CertReady

CertReady ("we", "our", or "us") is a mobile application that helps construction workers capture, track, and share their professional certifications. This Privacy Policy explains how we collect, use, and protect your information when you use the CertReady app.

• Email address — used for account authentication, login, password recovery, and account support
• Basic account information — such as your name or Google account profile information when you choose Google sign-in
• Certification details — name, expiry date, and photos of your certifications
• Reminder preferences and push notification tokens — used to send the phone or email expiration reminders you enable
• Device information — device platform and push-notification delivery information used to operate reminders
• Company workspace information — accepted company membership and company-managed credential records when you use CertReady Teams
• Company billing information — plan and payment status for company administrators who purchase CertReady Teams on the web
• Limited usage events — actions such as invitation acceptance, sharing, dashboard use, and checkout completion used to understand whether key workflows function

Your data is stored securely on Google Cloud Platform using the following Firebase services:

• Firebase Authentication — manages your account credentials
• Cloud Firestore — stores your certification details
• Cloud Storage — stores your certification photos

All data is transmitted using industry-standard encryption (TLS/SSL).

CertReady uses the following third-party services to operate:

• Firebase (Google) — authentication, database, storage, and hosting
• Expo Push Notifications — delivers certification expiration reminders
• Stripe — processes optional company dashboard billing on the web
• Resend — delivers CertReady Teams invitations and optional credential-expiration reminder emails

These services have their own privacy policies that govern their handling of your data.

We do not sell your personal data. We share limited data with service providers only as needed to operate CertReady, including authentication, storage, push notifications, company workspace access, and company payment processing.

Your certification data is available to another person only when you explicitly choose to generate and send a share link or QR code. Anyone who receives that link can view the selected record until the link expires or is revoked, so you should send it only to intended recipients.

Accepting a CertReady Teams invitation connects your account to that company workspace. It does not automatically expose your personal credential wallet. Company-managed credential records are stored separately.

Your personal wallet data is retained while your account is active. After a successful account deletion, CertReady removes your wallet certifications, private photos, managed public shares, push-notification settings, and Firebase Authentication account.

Company-managed records belong to the company workspace and may remain after a worker disconnects or deletes a personal account. Worker-authorized company shares and their copied proof photos are revoked and removed. Company retention and deletion requests must be handled by the company administrator and CertReady support under the approved retention policy.

Short-lived operational records are retained only as needed for security, delivery, and abuse prevention. Identifier-free daily usage totals may remain because they cannot be tied back to a user or company. Stripe may retain billing records as required for payment, fraud-prevention, tax, and legal obligations.

You can request account deletion from the Profile screen. Deletion is irreversible after it succeeds. A CertReady Teams owner must first transfer company ownership to another active administrator so the company workspace is not orphaned. If deletion cannot complete safely, the account remains available so the request can be retried or support can help.

For detailed instructions, see our Account Deletion Guide.

CertReady is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. Users will be notified of material changes via an app update. We encourage you to review this policy periodically.