Privacy policy

What we collect

• Your account: your name and email address, from Google when you sign in. We don't receive your Google password, and we don't access your Gmail, Drive, contacts or calendar. Google also sends a profile photo link; we delete it straight away and show initials instead. If you turn on two-step verification, the key your authenticator app uses is kept by our sign-in provider (Supabase), and your recovery codes only as scrambled fingerprints we can't read back.
• Your organizations: which organizations you belong to, your role in each (Admin, Manager or Member), and when you joined.
• What you and your team add: projects, team lists, plan boards, comments and messages, rounds of work, links you paste, gear records, gear bookings, pack lists, delivery checklists, credits (names and jobs), notes, problem reports, and approval decisions.
• Activity records: who scanned which item and when, who checked gear out or in, and confirmations. If you type a place under “Scanning at” (for example “Studio A”), we keep that text. We never use your phone's GPS or track your location.
• Notifications: the notifications we send you, which kinds you've muted, and, if you turn on phone notifications, the technical address your phone's push service gives us for it.
• Your agreement: which version of these terms you accepted, and when.
• Technical logs: like every website, our hosting and database providers record visitors' IP addresses and browser details in short-lived logs, to keep the service running and secure. We don't use them to track you.

What we don't collect

• No birthdays, home addresses, grades, or photos of people.
• No media files. Videos and photos stay wherever you already keep them (Google Drive, Dropbox, Vimeo, YouTube and so on). We only store the link.
• No payment card details. There are no payments in the app.
• No advertising, no analytics or tracking tools, and no selling or renting of your information.
• No artificial intelligence (AI) services: nothing you add is sent to an AI company or used to train AI.

How we use it

Only to run Rigcall: to sign you in, show you your organizations' projects and gear, record checkouts and scans, send the notifications and reminders you haven't muted, keep the service secure, and fix problems.Rigcall doesn't send email yet; we'll update this page before it does.

Who can see it

• People in your organization: they can see your name, email and role. Admins and Managers also see gear checked out to you, scan history, and the work you add. Projects are visible to their team and to Admins and Managers. Clients (people an organization invites only to review its work) see just the review part of the projects they're added to, and the names, never the emails, of the people on them. Each organization's data is kept separate from every other organization.
• Services that run Rigcall for us, each only for its job:
  • Supabase: database and sign-in (servers in the United States).
  • Vercel: hosting the website.
  • Google: signing you in.
  • Apple, Google, Mozilla or Microsoft: delivering phone notifications to your device, if you turn them on. What they deliver is encrypted.
  • GitHub: storing our encrypted nightly backups.
  • Your calendar app (Google Calendar, Apple Calendar or another), only if you turn on calendar sync in your account: it receives the titles, dates and places of your shoot days, due dates, gear due back and gear bookings through a private link, and checks it regularly. Turning it off stops the link.
  • YouTube or Vimeo: only if you tap “Play here” on a round, the video loads from them, and they receive your IP address and may use their own cookies under their policies. Nothing loads before you tap.
  • YouTube, Vimeo, Google Drive or Dropbox: to warn that a round's link may be private, Rigcall asks the service whether the link opens without signing in. Only the link is sent, nothing about you.
• Anyone we're legally required to share it with, for example under a valid court order.

On your device

We use two cookies, both needed for the app to work: one keeps you signed in, and one remembers the last organization you opened. On your device, the app also keeps your light or dark choice, scan sound setting, recent “Scanning at” places, and copies of pages and pack lists so they open with no signal. Scans made with no signal wait on your device until they can be sent. Signing out clears the copies. There are no advertising or tracking cookies, so there's nothing to opt out of.

Ages, students and schools

You must be 13 or older to use Rigcall. Some organizations, such as school media programs, include students under 18. Each organization decides who it invites and is responsible for any permissions its own rules require (for example from parents or the school). When a school uses Rigcall, we use its members' information only to provide the service to that school, and the school can ask us for a copy or deletion. If you believe someone under 13 is using Rigcall, contact us and we'll delete their account.

How long we keep it

• Your account information: while you have an account.
• Notifications you've read: about 90 days.
• Organization records (projects, gear, history): until the organization deletes them or itself.
• Encrypted backups: 30 days, after which they're deleted automatically.
• Technical logs: kept by our hosting providers for a short time.

Your choices and rights

• Download your data: Account → Download my data gives you a file with everything we hold about you.
• Correct it: change your name under Account. Your email comes from Google.
• Delete it: Account → Delete my account removes your sign-in, name, email and memberships straight away. What you did in an organization (for example a checkout record) stays there for the team as “a former member”. Copies in our encrypted backups disappear within 30 days.
• Notifications: mute any kind, or turn phone notifications off, under Notifications.

Depending on where you live, you may have further rights, such as to object to or restrict how we use your information, or to complain to a data protection authority. We don't sell or share personal information for advertising. For any request, email support@rigcall.app; we answer within 30 days.

Security

Everything travels encrypted (HTTPS). The database itself enforces who can see what, so one organization can never read another's data, and backups are encrypted. No system is perfectly secure; if a breach ever affects your information, we'll tell you and anyone else we're required to.

Changes

If we change this policy, we'll update the date at the top. If the change matters, we'll ask you to agree again the next time you open Rigcall. See also our terms.