can delete your account from inside the app (Settings → Account → Delete account) or by emailing us. Deletion removes your projects, materials, sheets, name, and email immediately. Active sessions are revoked. Server logs containing the IP that made requests roll out within 14 days as part of normal log rotation.

7. Children

Cutlist isn't directed at children under 13 and we don't knowingly collect data from them. If you believe a child has signed up, email us and we'll delete the account.

8. Changes to this policy

If we change anything material, we'll notify you by email and update the "effective" date at the top of this page.

Questions? Email hello@spjsetbuilding.org.