SiteList Privacy Policy

Last updated: October 26, 2026

1. Overview

This Privacy Policy describes how SiteList (“SiteList,” “we,” “us,” or “our”) handles information in connection with the SiteList mobile application (the “App”), our websites — including our landing page and the hosted report pages created through the App (the “Site”) — and related services (together, the “Service”).

SiteList is built to be private by default: your reports, photos, and videos are stored on your device; the App requires no account; nothing you create is uploaded to our servers until you explicitly create a share link; we show no ads; and we do not sell personal information or use third-party advertising or tracking.

The short version:

2. Information stored on your device (not sent to us)

The following stays on your device and is not transmitted to SiteList unless you include it in a share link (Section 3):

Device permissions. The App asks for access to your camera and microphone (to capture photos and video) and to your photo library (so you can attach existing photos to issues and set report cover photos). If you turn on location stamping in Settings, the App also asks for permission to use your location while you are using the App. You can decline any permission in your device settings, though the related features will not work.

Location stamps. Location stamping is off unless you turn it on. When it is on, each new photo or video is stamped with where it was taken. To turn the coordinates into a short address, the App uses your device’s built-in geocoding service, provided by Apple on iPhone and by Google on Android under their own privacy policies; SiteList’s servers never receive your location. The stamp text is stored with the photo on your device and is included when you share, export, or upload that photo.

Address autocomplete. Address suggestions are generated on your device from addresses you have previously entered in the App. Typing an address does not send it to any mapping or autocomplete provider.

Device backups. Your device’s operating system includes App data in device-level backups you control (such as iCloud or Google backup). Those backups are governed by Apple’s or Google’s terms, not ours.

3. Information we receive when you share a report

Creating a share link uploads the content you selected to our servers so that we can host the shared page. That can include: the selected photos and videos (with annotations and any time or location stamps), issue titles, descriptions, locations, and priorities, the report title and property address, your company name and logo if shown, and the label you give the share version. If you set a password on a link, we store it in hashed form — a cryptographic fingerprint used to check the password, not the password itself.

Share-page access logs. Like most web infrastructure, our servers record basic technical information when someone opens the Site or a shared page — such as IP address, browser type, the page requested, and a timestamp. We use these logs for security, abuse prevention, and keeping the Service running; we do not use them to build advertising or tracking profiles. Logs are kept for a short period — no more than 30 days — and then deleted or aggregated. Our Site and shared pages are served by Cloudflare, and shared report content is stored with Supabase; both act as our service providers (Section 9).

Revoking a link. Revoked links stop working immediately, and the uploaded media is removed from our servers. Copies may persist briefly in routine encrypted backups for up to 30 days before being overwritten. Version records — what was included in each share — remain in the App on your device.

Link expiry. Every share link expires automatically 90 days after it is created; the expiry date is shown on the shared page. When a link expires, or when you delete a share version in the App, the hosted content is removed from our servers in the same way as for a revoked link. You can create a new link at any time.

Translation of shared pages. When a viewer opens a shared page in a language other than the one the report was written in, the report’s own text — the report title, the “prepared for” name, and the issue titles, locations, and descriptions — is translated by a machine-translation model running on Cloudflare’s infrastructure (Workers AI), and the translation is stored with the share so it is not generated again. Photos, videos, addresses, dates, and stamps are not sent to the model. Cloudflare processes this text only as our service provider.

4. Information you give us directly

Waitlist. If you join the waitlist on our landing page, we collect your email address and use it to tell you when SiteList launches and to send related product updates. You can unsubscribe at any time using the link in any email or by contacting us. Waitlist addresses are stored in our hosting infrastructure (Cloudflare).

Support. If you contact us, we receive your email address and the contents of your message, and we use them to respond and to keep records of support history.

5. Purchases

SiteList Pro is purchased through the Apple App Store or Google Play. Apple or Google processes the payment under its own privacy policy and shares with us, at most, non-card transaction data needed to activate and support your purchase (for example, confirmation that a purchase is valid). We use RevenueCat, a purchase-infrastructure service, to validate purchases and manage what your purchase unlocks; it receives purchase receipt data and an anonymous app-generated identifier — not your name or payment card details. We never receive your full payment card details.

6. Crash reports and App updates

Crash reports. If the App crashes or hits an internal error, it sends a crash report to Sentry, a crash-reporting service we use as a service provider. A report contains the technical location of the failure in the App’s code, the device model, operating-system version and App version, a short technical trail of what the App was doing just before the failure (not the contents of your reports), and a random installation identifier that lets us tell whether one device or many are affected. We configure the service not to collect personal information: reports never include your reports, photos, videos, addresses, names, or share links, and the identifier is not connected to you, your purchases, or your shares. Crash reports are deleted after 90 days.

App updates. When the App starts, it asks Expo’s update service (EAS Update, operated by Expo, Inc. as our service provider) whether a newer version of the App’s code is available and downloads it in the background for the next launch. That request carries the App’s version and platform and a random installation identifier; it does not include any of your content.

7. What we do not do

8. How we use information

We use the information described above to: provide and operate the Service (hosting the shared pages you create, enforcing link passwords, honoring revocations and expiry, and translating shared pages when a viewer asks for another language); keep the App working (diagnosing crashes and delivering updates); notify the waitlist about launch and product updates; respond to support requests; secure the Service and prevent abuse; comply with legal obligations; and understand usage in aggregate, non-identifying terms.

9. When information is disclosed

We do not disclose personal information to third parties for their own advertising or marketing.

10. Retention and deletion

11. Security

We protect information in transit with encryption (HTTPS) and limit access to our infrastructure. Optional link passwords add another layer for shared pages. No method of transmission or storage is completely secure, so please secure your device, choose strong link passwords, and give links and passwords only to the people you intend.

12. Your privacy rights

Most SiteList data never leaves your device, so you can view, correct, or delete it directly in the App at any time. For the information we do hold — hosted shares, waitlist emails, support correspondence — you can contact us at support@sitelistapp.com to exercise the rights below. We may need to verify your request, for example by confirming you control the email address or share link involved.

United States. Depending on your state of residence (including under the California Consumer Privacy Act and the comprehensive privacy laws of a growing number of other states), you may have rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of “sales,” “sharing,” and targeted advertising. SiteList does not sell personal information or process it for targeted advertising. We will not discriminate against you for exercising your rights, and where state law allows, an authorized agent may submit a request for you. If we decline a request, you may have the right to appeal by replying to our decision.

European Economic Area and United Kingdom. If the GDPR or UK GDPR applies to you, our legal bases are: performance of a contract (operating the App and hosting the shares you create), legitimate interests (securing and operating the Service, and diagnosing crashes), and consent (the waitlist, which you can withdraw at any time by unsubscribing). You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your local supervisory authority.

We do not use personal information for automated decision-making that produces legal or similarly significant effects.

13. If you appear in someone else’s report

SiteList users capture photos and video at real properties, so a report may include images of you, your voice, or your belongings — for example, if you live or work at a documented property. The SiteList user who created the report decides what is captured and shared and is responsible for having the right to do so; if you have concerns about a report, the fastest path is usually to contact the person who shared it with you. If content about you is hosted on an active SiteList share link and you believe it is unlawful or should be removed, contact us at support@sitelistapp.com with the link, and we will review and, where appropriate, remove hosted content.

14. Children

The Service is not directed to children under 13 (or the higher minimum age your local law sets), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

15. Where information is processed

SiteList operates from Puerto Rico, United States. Our service providers (Cloudflare, Supabase, Sentry, Expo, and RevenueCat) process and store service data primarily in the United States; Cloudflare operates a global network that may serve content from locations near viewers. If you use the Service from outside the United States, the information described in this policy is processed in the United States, and where the law requires, we rely on appropriate safeguards for those transfers.

16. Deleting your data

17. Changes to this policy

We may update this policy as the Service evolves. We will post the updated version with a new “Last updated” date, and for material changes we will provide reasonable, prominent notice — for example, in the App or on the Site.

18. Contact

Privacy questions and requests: support@sitelistapp.com