Last updated: November 9, 2026
Contractors Pocket Secretary ("the App", shown on your phone as "Contractor Invoices & Expenses") is a time-tracking, scheduling and job-management tool for solo tradespeople. This policy covers the App and its online booking pages on pocketsecretary.io. It explains what data is collected, where it goes, and your choices. It has two audiences: the business owners who use the App, and their customers who book through a booking page.
Account data. The App creates an anonymous account when you first open it; no sign-up is required. You may choose to link a Google account so you can access your work on another device. If you do, the App receives your Google account email address and profile photo, if available, through Google sign-in and Firebase Authentication. If you do not link an account, access to your anonymous account remains tied to this app installation.
Business and job data you enter. To operate, the App stores the information you provide to run your business:
Contacts. When you add or edit a customer, you can tap to fill the form from your phone's contacts. The App asks for contacts permission the first time you do this. You then pick one contact in the system contact picker, and the App reads that contact's name, main phone number, email and address to fill in the empty fields of the form. Nothing is saved until you save the customer. The App does not read, upload or store your contact list, and it never changes your contacts.
Calendar. With your permission, the App uses your phone's calendar in two ways, both optional:
Location data. With your permission, the App can use your current location to place a pin at a job site. If you enable automatic clock-in, the App also uses location in the background, even when the App is closed or not in use, to detect when you arrive at or leave a pinned job site. Android's location services check whether your device enters or leaves a radius of about 150 meters around the pin. An arrival can clock you in automatically; a departure can clock you out if you enabled that option, or prompt you to clock out. The App saves job-site pin coordinates and the resulting time-punch records to your account. It also keeps a limited diagnostic log of geofence events on your device, which you can choose to share with support. We do not save a continuous GPS movement history. You can deny or revoke location permission in your device settings and continue using manual clock-in and clock-out.
Receipt and job photos. Photos you take for receipts or jobs are uploaded to secure cloud storage (Firebase Storage) and linked to the expense or job. Text recognition (reading the amount and merchant off a receipt) runs entirely on your device using Google's ML Kit; the image is not sent to any text-recognition or AI service. ML Kit may send Google basic usage and performance metrics about the feature, not the image or its text.
Notifications. Appointment reminders and clock-in/clock-out prompts are scheduled on your device. If you use online booking, the App also registers your device for push notifications through Firebase Cloud Messaging: a push token, a random ID for this installation, the platform and your language are stored with your account. When a customer books, moves or cancels, our server sends a push to your device with the customer's name and the appointment's day and half-day. You can turn notifications off in your device settings.
Texts and sharing. When you text a customer or share an invoice, the App opens your phone's own messaging or share app with the message or file ready. You send it yourself; the App does not send texts or emails on your behalf.
A business using the App can turn on a public booking page (pocketsecretary.io/book/<name>). The page shows the business's name, phone number, working hours and which mornings and afternoons are open.
What you provide when you book. Your name, phone number, address, email (optional), what needs doing, whether you'll be home, the day and half-day you pick, and your language. This is stored in that business's account in Cloud Firestore as a customer record and an appointment, the business sees it in the App, and the business's phone gets a push notification with your name and the appointment time. The business may add to the record (for example a specific time or notes) and may contact you using the details you gave.
Your private link. After booking you get a private link (pocketsecretary.io/b/…) where you can see your appointment's date and time, type and address, and move or cancel it. Anyone who has the link can do the same, so keep it private. Moves and cancellations are recorded on the appointment and sent to the business as a push notification.
Bot protection and hosting. The booking form uses Cloudflare Turnstile to block automated bookings. Your browser interacts with Cloudflare to complete the check, and our server sends Cloudflare the resulting token and your IP address to verify it. The booking pages are hosted on Cloudflare Pages and load fonts from Google Fonts, so Cloudflare and Google receive your IP address and browser information as part of serving them. Bookings are processed by our server on Google Cloud (Cloud Functions), whose standard request logs may include your IP address; our own logs record the business and the action taken, not your details. The page remembers your language choice in your browser's local storage. We use no advertising or analytics cookies.
Who controls your booking data. The business you booked with decides how your information is used and kept. To correct or delete it, contact the business (its phone number is on the booking page), or email us at the address below and we will pass the request on or act on it.
Data is used solely to provide the App's functionality: tracking time, jobs, customers, appointments, expenses and invoices; running booking pages and notifying the business about bookings; and generating documents (like invoices) from that data. We do not use your data for advertising, and we do not sell or share your data with third parties for marketing purposes.
The App and booking pages use the following services to operate. We do not use any bank-linking, analytics, advertising, or crash-reporting services.
The Google services are governed by the Google Privacy Policy. These providers act as our service providers and process data to run their services for us.
All data, including location, business, customer and financial data described above, is encrypted in transit (TLS) and at rest, using Google Cloud's and Firebase's standard encryption for Firestore, Authentication, and Cloud Storage. Access to each business's records is restricted to that business's account.
Your data is retained as long as you use the App. You can delete customers, appointments, jobs and expenses in the App at any time. If you have not linked a Google account, deleting the App from your device can remove your access to the anonymous account. Your records remain in our cloud storage until you request deletion. If you linked a Google account, you can sign back in to access your saved work. Calendar events the App copied stay in your calendar until you or the App remove them. Push registrations are removed when the device stops accepting notifications.
Customer records and appointments created through a booking page are kept in the business's account until the business deletes them or asks us to delete its account.
To request deletion: Email datadelete@pocketsecretary.io from any address and include the Support ID shown under Settings → Support in the App (preferred), or your business name and phone number as entered in the App's Company profile, so we can locate your record. We will delete your Company record and all associated Customers, Appointments, Jobs, Punches, Expenses, Invoices, photos and booking settings within 30 days of a verified request, and confirm by email once complete. If you booked with a business and want your details removed, email the same address with the business's name and the phone number you booked with.
The App and booking pages are intended for adults and are not directed at children. We do not knowingly collect data from anyone under 13.
We may update this policy as the App's features change. We'll update the "Last updated" date above when we do.
Questions about this policy or data requests: secretary@pocketsecretary.io
Home · Terms of Service · Support · FAQ