Plainspoken — not legalese. A small HVAC+R shop owner should be able to read this twice and know exactly where their data sits, who can see it, and how to ask us to take it out.
Last updated . When this page changes materially, the date moves and the archive is the page history.
We do not buy lists, scrape public sources, or pull third-party data into your shop record. The only data we hold is what someone typed into a Frostledger form.
Some addresses were captured before the self-serve launch through the former waitlist flow. That intake is no longer active, and these historical records are not used for a new campaign or automated sequence. They are retained only as described below and are not forwarded to a marketing tool.
Earlier request-access submissions contain the name, work email, company, technician count, an optional tier suggestion, and any notes that were typed. The public request path is no longer active. Existing records remain available for administrative history for the retention period below and are never added to a marketing list.
When you create a Frostledger account through the self-serve signup path, we hold an email-addressed user record with optional name and avatar, plus the inspection rows and refrigerant recovery rows you create. Account authentication runs through the better-auth module — your password is stored only as a one-way hash, never as plaintext. Inspection and recovery rows are tied to your user and are not visible to any other account on the platform.
Production data lives in a managed Postgres instance on the Polsia platform. The application reaches it over SSL — connections in transit are encrypted end to end.
Every query the application issues against the database is parameterized. There is no string-concatenated user input anywhere in the read or write paths, so injection is structurally impossible.
Inspection and recovery rows are owned by the user who created them. Reads and writes are scoped with a where: { userId: user.id } clause — no other customer can ever see your rows, and there is no shared "tenant" surface that crosses shops.
Database backups are managed by the platform; they live in the same managed-Postgres perimeter. We do not export customer data to an external warehouse or to a third-party backup system.
We do not sell your data. We do not share it with advertisers. We do not upload it to a marketing automation platform, and there is no retargeting pixel on this site. The PDF inspection reports and refrigerant recovery records you generate belong to you — they are produced in your browser, downloaded to your machine, and never indexed by us.
The only thing the production app emits to a third party is a single platform-side visitor beacon: a page-view counter that records a visitor hit without anything user-level attached. It is not Google Analytics, it is not an ad network, and it cannot identify a signed-in account from a public visitor.
Government disclosure goes only where the law requires it. If we are ever compelled to share a record, we will tell you what was shared and why, unless that notice is itself legally restricted.
A small cookie records whether you have chosen light or dark mode so the choice persists between visits. It carries no identifying data; removing it just resets the theme to system default.
When you sign in, the authentication module issues a session cookie to keep you signed in. Without it, you would have to enter your email and password on every page. There is exactly one such cookie and it is bound to your account — no third party can read or set it.
No third-party cookies. No cross-site tracking. The shipped browser Permissions-Policy header keeps browsing-topics=() disabled at the platform layer — see src/lib/permissions-policy.ts.
Historical records are kept until you ask to be removed, or for as long as the product team needs to maintain the former acquisition archive. Removal is a manual email to the contact below — no automation and no sequence.
Historical submissions are kept for the duration of the former pilot conversation plus a reasonable record-retention window afterwards, so we can answer follow-up questions about scope, tier, or pricing without re-asking for context.
Kept as long as your account is active. Deleting a single row is available today; closing the account (and removing every row tied to it) is a manual email to the contact below. We confirm in writing when the deletion has run.
Not retained by us. A PDF is generated in your browser and downloaded to your machine. We do not store copies of generated PDFs on our side — once it is in your hands, it is in your hands.
The retired pilot and waitlist flows do not accept new submissions. To ask us to remove an existing lead record, write to the contact below and a person will process the request by hand.
If something material changes — a new data category, a new shared processor, a retention rule — we update this page and bump the "last updated" line. Old revisions remain in the page history.
Questions about privacy? Write to frostledger@polsia.app.