Privacy Policy

Keystone · Last updated October 20, 2026

Keystone is business-management software for contractors and other service companies ("Keystone", "we", "us"). This policy explains what we collect, why, and the choices you have.

What we collect

  • Account details: your email address and password (stored by our sign-in provider, never in plain text), and the optional name, phone number and ZIP code you add.
  • Business records you enter: your company profile and logo, clients and their contact details, estimates, line items, signatures, jobs, schedules, crew assignments and pay, time clock entries, expenses, receipts, job photos, invoices and payments.
  • Information from connected services: if you connect Stripe, we store your Stripe account ID and invoice and payment records; card and bank details are handled by Stripe and never reach us.
  • Technical data: sign-in cookies, and basic server logs (such as IP address and pages requested) used to keep the service secure and working.

How we use it

Only to provide and improve Keystone: to show your records to the people on your team, send estimates, invoices and reminder emails you set up, process subscription billing, keep accounts secure, and answer support requests. We don't sell personal information or use it for advertising.

Who can see your data

Each company's records are kept separate and are visible only to that company's team. Admins see everything in their company; crew see only the jobs assigned to them and their own pay. Your clients see only the estimates and invoices you send them.

We share data with the service providers that run Keystone, only as needed: Supabase (database and sign-in), Render (hosting), Stripe (payments and subscriptions) and Resend (email delivery). We may disclose information if the law requires it.

Keeping and deleting data

We keep your records while your company uses Keystone. You can delete your account yourself at any time in the app (Account, then Delete account), and an admin can delete their company and all of its records (Company profile, then Delete company). Deletion takes effect right away; copies in our backups are erased within 30 days. You can also email us to ask for deletion or a copy of your data. We keep only what the law requires, such as billing records. See how to delete your data.

Security

Data is sent over encrypted connections, access is limited by company and role in the database itself, and connection tokens can be read only by the Keystone server. No system is perfectly secure, so please use a strong, unique password.

Children

Keystone is for businesses and isn't meant for anyone under 18.

Changes

If we change this policy, we'll update the date above and, for significant changes, tell account admins by email or in the app.

Contact

Questions or requests: [email protected].

Privacy · Terms · Support · Delete your data