Privacy Policy

1. Introduction

Welcome to FortSort ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our inventory management service.

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the application.

2. Information We Collect

Personal Information: We collect personal information that you voluntarily provide to us when you register for the service, express interest in obtaining information about us or our products and services, or otherwise contact us. This information may include:

• Name and email address
• Billing information, including payment card details, billing address, and phone number (collected by our payment processor, Stripe, Inc. on our behalf — we do not store raw card numbers on our servers)
• Account credentials (passwords are stored as irreversible hashes — we never store your plaintext password)
• User content, such as inventory data, item images, task details, organization names, and other content you upload to the service

Automatically Collected Information: When you use our service, we automatically collect certain information through your mobile device or web browser. This may include:

• Device identifiers: device model, manufacturer, operating system version, and browser type
• Google Advertising ID (GAID) / advertising identifier: on mobile devices, an advertising identifier may be collected by our advertising SDK (Google AdMob) to serve and measure ads. See Section 4c for details and opt-out options.
• Push notification token (FCM registration token): a device-specific token issued by Firebase Cloud Messaging that allows us to deliver push notifications to your device. This token does not identify you personally but is associated with your account while notifications are enabled.
• Device fingerprint (security): a one-way hash derived from your browser or device characteristics (user agent, language, approximate IP prefix) used solely to detect new-device sign-ins and send security alerts. The raw IP address is not stored beyond the hashing step.
• IP address and approximate location: your IP address is used to derive an approximate city and country for security alert emails when a new device signs in to your account. This location data is not retained once the alert is sent.
• Browser language, access times, and referring website addresses

3. How We Use Your Information

We use the information we collect for various purposes, including:

• To provide, operate, and maintain our services
• To improve, personalize, and expand our services
• To understand and analyze how you use our services
• To develop new products, services, features, and functionality
• To process transactions and send related information including confirmations and invoices
• To communicate with you about service updates, offers, and promotions
• To provide customer support and respond to inquiries
• To protect our services and investigate and prevent unauthorized or illegal activities
• To detect new-device sign-ins and send security alert notifications to your registered email address and/or mobile device
• To serve advertisements through Google AdMob on our free tier (mobile app only). Advertising identifiers are used by AdMob to show relevant ads; we do not use your inventory content or personal information for ad targeting.
• To deliver push notifications about inventory events, task assignments, membership changes, and security alerts (only when you have enabled push notifications for your account)

4. Sharing Your Information

We may share your information with third parties for the following purposes:

• Service Providers: We may share your information with third-party vendors and service providers that perform services for us or on our behalf, such as payment processing, data analysis, email delivery, hosting services, and customer service.
• Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Legal Requirements: We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process.
• Protection of Rights: We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person, or as evidence in litigation.

4a. Collaboration & Shared Content

FortSort supports multi-user collaboration through shared domains. When you invite another person to a domain, or accept an invitation to one, content you add to that domain becomes visible to every current and future member of it. This includes, but is not limited to:

• Task titles, details, assignees, and attached images
• Item names, descriptions, and images
• Storage space and domain names
• Your profile picture (if you use the uploaded-photo or captured-photo mode) and the email address associated with your account

Members of a shared domain can retain or capture content outside our control— for example, by taking a screenshot, downloading an image, or exporting their view of the domain. Removing a member from a domain, or leaving a domain yourself, prevents further access to new content but does not recover content that was already seen or captured. If you do not want your profile picture visible to co-members, you can switch your profile to the initial-letter avatar in your profile settings; this does not expose an image to other members.

For more detail on acceptable use in shared domains and on the tools available to you, see our Acceptable Use Policy.

4b. Third-Party AI and Vision Processors

Certain FortSort features work by sending content you submit to third-party providers that perform specialized processing on our behalf. In particular:

• Smart Add (object recognition): images you submit to identify items may be transmitted to a third-party AI vision provider that returns labels or suggestions.
• Receipt Scan: images of receipts you submit may be transmitted to a third-party provider that extracts text and line items.
• Barcode Scan: images or decoded barcodes you submit may be transmitted to a third-party lookup provider that returns product metadata.

These providers act as service providers under Section 4 above and are contractually restricted to using the content only to provide the requested service. We do not sell your content to them. Your content may be transmitted across international borders in the course of this processing. If you do not want your images processed by these providers, do not use the corresponding feature.

4c. Advertising — Google AdMob

On our mobile app, free-tier users may see banner advertisements served by Google AdMob(Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). AdMob may collect and use:

• Your device's advertising identifier (Google Advertising ID on Android; IDFA on iOS)
• Approximate location (derived from IP address)
• Device information and app interaction data for ad measurement

AdMob's use of this data is governed by Google's Privacy Policy.

iOS (App Tracking Transparency): On iOS, you will be shown an App Tracking Transparency prompt before any personalized ads are served. You may choose to allow or deny tracking. If you deny, non-personalized ads will be shown instead.

Ad personalization opt-out: You can disable personalized ads at any time in the app under Settings → Ad personalization. Disabling this sets the AdMob non-personalized ads (NPA) flag; generic ads will be shown instead. You may also opt out at the OS level:

• Android: Settings → Google → Ads → Delete advertising ID
• iOS: Settings → Privacy & Security → Tracking → disable app tracking

Paid subscribers do not see ads; AdMob is not initialized for paid accounts.

4d. Push Notifications and Firebase

We use Firebase Cloud Messaging (FCM) (Google LLC) to deliver push notifications. When you enable push notifications, your device is issued an FCM registration token. This token is:

• Stored in our database associated with your account
• Used only to route notifications to your specific device
• Deleted from our database when you remove the device from Settings → Push notifications

Push notification payloads contain only generic event descriptions (e.g., "New sign-in detected", "Item expiring soon"). Sensitive personal data such as your email address or inventory contents are never included in push notification payloads.

Firebase is governed by Google's Privacy Policy.

4e. Named Third-Party Service Providers

We use the following third-party services to operate FortSort. Each acts as a data processor on our behalf and is bound by its own privacy policy:

• Supabase, Inc. — database hosting, authentication, and real-time services. Your account data and inventory content is stored on Supabase infrastructure. Supabase Privacy Policy
• Stripe, Inc. — payment processing. Stripe collects your payment card number, billing address, and phone number directly; we receive only a payment token and subscription status. Stripe may use your billing address and phone number in accordance with its own policy. Stripe Privacy Policy
• Google AdMob / Firebase (Google LLC) — mobile advertising and push notifications. See Sections 4c and 4d above. Google Privacy Policy
• Zoho Corporation — transactional email delivery (account verification, invitation emails, security alerts). Recipient email addresses are transmitted to Zoho for delivery. Zoho Privacy Policy
• Vercel, Inc. — web hosting and edge infrastructure. Your requests to fortsort.com are processed by Vercel servers. Vercel Privacy Policy

5. Data Security

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure.

6. Data Retention

We will retain your personal information only for as long as is necessary for the purposes set out in this privacy policy. We will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

7. Your Data Protection Rights

Depending on your location, you may have the following rights:

• Access: You have the right to request copies of your personal data.
• Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• Erasure / Deletion: You have the right to request that we erase your personal data. You can delete your account directly from within the app at Account Settings → Delete Account, which permanently removes your profile, inventory data, and all associated records from our systems. Alternatively, email us at support@fortsort.com with the subject line "Delete my account" and we will process your request within 30 days.
• Restriction: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• Object: You have the right to object to our processing of your personal data, under certain conditions.
• Data Portability: You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.

California residents (CCPA):You have the right to know what personal information we collect, the right to delete it, and the right to opt out of the "sale" of personal information. We do not sell personal information. To exercise your rights, contact us at support@fortsort.com.

8. Children's Privacy

Our service is not directed to anyone under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us. If we become aware that we have collected personal information from children without verification of parental consent, we take steps to remove that information from our servers.

9. Changes to This Privacy Policy

We may update our privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the "Last updated" date at the top of this policy. You are advised to review this privacy policy periodically for any changes.

10. Contact Us

If you have any questions about this privacy policy or our practices, please contact us at:

Email: support@fortsort.com

Operated by: Sciciety LLC (Wisconsin, USA)