Privacy Policy

Groundskeeping is a work-tracking app for grounds and facilities crews. It is made and run by Robert Spencer, a sole proprietor in Provo, Utah. This page explains what the app collects, how it is used, and who it is shared with.

What we collect

• Names of crew members and the manager, as the site's manager enters them.
• Work records: what was marked done, where and when, problems reported, photos taken for a report, Today's list, schedules, time off, meetings a manager adds for the crew or the crew leads, and notes.
• Contact details a person gives so they can be told about work: an email address they enter on their own phone and, for text messages, a mobile phone number they enter themselves when they sign up for texts.
• Text messages the manager forwards to the app's number, such as a crew member saying they will be out, so the app can put that on the crew calendar.
• Problems people text to the app's number, and any photos sent with them: from crew members, and from people outside the crew who look after the site, such as a custodian, once they have signed up for texts themselves. The text, the photo and the sender's name and role are kept with the report for the crew to see.
• Service requests emailed to a site's own address by the university's work order system, or forwarded by the site's manager: the request number, building, the requester's name or office, and the description. Only the fields the crew needs are shown; the email itself is not kept.
• Reports sent from a QR code sign on a building: what the person wrote, any photos, and their name only if they chose to give it. Their network address is turned into a one-way code used only to limit how many reports one phone can send in a day, and is not kept past that day.
• Supplies: what each storeroom, closet, restroom or cart holds, who marked something low or counted it, which parts went into a fix (who used them, when, and a few words of the problem they fixed; the latest 200 uses are kept), and orders the crew has sent. Prices and the purchaser's email address are seen only by the site's manager and supply lead. A restroom's door sign collects nothing about the person who uses it: only which items are out and any note they choose to write, with the same one-day limit on a network address as the QR code signs.
• Supervisors who oversee several areas: their name and work email, kept by the organization's admin so they can sign in with a code sent to that email, and a record of the areas each change they make belongs to.
• A supervisor's list for the managers of their areas: the lines, any photos on them, who took and finished each one, and the replies between the supervisor and each area's manager. Each manager sees only their own area's part; the crew does not see it. Finished lines are removed a week after the last area finishes.
• Support access: who gave the app's author access to an area, for how long and with which permissions, and a log of each support session (when it started and ended, anything viewed as a person, live checks and setup steps). The area's manager and the organization's admin can read and download it.
• The public status page shows only counts for the whole service (checks that passed, notices, emails and texts sent and failed) and the words of any incident; no area, person or message. A template the app's author keeps of an area's way of working holds no people, places on the map, contacts or history.
• If your organization connects Slack or Microsoft Teams, the messages it chose (such as new reports or supplies out, by area and place) are sent to its own channel; people's names and words are left out unless your organization's admin turns them on.
• Feedback you send from the app (a problem, an idea or something good): your stars and words, any pictures or files, your name, the area, where in the app you were, the app's version, the browser type and the phone's last error, for the app's author to fix and improve the app. When the author tracks one as an issue to fix, a copy is kept with the app's code on GitHub: the words as the author saved them, the stars, the kind, the app's version and which screen (never a zone's name), but never your name, the area or any pictures. The names the app keeps for people (the crew, managers, reporters, leads, supervisors and phones) and places (areas, zones, named places and organizations), email addresses, phone numbers, join codes and web links (except links to the app itself, which keep their address without its details) are taken out of the words first, and the author checks them before saving. These copies stay with the app's code history.
• Requests for help you send from Get help: your words, a screenshot if you add one, and, unless you leave them out, details of your phone's app state (the app's version, phone and browser type, connection and sync status, notification permission and the last error). They are kept so support can answer you and see which problems come up most; the charts built from them show counts only. Your organization's admin can see your organization's requests without the phone details.
• Basic technical information needed to run the app, such as a device's notification registration and error reports. When the app hits an error, the phone sends the app's author the error message, where in the app's code it happened, the app's version, the browser type, the area and the screen it was on: each different error once each time the app is opened, ten at most. It never sends names, anything anyone typed, or the area's records, and it takes out quoted values, web addresses' details, email addresses, phone numbers and join codes first. Error reports are kept for 30 days.

How we use it

• To show the crew's work, schedule and calendar to the people on that site.
• To send notices about work: push notifications, email and, for people who agreed to it, text messages.
• To read a forwarded text and suggest a calendar entry, which the manager checks before anything is saved.
• To read a texted problem, sum it up in a few words and suggest where it is, so the manager or a lead can put it on the map.
• To put service requests and reports from QR code signs on the crew's list for the manager to place on the map. They are read by fixed rules, not sent to AI.
• To keep the app working and fix problems.

We do not sell personal information, and we do not use it for advertising. The app does not take payments or place orders; an order is handed to the organization's own purchasing.

Who helps us run the app

The app uses a few service providers, each only to do its job for the app and under its own privacy terms: Google Firebase (storing data, sign-in and push notifications), Cloudflare (hosting the app, and receiving email sent to a site's service request address), Twilio (sending and receiving text messages), Resend (sending email), Stripe (taking payment from the organization that pays for the app), and Anthropic (the AI features: reading a forwarded or texted message so the app can suggest a calendar entry or sum up a problem, answering questions about the crew's library, and translating the app). Anthropic does not use this information to train its models. GitHub, where the app's code is kept, receives only the copies of issues described above, which are meant to hold nothing that identifies a person or a school. A manager can turn every AI feature off for a site under Manager settings > Site. We share information with them only as needed to provide the app, and never for their marketing.

Who can see what

Information belongs to the site it was entered on. People on that site see the crew's work and calendar. Email addresses and phone numbers are stored where no phone in the app can read them back; only the app's server uses them to send notices. Reasons for time off and thanks between crew members are shown only to the people they concern and the manager.

Reasons for time off, and the words of a texted time-off request, are kept in a separate record that only the manager and the person who asked can open; the shared calendar shows only who is off and when. Meetings a manager adds, under Meetings in the app (what the meeting is, when, where, notes and who it is for), can be opened by everyone on the crew when they are for the whole crew, and otherwise only by the manager and the crew leads’ own phones; a meeting for the whole crew names nobody. Both are removed when the manager cancels them, or about two months after they take place. Thanks sent without a name keep no name anywhere. The manager sees a person's thanks only if that person allows it. A manager can give a crew lead the manager’s tools for a set time (at most 90 days): that lead can then run the work as the manager does, but never sees the manager’s record of each person’s work in Progress (By person, each person’s hours, and the names on the longest waiting work and on open problems; what every crew member sees in Progress, such as how many marks each person made and who did each job on Today’s list, a lead sees too), reasons for time off, contact details, supply prices, the thanks crew members send each other, surveys, the History, or anything under Crew and access but who takes each kind of work and the crew's hours; nor can they change whether the app asks each person for their hours, or Crew motivation (the weekly goal, thanks, milestones and the weekly spotlight that names people). The tools end on their date, or sooner if the manager takes them back or marks the lead away. What the crew shares with another crew or organization from its library is cleaned first: names, phone numbers, email addresses and exact locations are taken out, and the organization's manager decides what may be shared at all.

Schools and universities

Where the crew includes student employees, their work records may be education records under FERPA. The app uses them only to provide the service to the school, acts under the school's direction as a school official with a legitimate educational interest, and does not disclose them to anyone else except the service providers above, as needed to run the app. A school can ask for a copy of its data or for its deletion at any time.

Security

Data is encrypted in transit and at rest. Each site is kept apart from every other, and the rules that decide who can read what are enforced on the server, not only in the app. Only a manager can change a site's settings. Managers unlock with a PIN, which a site can back with a code from an authenticator app, or with the university's own sign-in. Every unlock is recorded in the site's history. To report a security problem, write to rems.byustudies@gmail.com; you will have an answer within three working days.

How long we keep it

Work records are kept for as long as the site uses the app, so the crew can see its history. Time off is removed about two months after it ends, and a meeting two months after its day. A manager can remove people, phones and contact details at any time, and can ask us to delete a site's data. When an update moved email addresses kept by an older version to where no phone can read them, an address under a name the site did not know then was set aside there, unused, for 30 days, and then removed; the site’s history names whose they were, so anyone still there can save theirs again.

Your choices

• Reply STOP to any text, or tap Stop texts in the app, to stop texts. To get them again, reply START or sign up again yourself.
• Ask your manager to change or remove your contact details, or contact us directly.

Children

The app is for work crews and is not meant for children under 13.

Contact

Questions or requests about your information: rems.byustudies@gmail.com.

If this policy changes, the date below changes with it.