Privacy Policy
Shimwise is built to collect as little as possible. Most of what you make in the app stays on your iPhone. This policy explains the parts that don’t.
1. Who we are
Shimwise is an iPhone app that helps tradespeople (“contractors” or “you”) build quotes and send them to their customers. It is operated by Derek Zak (“Shimwise”, “we”, “us”), 50 Legacy Woods Circle SE, Calgary, AB T2X 4M2.
For information about contractors who use the app, we decide how it’s handled. For information about a contractor’s customers, the contractor is the business the customer is dealing with, and we handle that information on the contractor’s behalf to deliver the quote, signature and payment flow.
2. The short version
- No accounts, passwords or email address are needed to start.
- Recordings, transcripts and room scans stay on your iPhone and never reach our servers.
- We only receive a quote when you send it, because your customer needs a link to open.
- There are no ad, analytics or tracking tools in the app or on this website. We don’t sell or share personal information for advertising.
- Card and bank details are entered on Stripe’s pages. We never see or store them.
- You can export all of your data at any time, including after you cancel.
3. What stays on your iPhone
Your business details, price book, clients, drafts, photos, invoices and settings are stored on your iPhone. If you use iCloud, the app syncs them through your own private iCloud database, which Apple operates under its own privacy policy and which we cannot read.
These never leave your iPhone for our servers:
- Voice recordings and transcripts. Dictation is converted to text on the device.
- Room scans. LiDAR scans and their 3D geometry stay on the device. Only the resulting line items and totals appear on a quote you send.
- Drafts and quotes you haven’t sent.
Two exceptions involve Apple, not us, and you control both:
- If your iPhone has no on-device speech model for your language, the app asks before using Apple’s speech recognition service. Recordings sent that way go to Apple under Apple’s privacy policy. If you say no, they stay queued on your phone.
- On devices with Apple Intelligence, the app may use Apple’s on-device model, or Apple’s Private Cloud Compute for very long walkthroughs, to help structure what you said. Apple designs Private Cloud Compute so that the data isn’t stored or made accessible to Apple.
4. What reaches our servers
| Information | When and why |
|---|---|
| Published quote snapshot: the quote PDF, line items, options, totals, terms, photos you chose to include, your business details as printed on the quote (name, logo, phone, email, licence numbers), and your customer’s name, phone, email and the job address | When you send a quote, so your customer can open it from a link and so the signed contract can be produced. |
| Signed contracts (PDF) with the notice of cancellation and audit certificate | When your customer signs, to prove what was signed and deliver copies to both of you. |
| Signature audit trail: the phone or email the link was sent to, timestamps of first view, consent and signature, the customer’s IP address and browser user agent, the typed name, the consent version, the chosen option and a fingerprint (SHA-256 hash) of the document | When your customer views, consents and signs, because electronic signature laws require proof of who signed what and when. |
| Quote events (viewed, accepted, paid, cancellation requested) and cancellation requests | To notify you and to keep the contract record accurate. |
| A pseudonymous install identifier and a count of quotes you’ve sent | To run the free tier (first 5 sends free). This uses Apple’s App Attest and DeviceCheck services and a record in your private iCloud database; it does not identify you by name. |
| Push notification token | To tell you when a quote is viewed, accepted or paid. Tokens Apple reports as invalid are deleted. |
| Subscription status from the App Store: the product, expiry date, environment and Apple’s original transaction ID | To confirm Shimwise Pro. We never receive your payment card or Apple Account details. |
| Your Stripe connected account ID and whether it can accept payments | To create deposit and invoice payments in your own Stripe account. |
| Business name, email and country | Sent with your first published quote, to label your account and send you signed copies. |
| Emails you send to support | To answer you. |
5. Information about customers
If you received a quote link from a contractor, the contractor gave us your name and contact details and the job address to deliver that quote. When you use the link, we also record the signature audit trail described above, and if you pay a deposit, Stripe processes your payment for the contractor. We use your information only to show you the quote, record your consent and signature, send you your signed copy and receipts, and handle cancellation requests. We don’t market to you and we don’t sell your information.
Your contract is with the contractor. For questions about the job or to exercise privacy rights, you can contact the contractor or us; we’ll work with the contractor to respond. See Information for customers.
6. How we use information
- To host the quote page, record consent and signatures, produce and deliver signed contracts, and process cancellation requests.
- To send push notifications and email receipts.
- To provide the free tier and Shimwise Pro, and prevent abuse of them.
- To answer support requests and keep the service secure.
- To meet legal obligations, such as keeping signed contract records.
We don’t use your information for advertising, we don’t build profiles, and we don’t use quotes or customer information to train AI models.
7. Service providers
We use a small number of providers who process data for us under contract:
| Provider | What it does |
|---|---|
| Cloudflare, Inc. | Hosts the quote pages and our server, database and file storage (Workers, D1, R2). |
| Stripe, Inc. and its affiliates | Processes customer payments in the contractor’s own Stripe account, under the contractor’s agreement with Stripe and Stripe’s privacy policy. Stripe handles all card and bank details. |
| Apple Inc. | Delivers push notifications (APNs), sells and manages subscriptions (App Store), provides App Attest and DeviceCheck, and stores your iCloud data. |
| Resend (once email is enabled) | Sends signed contracts, receipts and notices by email. |
These providers may store data in the United States and other countries. If you are in Canada, your information may be processed outside Canada and may be accessible to authorities there under local law.
We may disclose information if required by law, to protect people’s rights or safety, or as part of a sale or reorganization of our business, in which case this policy continues to apply.
8. How long we keep it
- Signed contracts, notices and their audit trails: at least 7 years after signing, because they may be needed to prove a contract or a cancellation.
- Quotes that were never signed: deleted from our servers, with their PDFs and history, 90 days after they expire.
- Push tokens: until Apple reports them invalid or you delete the app.
- Subscription status: while you use the app, plus the time needed for accounting and tax records.
- Support emails: up to 2 years after the conversation ends.
- If you ask us to delete your data: we delete it within 30 days, except signed contracts and their audit trails, which we keep for the period above because the law may require them.
Data on your iPhone and in your iCloud stays until you delete it.
9. Your rights
Depending on where you live, you may have the right to ask for access to the personal information we hold about you, to correct it, to delete it, to receive a copy in a portable format, or to withdraw consent. To make a request, email zak.support12@gmail.com. We’ll verify the request and answer within 30 days. We won’t treat you differently for using these rights.
Some records can’t be deleted on request while the law requires us or the contractor to keep them, such as a signed contract and its audit trail. In that case we’ll tell you and keep only what is required.
Contractors can export all their data from the app at any time, as CSV and PDFs.
10. Canada
We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Alberta’s and British Columbia’s Personal Information Protection Acts. Our privacy officer can be reached at zak.support12@gmail.com. If you aren’t satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.
Shimwise is not yet offered in Quebec.
11. US state privacy laws
Residents of California and other states with consumer privacy laws (such as Colorado, Connecticut, Virginia and others) have the rights described in section 9. In the past 12 months we have collected the categories of information described in section 4: identifiers and contact details, commercial information (quotes, contracts and payment status), and internet activity limited to the IP address and user agent recorded at signing. We collect them for the purposes in section 6 and disclose them only to the providers in section 7.
We do not sell personal information, share it for cross-context behavioral advertising, or use sensitive personal information for purposes that would require an opt-out. You may use an authorized agent to make a request. If we deny a request, you may appeal by replying to our answer.
12. Security
Data is encrypted in transit. Quote links use long random tokens, and signing links are single use. Signed PDFs are fingerprinted so changes can be detected. No system is perfectly secure; if a breach affects your information, we’ll notify you and the authorities as the law requires.
13. Children
Shimwise is a business tool and is not intended for children. We don’t knowingly collect information from anyone under 16.
14. This website
This website uses no cookies, analytics, ads or third-party scripts. Our hosting provider processes standard request data such as IP addresses to deliver pages and protect against abuse.
15. Changes
If we change this policy in a way that matters, we’ll update the date above and tell you in the app before the change takes effect.
16. Contact
Derek Zak
50 Legacy Woods Circle SE, Calgary, AB T2X 4M2
zak.support12@gmail.com