PRIVACY POLICY
Last Updated: 09/29/2026
PictCR, LLC ("we", "us") makes software for keeping a record of a property — its rooms and spaces, the work done to it, the photographs, the receipts. This policy says what we hold, why, who else sees it, and what you can do about it.
1. WHAT YOU GIVE US
Your account. Your email address and name, held by our identity provider (see §3). We never see or store your password.
Your property records. What you put in: property names and addresses, rooms, spaces, features and appliances, projects, tasks, photographs, documents and receipts. These are yours. We do not sell them, we do not use them to train anything, and we do not look at them except when you ask us to help with a problem.
Conversations. Messages and photographs exchanged with anyone you invite to a conversation about a property, and the phone number or email address you send the invitation to.
Payments. If you buy a licence, our payment processor collects your card details. We receive only the amount, the currency, the product, a transaction reference, and the email address you gave at checkout. We never see your card number.
2. WHAT YOU CHOOSE TO PUBLISH
A property is private until you share it. When you turn sharing on you choose how much of the address appears on the public page: the full address and a map, the town and state only, or nothing at all.
Two things follow from that choice, and both are worth knowing:
- A shared link is a link, not a login. Anyone who has it can open the page. Turning sharing off stops every link immediately.
- When — and only when — you publish the full address, the link itself is built from that address, so the address is visible in the URL to anyone the link reaches. When you publish less than that, the link carries an opaque identifier instead.
Photographs marked private, and work you have hidden, never appear on a public page.
3. WHO ELSE PROCESSES YOUR DATA
We use these services to run PictCR. Each one holds only what it needs to do its job.
| Service | What it handles |
|---|---|
| Auth0 (Okta) | Sign-in, your email address and name. Passwords never reach us. |
| Microsoft Azure | Where the application runs and where your records and photographs are stored. |
| Stripe | Payments. Card details go to Stripe, not to us. |
| Twilio | Text messages, when you invite somebody to a conversation by phone. |
| Google Maps Platform | A static map image of a property, requested by us — your browser does not contact Google for it. |
| Azure AI Document Intelligence | Reading a receipt photograph you upload, so its details can be filled in for you. |
| Google Analytics | Counting page views and a small set of actions. See §4. |
4. ANALYTICS, AND WHAT WE DELIBERATELY DO NOT SEND
We use Google Analytics to understand which parts of PictCR are used — how many people open a shared link, how many go on to add a photograph, where people give up. It tells us about patterns, not about you.
We never send Google:
- street addresses — including the addresses that appear in shared links, which are replaced with a placeholder before anything is reported;
- email addresses, names or phone numbers;
- the contents of your property records, your receipts or your messages;
- anything you type into a form.
We do send: which page was visited (with the parts above removed), which of a short list of actions happened — a property created, a photograph added, a task completed — and an opaque identifier for the property concerned, which means nothing outside our system. If you are signed in we also send your account identifier, so that using PictCR on a phone and a laptop counts as one person rather than two.
Advertising is switched off entirely. We run no advertising, we do not use Google's advertising features, and we instruct Google not to use this data for advertising or to personalise anything.
Your choice. If you are in the European Economic Area, the United Kingdom or Switzerland, analytics is switched off until you say otherwise, and we ask. Elsewhere it is on and you can turn it off at any time — "Cookie choices" at the foot of the page, on the phone under Profile. Turning it off changes nothing about how PictCR works for you.
5. WHAT IS STORED IN YOUR BROWSER AND ON YOUR DEVICE
| Name | Purpose | Kind |
|---|---|---|
pictcr.selectedPropertyId |
Which property you were last working on. | Local storage |
access_token |
Keeps you signed in for the session. | Session storage |
Auth0 (@@auth0spajs@@…) |
Your sign-in, so you are not asked on every visit. | Local storage |
pictcr.consent.v1 |
Your answer about analytics, and when you gave it. | Local storage |
_ga, _ga_… |
Google Analytics' own identifier for this browser. Only written if analytics is permitted. | Cookie |
The first four are necessary for PictCR to work and are not used to track you anywhere else. The last is written only with your permission where permission is required.
6. HOW LONG WE KEEP IT
Your records are kept for as long as your account exists. Delete a property and its records and photographs go with it — except that a photograph sent in a conversation and also filed against the property is stored once and stays while either of them does.
Analytics data is kept for 14 months and is not tied to your records.
Payment records are kept as long as the law requires us to keep them.
7. YOUR RIGHTS
You can see and change your property records at any time inside PictCR. You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and everything in it. Write to the address below and we will act within 30 days.
If you are in the EEA or the UK, you also have the right to object to processing, to restrict it, and to complain to your data protection authority.
8. CHILDREN
PictCR is not for children under 13 and we do not knowingly collect anything from them.
9. CHANGES
If we change this policy we will change the date at the top and, where the change matters, tell you inside the application.
10. CONTACT
PictCR, LLC — support@pictcr.com