Plainspoken — not legalese. A small HVAC+R shop owner should be able to read this twice and know exactly where their data sits, who can see it, and how to ask us to take it out.
Last updated . When this page changes materially, the date moves and the archive is the page history.
We do not buy lists, scrape public sources, or pull third-party data into your shop record. The only data we hold is what someone typed into a Frostledger form.
Captured from the waitlist form on the homepage and at the bottom of every marketing page. We use it for one purpose only: to write you a single note when there is a pilot seat that fits your fleet size. That outreach is manual — a person on the team reads every address and sends by hand. There is no drip sequence, no re-engagement campaign, and the address is never forwarded to a marketing tool.
Submitted from the request-access form on the pricing page. We collect the name, work email, company, technician count, an optional tier suggestion, and any notes you choose to type. We use it to start a short pilot conversation with you. It is held for the duration of that conversation plus a reasonable record-retention window, and is never added to a marketing list.
Once you create a Frostledger account, we hold an email-addressed user record with optional name and avatar, plus the inspection rows and refrigerant recovery rows you create. Account authentication runs through the better-auth module — your password is stored only as a one-way hash, never as plaintext. Inspection and recovery rows are tied to your user and are not visible to any other account on the platform.
Production data lives in a managed Postgres instance on the Polsia platform. The application reaches it over SSL — connections in transit are encrypted end to end.
Every query the application issues against the database is parameterized. There is no string-concatenated user input anywhere in the read or write paths, so injection is structurally impossible.
Inspection and recovery rows are owned by the user who created them. Reads and writes are scoped with a where: { userId: user.id } clause — no other customer can ever see your rows, and there is no shared "tenant" surface that crosses shops.
Database backups are managed by the platform; they live in the same managed-Postgres perimeter. We do not export customer data to an external warehouse or to a third-party backup system.
We do not sell your data. We do not share it with advertisers. We do not upload it to a marketing automation platform, and there is no retargeting pixel on this site. The PDF inspection reports and refrigerant recovery records you generate belong to you — they are produced in your browser, downloaded to your machine, and never indexed by us.
The only thing the production app emits to a third party is a single platform-side visitor beacon: a page-view counter that records a visitor hit without anything user-level attached. It is not Google Analytics, it is not an ad network, and it cannot identify a signed-in account from a public visitor.
Government disclosure goes only where the law requires it. If we are ever compelled to share a record, we will tell you what was shared and why, unless that notice is itself legally restricted.
A small cookie records whether you have chosen light or dark mode so the choice persists between visits. It carries no identifying data; removing it just resets the theme to system default.
When you sign in, the authentication module issues a session cookie to keep you signed in. Without it, you would have to enter your email and password on every page. There is exactly one such cookie and it is bound to your account — no third party can read or set it.
No third-party cookies. No cross-site tracking. The shipped browser Permissions-Policy header keeps browsing-topics=() disabled at the platform layer — see src/lib/permissions-policy.ts.
Kept until you ask to be removed, or for as long as the product team needs to plan pilot onboarding queues. Removal today is a manual email to the contact below — no automation, no sequence.
Kept for the duration of the pilot conversation plus a reasonable record-retention window afterwards, so we can answer follow-up questions about scope, tier, or pricing without re-asking for context.
Kept as long as your account is active. Deleting a single row is available today; closing the account (and removing every row tied to it) is a manual email to the contact below. We confirm in writing when the deletion has run.
Not retained by us. A PDF is generated in your browser and downloaded to your machine. We do not store copies of generated PDFs on our side — once it is in your hands, it is in your hands.
This site does not run an automated unsubscribe system today — there is no transactional email module wired in. To come off the waitlist, write to the contact below and a person will remove you by hand.
If something material changes — a new data category, a new shared processor, a retention rule — we update this page and bump the "last updated" line. Old revisions remain in the page history.
Questions about privacy? Write to frostledger@polsia.app.