Privacy Policy

1. Who we are

schedule.construction is operated by AOS Construction Software LLC, a Wyoming limited liability company (“AOS,” “we,” “us,” or “our”). This policy covers this website, the app at app.schedule.construction, the sandbox, share links, our API, and our iOS app when it is available.

Our customers are construction companies and other organizations. The projects and schedules they put into the app are their content: we process it on their behalf and under their instructions. If you are a member of a customer organization, that organization decides who can see its content, and you can direct requests about it to the organization as well as to us.

2. What we collect

• Account details: your name, email address, organization name, and password (stored only as a one-way hash), plus preferences such as your display theme and notification settings. If you sign in with single sign-on, your organization’s identity provider sends us an account identifier, your email, your name, and whether your email is verified.
• Organization and membership: members, roles, invitations (the invited email address), and a log of membership changes.
• Customer content: projects, schedules, activities, dates, costs, budgets, expenses, vendor and client names, notes, comments, risk and issue logs, work plans, planning-board notes, site locations (coordinates you enter for a project site), company logos, and a history of schedule changes with who made them.
• Access and activity records: share links and API tokens (name, creator, permissions, expiry, and when a token was last used), in-app notifications, and a log of changes made through the app showing the account, organization, and request involved.
• iOS app: a name for your device, a device sign-in token (stored on our side only as a hash), and, if you allow notifications, an Apple push token.
• Distribution lists: names and email addresses of people an organization chooses to receive emailed schedule reports. These people may not have accounts.
• Imported files: schedule files you upload (such as .xer, .xml, .mpp, .xlsx, or .csv) are read to create your schedule. The file itself is not kept; the resulting schedule is. Microsoft Project (.mpp) files are held on our servers only until the import finishes or fails, then deleted.
• Billing: Stripe collects your payment details. We never receive or store full card numbers. We give Stripe your organization name and the owner’s email to set up billing. We receive and keep records of billing events from Stripe, which can include billing contact name, email, address, tax ID, invoice amounts, and subscription status, along with the billing notices we email you.
• Diagnostics: when something goes wrong on our servers, an error report that includes your account ID, email, name, IP address, browser, the request involved (including data submitted with it), and related log messages. We also record timing data for a sample of requests to measure performance.
• Browser diagnostics: errors in the app in your browser are reported without your name, email, or account ID. For a sample of app sessions (about 1 in 10) and for sessions where an error occurs, we record a session replay showing page structure, clicks, and navigation. Replays hide all text and form input and block images and media.
• Security data: your IP address, used to rate-limit sign-up, password-reset, and sandbox requests, and, with the email you enter, to slow down repeated failed sign-ins. Our hosting and network providers also record IP addresses in their standard traffic logs.
• Sales and support: when you sign up, we record your email, name, and organization; when you request sandbox access, we record your email. We keep these and our notes about our conversations with you so we can follow up about your trial and support your account. We also keep emails you send us.
• Prospects: to find construction companies that may want the Service, we get business contact details from Apollo.io, a sales data provider: name, job title, company, work email address, and business details such as company size and the software it uses. We use them to send a small number of business emails about the Service, and we keep them with our notes and any replies.

This website (schedule.construction) has no forms or advertising trackers, and loads its fonts from our own server. It uses Umami to count page views without cookies: for each visit Umami records the page, the referring site, any campaign tags in the link, your country, region, and city, your browser, operating system, device type, screen size, and language. To count unique visitors it combines your IP address and browser details into an identifier that changes every month, and it does not store your IP address. We see only totals, never individual visitors. The app does not use Umami.

3. How we use it

• to provide, maintain, and support the Service, including scheduling calculations, sharing, exports, offline sync, and emailed reports;
• to create and secure accounts, verify email addresses, and prevent fraud and abuse;
• to bill subscriptions, calculate taxes, and send billing and account notices;
• to diagnose errors and improve reliability and performance, including when a small number of AOS staff look at an organization’s data to provide support you ask for or to investigate a problem;
• to follow up about trials and respond to your requests;
• to email businesses that may be interested in the Service; and
• to comply with law and enforce our Terms.

We do not sell personal information, share it for cross-context behavioral advertising, or use customer content to train AI models.

4. Who we share it with

We share information only with service providers that help us run the Service and our business:

• Render hosts this website and the app, database, and background workers in the United States (Oregon).
• Cloudflare carries traffic to the app and stores company logos.
• Stripe processes payments, billing, and sales tax.
• SendGrid (Twilio) delivers our email, including the recipient, subject, message, and any attached report.
• Umami (Umami Software, Inc.) counts page views on this website as described above, on servers in the United States.
• Sentry receives the error reports and session replays described above.
• Apollo.io provides prospect contact details and sends our business emails to prospects; it receives the contacts we email, our messages, and their replies.
• Anthropic receives project details and draft text only when you use AI-assisted drafting, such as preparing an owner delay notice. Anthropic processes it to return the draft and, under its commercial terms, does not use it to train its models.
• OpenWeather receives a project’s site coordinates when weather features are used for that project. No personal information is sent.
• Apple delivers push notifications to the iOS app and receives your device’s push token and the notification text.

We also share information:

• with integrations your organization sets up, such as a project management bridge address or an API token, which receive the data they are configured for;
• when required by law, or to protect the rights, safety, or security of our users, the public, or AOS; and
• with a buyer or successor if AOS is involved in a merger, acquisition, or sale of assets, subject to this policy.

5. What others can see

• Members of your organization can see your name, email, and role, the comments you write, and the schedule changes you make.
• People viewing the same project at the same time see your name (or email, if no name is set).
• Anyone with a share link can view that project without signing in, including its vendors, notes, client and site details (including the site location), budget, and costs, and can download its printable PDFs. Organizations control who gets share links and can revoke them.
• Company logos are served at public addresses so they can appear on share views and exports.

6. Cookies and device storage

• The app sets one cookie: a session cookie that keeps you signed in and protects forms against forgery. It is essential and ends when you close your browser. We do not use advertising or analytics cookies.
• To work offline, the app stores your account details, your organizations, cached schedules, and edits waiting to sync in your browser’s storage on your device. Signing out clears it, including any edits that have not synced yet. The app also remembers your recently opened projects and dismissed tips, and our diagnostics tool keeps a session identifier in your browser while the tab is open.
• The iOS app keeps its sign-in token in the device’s secure keychain and caches schedules on the device so it can work offline.
• This website sets no cookies of its own, and its analytics uses no cookies or device storage. Our network provider may set a strictly necessary security cookie to filter malicious traffic.

7. Email

We send email you need to use the Service: email verification, password resets, invitations, billing and trial notices, drafts you ask the app to email to you, and reports or digests that you or your organization set up. You can turn off the weekly digest in your notification settings. If you receive schedule reports from an organization’s distribution list, ask that organization or email us to be removed.

We also send a small number of business emails about the Service to people at construction companies, using contact details described in section 2. These are not sent to your account address because you use the Service. To stop them, reply to the message or email [email protected], and we will not email you about the Service again.

8. Retention

• Account and organization data is kept while your account is active. After a trial ends or a subscription is cancelled, the organization stays available read-only and its data is kept until you ask us to delete it. We will give owners at least 30 days’ notice before deleting an inactive organization.
• When we receive a verified deletion request, we delete the data within 30 days, except records we must keep for tax, accounting, or legal reasons, and backup copies, which are removed as they expire.
• Invitations expire after 14 days, verification links after 48 hours, and password reset links after 2 hours. Rate-limit records last about an hour, and failed sign-in records about 15 minutes.
• Billing records are kept as long as we need them for tax and accounting.
• Website page-view totals are kept in Umami while we use it.
• Error reports and session replays are kept for a limited period set in our account with Sentry.

9. Security

All traffic to the app is encrypted with HTTPS. Passwords are stored as salted one-way hashes. Each organization’s data is separated by access checks in the app and by row-level security in the database. Changing or resetting a password signs out your other sessions and devices, and repeated failed sign-ins are temporarily blocked. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security. Report suspected issues to [email protected].

10. Your choices and rights

You can ask to access, correct, or delete your personal information, or to get a copy of it, by emailing [email protected]. Each project can also be exported from the app at any time. We will verify your request, usually by confirming it from the email on your account, and respond within 45 days.

Depending on where you live, for example California, you may have additional rights under state privacy law, including the right to know what we collect and to opt out of sales or targeted advertising. We do neither. We will not treat you differently for exercising your rights. An authorized agent may make a request for you with your written permission. Because we do not sell or share personal information for advertising, there is nothing to opt out of, including through a Global Privacy Control signal.

If your information is part of an organization’s customer content, we may refer your request to that organization and help it respond.

11. Children and location

The Service is for business use by adults and is not directed to anyone under 18. We do not knowingly collect information from children. The Service is intended for organizations in the United States, and we store and process information in the United States.

12. Changes to this policy

We will post updates here with a new effective date. For material changes, we will notify organization owners by email or in the app before the changes take effect.