Privacy, in plain terms.

Notice at collection · privacy version 4

Effective November 1, 2026. Berry Street Research Group LLC operates Fencekind. This notice covers our website, account services and native app, with separate website and iOS choices below. It describes current collection and permitted future business purposes. A feature or recipient described as “may” is not a statement that it operates today. New processing remains subject to applicable law, your choices, our contracts and any additional notice or consent required at collection.

We collect identifiers such as account email, account/device identifiers, browser/ad-click identifiers and, for permitted web advertising measurement, your edge-observed IP address; customer records such as your own business contacts and support requests; commercial information such as your subscription and verified payment history; internet/device activity such as fixed-page visits, product interactions, browser information and delivery diagnostics; approximate country and, when present in original trusted hosting metadata, state or metro classification; photos you deliberately upload; professional/business information you provide when requesting help; and inferences such as acquisition attribution and product-activation status. Customer Content includes the plans, photos and customer records you choose to provide. Native camera scenes and local recordings follow the on-device rules below and are not automatically uploaded. Stripe, rather than Fencekind, collects payment-card details.

We collect optional business-profile answers in three short steps: company name and website, trade and role, service-area state or ZIPs, crew size, job-volume/value bands, estimating tools, referral source, estimate volume and next-job timeframe. You can skip, change or clear these answers. They are first-party company profile data; the answers are not sent to Meta. With analytics permission, we connect retained pre-signup activity to your account only after a verified sign-in in the same browser. We do not identify anonymous visitors by name. Authorized analytics operators can view account profiles, retained session and visit history, attribution, qualification, billing and event timelines and export them as CSV. We may obtain business and firmographic information about account holders and their companies from lawfully selected providers, business partners, referrals and public records, including contractor-licence registries. We do not currently operate a purchased-data enrichment program. We do not use consumer data brokers or identity-graph services to identify anonymous visitors by name, and do not enrich contractors’ homeowner/end-client records for our own purposes.

Sources are you and your authorized users; first-party cookies, web beacons, logs and product interactions; the optional ATT-authorized native Meta SDK described below; our current advertising, email, hosting, AI and payment providers; and, if a future permitted feature is introduced, business-data providers, public records, partners and referrals. App stores and payment processors may provide operational distribution or payment information. We do not use third-party session replay or collect typed field values or keystrokes for advertising analytics.

Actual collection and service disclosures · preceding 12 months

During the 12 months before November 1, 2026, Fencekind collected the following categories in the features people chose to use: identifiers; account/customer records and support communications; commercial subscription/payment information; internet/device activity; approximate country information; uploaded photos and other Customer Content; professional/business qualification information; and inferences such as attribution and activation status. Collection depended on use and applicable permission; this does not mean every person supplied every category. We did not purchase outside enrichment profiles or operate a separate data-sale program.

During that period, identifiers, account/customer records, support communications, commercial information, internet/device activity, approximate country, uploaded photos/content, professional/business information and related inferences were disclosed as necessary to our hosting/storage and service infrastructure providers to operate, secure, save, restore, analyze and support the service. Email addresses and necessary delivery metadata were disclosed to our email provider for requested sign-in, support and operational messages. Subscription/payment identifiers, plan and commercial information went to our payment processor for billing and reconciliation. When a user requested configured AI assistance or photo editing, submitted descriptions/specifications or photos and necessary request metadata went to the AI service providers described below. Providers did not receive every category in every request. Local-only native camera scenes, recordings and customer estimates were not automatically uploaded by these features.

The distinct advertising disclosure during that period was limited identifiers, internet/device activity and verified commercial payment milestones/amount and currency sent to Meta with applicable permission; browser beacons also necessarily disclosed their connection IP and user agent. This was not a disclosure of contractors’ homeowner records, plans, photos or quote amounts. Server-side client-IP matching starts with version 4 and was not present throughout the historical period. Prospective enrichment, audience and sale programs described elsewhere in this notice were not operating merely because they were reserved as future possibilities.

Business purposes and recipients

We use these categories to provide and administer the service; authenticate and support accounts; prevent fraud and secure the service; calculate and deliver requested outputs; maintain records and comply with law; analyze performance, attribution and product use; develop, test, research and improve products and service AI/ML; build business profiles, segments and derived insights; communicate about the service and, with separate email permission, send product marketing; and measure and optimize permitted targeted and cross-context advertising. Future permitted uses may include company-data enrichment, lead scoring, custom/lookalike audiences, benchmarks, financing or business transfers, and other purposes disclosed at collection or with your consent. No broker purchase, audience upload, predictive-value model or automated AI-training pipeline is established merely by this notice. Sensitive information and contractors’ end-client data are excluded from our own advertising, enrichment and sale purposes.

We disclose necessary information to service providers and contractors, including hosting/storage, email, payments and AI providers. With applicable marketing permission, we share the limited web event and matching fields described below with Meta. Future permitted disclosures may include other advertising/analytics partners, business-data partners, affiliates, professional advisers, potential financiers or acquirers, legal authorities when required or appropriate to protect rights and security, and others you direct or consent to. A listed recipient does not receive every category. Customer Content and sensitive information remain subject to the narrower restrictions below.

Sale, sharing and business profiles

In the 12 months before this effective date, Fencekind has not sold personal information for monetary consideration. We have shared permitted identifiers, internet/device activity and commercial information with Meta for cross-context advertising measurement: account/session identifiers, browser and observed ad-click identifiers, user agent, page/event times and paths, and verified registration/payment milestones. Version 4 permission adds the observed IP address; hashed verified email/account ID matching was already supported. Exact current fields and exclusions are described below. Homeowner information, plans, photos, quote amounts and sensitive information are excluded from Meta events.

For information lawfully collected under this notice, we may sell personal information or share it for cross-context behavioral advertising where permitted by law and your choices. Eligible categories are account/business identifiers and contacts, professional/business information, commercial information about the account’s own use of Fencekind, internet/device activity, approximate location and related business-profile inferences. Potential recipients are advertising/analytics partners, business-data partners and other businesses offering relevant business products. This reserves a future permitted program; it does not claim that a separate data-sale or enrichment program exists today. We do not sell Customer Content, homeowner/end-client information, sensitive information, account credentials, payment-card details or precise location. App data is not sold without separate consent and applicable Apple permissions/disclosures.

Your Privacy Choices / Do Not Sell or Share My Personal Information is available from the footer and account settings. It opts out of sale, sharing and targeted advertising. We honor Global Privacy Control, including a Colorado-recognized universal opt-out signal, as an opt-out of sale/sharing and targeted advertising. A website marketing checkbox cannot override an active signal. This includes any future sale program, which must enforce current choices before disclosure. Current server-side marketing controls record the account’s refusal where linked. An anonymous choice applies to that browser; sign in or contact us to apply a verified request to other account records. Website and native choices remain independent; optional email has its own permission.

Depending on location and applicable law, you may also opt out of profiling used for decisions with legal or similarly significant effects. We do not currently use advertising profiles for such decisions. Contact support@fencekind.com for that request or a Nevada sale opt-out. An advertising score is not verified revenue, creditworthiness or a guarantee. We provide any additional required notice, assessment, contract or choice before a materially different future use. This notice does not silently authorize a new use of older data that violates an earlier promise or requires new consent.

As between the parties, and subject to privacy rights, Fencekind owns Usage Data, derived insights, feedback and qualifying aggregated/de-identified data, and may use, license or sell it for lawful purposes. We publicly commit to maintaining qualifying de-identified information in de-identified form, not attempting to re-identify it except as legally permitted to test de-identification, and contractually requiring recipients to preserve those protections. Calling personal data “de-identified” does not remove your rights unless it meets the applicable standard.

Protected content, sensitive information and children

You keep ownership of Customer Content. For homeowner, end-client and contractor-customer personal information supplied by a contractor, we act as that contractor’s service provider/processor and use it only to provide and improve the service on the contractor’s behalf, as permitted by law. We never sell/share it for our own advertising, enrich it for our own purposes or upload it to Fencekind’s Meta dataset or audiences. The same narrower restrictions apply to subcontractors supporting that processing. The Customer Content/service-provider restrictions and separately accepted data-processing addendum remain in force; this policy does not broaden their licence.

We do not sell/share sensitive personal information or use it to infer sensitive characteristics. Account credentials, payment-card data and precise geolocation are excluded from sale and advertising. Necessary credentials, voluntarily submitted support/content information and payment-provider processing are used only for permitted service/security purposes. Do not submit government identifiers, health information or other unnecessary sensitive data. This business service is for adults 18 and older. We do not knowingly collect children’s information or knowingly sell/share information about anyone under 16; contact us if such information was provided so we can address it.

Native tracking requires applicable iOS authorization and follows the exact iOS notice below. A web choice does not grant ATT, and ATT does not grant website permission. A future app-data practice requiring separate consent or different App Store privacy labels will not begin merely because this website policy mentions it. Native account-connection web flows remain excluded from web advertising measurement.

Retention, security and international processing

We retain account/customer records, saved content and support/business-profile records for the account/service relationship and legitimate support, security, dispute, contract and legal needs, applying the export, deletion and closure limits below. Commercial/billing records follow necessary financial, tax, dispute and provider retention duties. Optional web events and browser/click/IP matching context have the 90-day maximum below; current privacy choices and necessary decision/suppression records may remain longer to honor them. Local files remain until you or the device removes them. Derived personal profiles remain subject to underlying personal-information rights and retention limits. There is no universal automatic deletion schedule for all service records; provider and backup expiry remain separate. We assess necessity, purpose, sensitivity, consent/contract limits and legal duties rather than claiming indefinite personal-data ownership.

We use access controls, restricted service credentials, encryption in transit and other measures appropriate to the service; no system is guaranteed secure. Providers may process data in the United States or other countries where they operate. Where law requires international-transfer safeguards, we use an appropriate transfer mechanism and safeguards before that processing. AI routing/retention limitations are described below; this notice does not promise provider deletion or training restrictions beyond controls actually configured.

State and other privacy rights; requests and appeals

Depending on residence, applicable thresholds and exemptions, including comprehensive privacy laws in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, Nebraska and other states, rights may include access/confirmation and categories or specific pieces of information; correction; deletion; a portable copy; information about recipients; and opt-outs of sale, sharing, targeted advertising or qualifying profiling. We do not discriminate for exercising applicable rights. Mandatory privacy rights are not waived by this policy or the Terms’ arbitration/liability provisions.

Use Your data for available account export/deletion/closure, Privacy choices for immediate browser opt-out, or email support@fencekind.com with “Privacy request.” You may also use private Help. We may verify access, correction or deletion requests through your signed-in account, verified email and information reasonably needed to confirm authority. Do not send passwords, full card numbers or government identifiers. Browser sale/sharing opt-outs do not require an account or identity verification. Authorized agents may act where permitted; we may request signed authority and proportionate verification of the person represented, subject to applicable exceptions.

We acknowledge and respond within applicable deadlines, generally 45 days for access/deletion requests, with a permitted extension and notice when needed. If denied, we explain the reason and available appeal. Email the same address with “Privacy appeal” and the decision reference; we review it and respond within the applicable statutory period, including the required explanation and regulator-complaint route if denied. You may contact your state attorney general or privacy regulator. If California’s reporting threshold ever applies, we will publish required request metrics. Request-handling information is used for that purpose and compliance duties.

We may update this policy and identify its effective version/date. We give notice of material changes in the service or by email where appropriate. Continued use after notice signifies acceptance only where law permits; we obtain additional consent where required and do not retroactively erase earlier restrictions. The service contract includes business-v2 arbitration, class/jury waiver and liability terms, subject to mandatory rights. Contact Berry Street Research Group LLC at support@fencekind.com with questions.

What the app stores

The web studio can save a project draft, favorites, and recovery copies in your browser. Customer estimates also store business and customer names, email addresses, phone numbers, job addresses, quote notes, and pricing adjustments locally in this browser profile. Estimate data and its recovery backups use separate per-project storage keys and persist across sign-ins until you clear this site’s browser data. Account export or server deletion does not erase these local records. These files belong to that browser profile and can be visible to someone else using the same profile. Optional web assistance also preserves the description, stable request key, earlier model values, proposal, review receipts and a nonsecret account binding in this browser before sending a request. Normal history views are account-specific, but someone with access to the same browser profile or its storage can still access local records. Reloading does not automatically resend a description. You can download browser history originals from Model workshop; those files can contain private descriptions. Server export and deletion do not remove this local history. Browser storage limits, private-mode settings or clearing site data can remove it, so retain copies you need. The native app stores saved projects on its device. Local files do not automatically become account records.

When you create or join a team, the service stores the team name, owner account/email, member account/email and role, invitation recipient and role, invitation-link hash, lifecycle times, and explicitly saved shared designs and rates. The owner manages membership. Editors can save shared designs; viewers can open and export them. Personal projects are not automatically copied into a team. Team drafts and private customer quote details use separate account-and-team browser storage keys; that separation is not encryption and does not protect files from someone with access to the browser profile. Revocation does not remotely erase cached or downloaded copies. Team invitation links are manually shared; no automatic invitation email is sent. Their secret may be kept in this tab’s session storage until acceptance or browser cleanup. Expiry stops acceptance after seven days; invitation metadata remains with the team until deletion.

A separately approved native Team connection stores the approving account/email, selected Team, a membership reference, read-only or save ceiling, device label, credential hashes and lifecycle times. It lasts up to 30 days from connection. Every shared-project request checks current membership and role; removal, leaving, archiving or revocation closes future access. Rejoining does not restore an old grant. Personal device credentials are separate and do not gain Team access. Team designs open as separate local copies to keep personal project and customer estimate files separate. Revocation cannot erase offline copies. Team connection metadata is included in the approving account’s export and removed with its saved-data deletion or when its Team is deleted.

When you sign in and save to your account, the service stores your account identifier, project name, fence specification, measured layout, rates, and update time. Model requests store the submitted specification or description, request state, validated output, errors, and timestamps. Avoid names, addresses, and other sensitive information in model descriptions.

If you explicitly publish a customer estimator, the service stores its configuration and an expiring share-link hash. Submitted leads store customer contact details, confirmed dimensions, a preliminary price, contact consent, and contractor status notes. Public requests use short-lived network digests for rate limiting, rather than storing raw IP addresses. A share link exposes its published estimator configuration to people with service access and that link; revoke it when no longer needed. A shared link does not bypass the service’s access restrictions. Publishing a customer presentation stores only its explicitly approved public title, business contacts, measured fence geometry, optional calculated estimate, timestamps, and share-link hash. Customer identity, original project identifiers, and private notes are excluded. People with service access and the link can view the selected snapshot until it expires or you revoke it. Revocation cannot recall an already loaded or saved copy. Device connections store a label, approval state and times, account association, and hashes of connection credentials. An approved native device has project read/write access for up to 30 days; you can revoke it sooner. A new connection can additionally request AI fence assistance, which requires separate explicit browser approval. Existing project-only connections do not gain that permission automatically. Assistance-enabled devices can submit fence descriptions and read their account’s assistance results; they cannot manage billing, leads, settings, or other devices. Device connection codes and credentials are excluded from account downloads. Support and account deletion requests store your account identifier, the text you submit, request state, and timestamps. Billing records contain provider customer and subscription identifiers, payment state, and receipt references. The app does not store card numbers.

On your iPhone or iPad

The native field app processes its camera scene, detected surfaces, depth, environment lighting, and tracking on the device. It does not automatically upload camera frames, scene meshes, depth images, photos, or session reports. It does not request GPS location or an advertising identifier. A measured fence layout uses relative project coordinates, rather than a geographic location.

Photos, videos, branded estimate exports, and diagnostic reports are created locally. Video capture requires an explicit recording action and system permission. It records this app’s visible view and controls, including the AR camera view when open; microphone and face camera are disabled. Older iOS capture can include app sounds. Original MP4 files and source, date, duration, dimensions, file size, and audio-track metadata stay in the device’s Fencekind Recordings folder. Incomplete files are retained and labelled as incomplete. Review recordings for customer details before sharing. You can remove them in the Files app; the app does not automatically upload or delete them. You choose whether and where to share them through the system share sheet. A report can contain the app version, device model and operating system, relative fence geometry, tracking decisions, lighting observations, elapsed intervals, and thermal state. It excludes GPS, hardware serial numbers, account credentials, contact details, project names, prices, and camera images. Recipients or file providers you select can retain their own copies; deleting server records cannot recall those copies.

Native customer estimates separately store business and customer contacts, a job address, reference, date, scope notes, additions, discount and deposit in the device’s CustomerEstimates folder. Imported estimate originals are retained there before an independent project copy opens. These private fields are excluded from account project sync and plain project JSON. Estimate packages, CSV, text and PDF include the selected estimate details; review them before using the system share sheet. Generated exports use a local cache that the operating system may clear. Removing a saved design or deleting server data does not remove these local estimate records or preserved originals. You can retain or remove those files in Files on the device.

Native projects, profile preferences, favorites, recovery files, and pending-save records stay in the app’s local storage until you change or remove them. Ordinary local files may be included in device backups according to Apple’s backup behavior and your settings. Connecting an account is separate: you initiate a connection, approve it in the browser, and explicitly choose which projects to load or save. A cloud save sends the project’s name, relative layout, fence specification, rates, and revision to the service and associates it with your account. Local edits do not automatically merge with an account project.

Connection records use a fixed app label, random identifiers, credential hashes, approval state, and expiry times. The native credential is kept in device-only Keychain storage without Keychain synchronization. If you explicitly enable AI assistance and submit a description, that description is sent to this service and its configured AI provider. A local request journal preserves the description, connection grant ID, stable request key, proposal, and review state for recovery, without storing the credential. No photo, camera frame, or scene scan is sent by this feature. Review proposed dimensions and assumptions before applying them; the service does not infer property boundaries or actual site measurements from that description. Removing a local connection clears its local credential; use Connected devices in the browser to revoke the server grant. If you separately request and approve customer presentation access, the device can publish reviewed snapshots and list, revoke or remove your account’s presentation links. Publishing sends the complete selected project to this service, which stores a public snapshot with anonymous layout identifiers, selected business contacts and an optional estimate. Private customer details and notes are excluded. Anyone holding an active link can view that snapshot. Revoking a device does not revoke existing presentation links; those expire or must be revoked separately. A local customer-link recovery record holds a public title, connection grant ID and attempt time when publication is unconfirmed. The full customer link stays in memory unless you deliberately copy, share or open it. Archived attempt records remain in Files until you remove them. iOS advertising measurement is described separately below. Website and app choices are independent; local AR diagnostics are separate.

Photos you choose to edit

Photo editing is optional and separate from local AR. The editor retains the file you select as a private local original before making a smaller processing copy. A selected file can be an edited or converted representation supplied by your browser or Apple Photos; it is not guaranteed to be the camera master. The selected original can contain location, date and other metadata. It stays in this browser profile or the native app’s local files and is not sent to the image provider by this workflow. Someone with access to the same browser profile, device, backups or exported files may be able to read it. Clearing site data or app files can remove local copies.

When you explicitly upload a photo, the service stores a reduced, orientation-corrected JPEG processing copy in private Cloudflare object storage. The official clients create a fresh copy without copying source metadata; the server additionally removes JPEG application metadata and comments. This uploaded source is different from the untouched local original. The service associates it with your account and stores its digest, dimensions, name, status and timestamps.

Each generation requires your confirmation of the source image and prompt. The service sends that source, including anything still visible in its pixels, and your prompt to OpenRouter and the configured Google image model. Use photos you have permission to process. Avoid people, addresses, documents and private customer details. The integration requests routes with data collection denied and zero data retention routing enabled. These are provider selection controls; they do not promise that all service, security, billing or legally required records disappear.

The service stores separate generated revisions, their source relationship, prompt, consent receipt, model, request identifiers, optional reported usage cost, errors and timestamps. Generated image bytes are retained as returned, including any provider content credentials or metadata. The editor keeps a local recovery journal before sending a request and checks saved status after an uncertain reply instead of automatically generating again. A device needs a new, separately approved image-editing connection permission; an older project or text-assistance connection does not gain it automatically. That permission does not replace confirmation before each image request.

Use the editor to export images and provenance or remove a server photo. Account export includes photo and revision records; image files use separate authenticated downloads. Removal closes access first, then cleans up stored objects. It remains pending until removal is confirmed; a provider request already admitted may finish before cleanup. Durable cleanup records can remain while removal is pending. A separate minimal usage ledger retains an account identifier, random admission identifier and time for the rolling 24-hour request budget; it contains no photo, prompt or storage key. Deleting an image does not reset this budget. Expired entries are removed during bounded admission maintenance, so they can remain until that maintenance next runs. These actions do not erase local originals, browser journals, downloads, backups, recipients’ copies or provider records. Remove local copies separately. Operational retention periods, backups and provider deletion procedures remain part of the public launch review.

Web and app advertising measurement

Web measurement notice version 4. Factual web-attribution and IP-retention update: November 1, 2026. US notice presentation update: November 2, 2026. For visitors Cloudflare identifies as being in the United States, product analytics and Meta web ad measurement are on by default, with an ad measurement notice and privacy controls in the footer. For all other or unknown locations, they stay off until you opt in. Earlier refusals remain effective. We record the decision version and basis: US default, explicit opt-in, opt-out or Global Privacy Control. Website and app marketing choices are independent.

Use Your Privacy Choices / Do Not Sell or Share My Personal Information in the footer to opt out of Meta sharing or change analytics. We honor Global Privacy Control sent by your browser as an opt-out of Meta sharing, including the Sec-GPC header or the browser’s globalPrivacyControl signal. It does not automatically opt you out of separate first-party product analytics. While that signal is active, a Meta opt-in cannot override it. Refusal does not prevent using the service.

Where the applicable web permission allows it, we send meaningful free-demo engagement, page views, completed registrations, checkout creation, verified paid trials, subscription conversions and actual live payment events to Meta. Browser and server copies share an event identifier. Checkout creation is not a paid trial. Matching can include your edge-observed IP address, a first-party browser identifier (fbp), an ad-click identifier (fbc) derived only from an observed fbclid, and SHA-256 hashes of your normalized verified account email and stable Fencekind account identifier. Hashing does not make these identifiers anonymous. Meta can link these events and identifiers with activity on other companies’ apps and websites. This can constitute sharing for cross-context advertising under privacy law.

Campaign labels and campaign, ad-set and ad IDs can be stored as first- and latest-touch attribution through the same browser’s sign-in and checkout. At verified web sign-in, we may also retain the observed ad-click ID and its click time with that account for up to 90 days from the click, and use it for that account’s later verified web trial, subscription and payment measurement when the current browser lacks a click ID. Refusal, Global Privacy Control and Do Not Sell or Share remove this account click context. This is an authenticated web-account association, not identification of anonymous visitors or a join to app installs. Web ad payloads do not include raw email, phone, contractors’ homeowner details, property data, fence plans, photos, quote amounts, or full query URLs. A permitted CAPI event can include your IP address in plain form, as Meta requires, together with browser information. The server uses a fixed page path, browser user agent, event time and verified USD payment value. The browser contacts Meta directly, so Meta receives that connection’s IP address and user agent. The manual web beacon uses no Meta SDK, automatic form matching, credentials or referrer.

Browser controls use an opaque first-party cookie retained for up to one year so opt-outs can persist. Explicit browser grants are checked for expiry; US defaults are evaluated using Cloudflare country metadata, never an address or country submitted by the browser. Browser/ad-click context and optional activity have a maximum 90-day retention window, with expiry checked before use and expired records removed on later scheduled cleanup. Raw client IP is usable for at most 24 hours after observation and is removed from stored matching context and delivery envelopes at the next background cleanup; it is also removed before any later delivery. A non-unique notice-dismissal flag may remain in browser storage. Verified web account permission can remain for up to one year for later trial conversions and renewals after a browser session ends. An account opt-out or recorded GPC suppression prevents default-on reactivation until an appropriate new explicit choice. Native app activity never grants web permission.

Opt-out or revocation stops new web marketing admission and retries and removes queued matching context for the linked account/browser. In-flight requests begun before the change may finish, and events already delivered cannot be recalled from Meta. Browser optional-activity deletion retains a non-measuring privacy choice so a US default does not immediately restart measurement. Saved-data deletion suppresses account web marketing while removing optional records. Essential financial and privacy-decision records remain separate. Known-staff and account-mismatched session controls prevent accidental marketing.

App connection pages do not use web advertising measurement. Device-connection, related sign-in and verification flows are marked as native context. In that context we suppress web Pixel/beacons, CAPI, matching capture and optional product analytics, regardless of US defaults or an earlier opt-in. These events are not queued for later upload. Email verification, account/device identifiers and connection records remain necessary service functionality. Only a later separate normal web session can use the standard web rules.

Fencekind measures our iOS ads with Meta by default when you authorize tracking in iOS: we share app opens, session length and interruption counts, and milestones such as connecting an account, drawing a fence, exporting a quote and placing a fence in AR with Meta to measure our ads. Meta can link this activity and SDK installation identifiers with activity on other companies' apps and websites. We do not send customer details, fence plans, photos or quote amounts in these events, and advertising-ID collection is disabled. You can turn measurement off in Fencekind's settings or deny tracking in iOS at any time. Turning it off stops new measurement; activity already recorded before then may still be delivered to Meta. Website and app marketing choices are separate.

Content, service improvement and derived data

You retain ownership of Customer Content. Where your applicable business terms authorize it, Fencekind can host, use, process, reproduce and modify that content to provide, secure, improve and develop the services, including training and evaluating service ML/AI models, and to create aggregated or de-identified data. New business-v2 accounts grant the license described in those terms; signing in to an earlier account does not silently record acceptance of v2. Permission for a future use does not mean that an automated training pipeline is currently running.

For contractors’ homeowner personal data, we act as a service provider and use it only to provide and improve the service on the contractor’s behalf, subject to applicable law. We do not sell that data or upload it to Fencekind’s Meta dataset or audiences. The content license does not authorize unrelated advertising or general-purpose model training on homeowner personal data. Contractors must have the required rights, notices and consents for the information and photos they supply.

As between the parties and subject to privacy rights, Fencekind owns Usage Data, telemetry, aggregated and de-identified data, derived insights, and feedback or suggestions. Usage Data describes service use and performance; it does not transfer ownership of your plans or photos. We take reasonable measures to de-identify data before treating it as de-identified, do not attempt to re-identify it, and impose appropriate restrictions on recipients. Personal information remains subject to applicable purpose limits, deletion rights and other legal protections. Service providers process information for the permitted service purposes under their applicable restrictions.

Why the app uses these records

The service uses saved projects to reopen your work and produce estimates and materials lists. Model inputs produce structured fence specifications and geometry. Account identifiers restrict access to your records. Payment state controls subscription access. Service requests preserve your request history.

If you request first-estimate help, we store your own company name, role, business type, estimate-volume range and next-job timeframe with your private support conversation. Scheduling and availability are confirmed later. Qualification is based on your answers, not independent business verification. This is separate from contractors’ homeowner leads. With web Meta measurement enabled, a newly confirmed qualified request can send a Lead event and the approved account/browser matching fields; company text and qualification answers are not sent to Meta. Requesting help does not enroll you in marketing emails. The support-request retention and full account-closure rules below apply to these answers. Optional analytics record visits and arrivals at fixed product pages, demo interactions, example starts, requested exports and quote views. After successful account actions, they can record verified sign-ins, saves, published customer quotes, checkout creation, uploaded photos and ready photo concepts or models. These records use a random browser session and, for verified product actions, your account identifier and a hashed resource reference. They exclude customer text, photos and full URLs. Approved campaign tags can remain in this tab’s session storage and be reused for up to 30 minutes after capture; expired attribution is removed on the next measured action. Web analytics follow the US default or explicit-choice rules described below. Withdrawing analytics removes this browser’s optional browser and product activity. Authorized analytics operators see aggregate reports and restricted account profiles/timelines; configured analytics, support and maintenance accounts and marked internal sessions are excluded. Essential billing receipt records are separate and remain subject to financial record retention. Meta web transmission follows the geographic default, GPC and opt-out rules below and requires a configured connection.

With web analytics enabled, we measure scroll-depth and engaged-time buckets, finite tool and form-field names, requested outbound/help destinations, pricing-calculator interactions, and coarse rage/dead-click heuristics. No field values, keystrokes, page text, DOM snapshots, click coordinates or session replay are transmitted in these analytics. Stripe-hosted checkout fields are not observed. A random tab-visit reference expires after 30 minutes of inactivity; retained browser contexts and visits are pruned after 90 days and removed on withdrawal. With Meta web permission, server-confirmed non-example fence saves, reviewed real-job estimate generation, qualified workspace activation, optional profile completion and real teammate invitations may send custom optimization events with a shared browser/server event ID and existing approved matching fields. These events contain no profile answers, quote values or homeowner information. Minimal opaque milestone-suppression receipts can remain after withdrawal to prevent resending an old milestone after re-consent. With web analytics enabled, we also measure page loading, interaction responsiveness and layout stability (LCP, INP and CLS). These first-party performance records contain a fixed initial page label and version, a coarse viewport size, navigation type, a random metric reference and numeric timing or layout values. They do not contain full URLs, page text, DOM selectors, photos or customer details and are not shared with Meta. Native connection contexts and recognized staff sessions are excluded. Turning analytics off removes optional performance records for this browser session; optional records are pruned after 90 days.

Service providers

The web service uses the Sites hosting platform and Cloudflare storage. Customer email sign-in uses one-time codes and an independent Fencekind account when email delivery is configured. Resend processes the recipient address and sign-in email. The hosting platform's ChatGPT identity remains available for the existing private owner; customers do not need it to design locally. Stripe handles checkout and subscription management when billing is configured.

When you choose AI assistance and the provider is configured, the server sends your fence description and specification to OpenRouter and its selected model provider. The integration requests provider routes that deny data collection. That request is a routing control, and it does not establish a universal deletion or retention guarantee for every provider. Deterministic model generation does not require an AI call.

Providers can process technical information needed to deliver and secure their services. Their records are separate from an account export or deletion within Fencekind.

Cookies and device storage

The first-party privacy cookie, fk_session, stores an opaque identifier for up to one year so opt-outs can persist. The server stores choice basis, version, expiry and native-connection suppression. A necessary, non-unique fk_native_context session cookie keeps app-connection pages outside web advertising measurement. Its absence in a later browser session can begin a new normal web session without replaying native-context events. Explicit browser grants have a 30-day use window; account web permission and opt-outs are described above. Essential Fencekind sign-in cookies hold opaque login and session tokens; scripts cannot read them. A code expires after 10 minutes, a session after 14 days. An identity-choice cookie lasts up to a year so signing out cannot silently switch to an existing hosting-platform account. Code and session secrets are stored only as hashes on the server. Expired login and session records are pruned after a day on a later successful sign-in-code delivery. A separate short-lived rate ledger holds a challenge identifier, email hash and timestamp, without the recipient, code, session token or account ID. It survives account closure so deletion cannot reset sign-in limits. Its time windows expire automatically for admission; rows older than a day are pruned on that same later delivery path. Verified account email records remain until the account closure process finishes. The optional hosting identity provider manages its own sign-in state. Browser project storage remains until you replace or clear it.

Use Plan & privacy choices to change consent or delete this browser's optional activity. Refusing optional analytics does not prevent using the sample studio.

Retention and deletion

Server-saved projects and model records remain until you delete them. Optional browser events can be removed through privacy controls. Account data controls can remove your saved projects, model inputs and outputs, customer leads, published estimator links, customer presentation snapshots, approved device connections, and account-associated optional browser and product activity. Removing a device connection revokes further project requests and assistance access, but does not erase its local files or cancel a provider request already admitted while the connection was authorized. A provider request already in progress can finish at that provider.

If you own a team, the current saved-data deletion control also removes that team and its shared designs for every member after displaying this scope. An older client cannot broaden its personal-data confirmation to team designs. Your membership in another owner’s team is removed; that business’s designs remain. Accepted-invitation identity in other teams is redacted, and pending invitations to your verified email are withdrawn. Archiving a team closes access while retaining its records for the owner’s export. Billing and receipt records remain after saved product data deletion. Support requests, replies and email preferences remain after saved-product-data deletion so the account can display their history; completing full account closure removes your conversation content and contact preferences. Staff identity on another customer’s retained conversation is redacted if that staff account closes. Email updates are optional and can be turned off in the conversation. The sending provider processes the recipient and a reference link; notification emails exclude the conversation text. Provider acceptance is not delivery confirmation. An email already sent may still arrive after you turn updates off. A separate notification budget retains only an opaque event identifier and timestamp, without the owner, email or message; it prevents account deletion from resetting the daily sending limit. Entries older than a day are removed on a later notification attempt. Optional measurement cleanup is described above. Other product and support records do not yet have a general automated retention schedule. Backup expiry and provider deletion procedures still require operational review.

Deletion in this app does not erase local devices, downloads, provider logs, Stripe records, or the external identity account used to sign in. Full account closure is available from Your data. Confirmation closes account access, connected devices and public links, then verifies subscription cancellation and private photo cleanup before removing saved product data, owned Teams and Fencekind email sign-in records. An interrupted closure stays restricted and can be resumed from the same page after sign-in. Completion is shown only after the steps succeed; pending billing checks are not a cancellation confirmation. A minimal opaque owner tombstone prevents old sessions or in-flight saves from recreating deleted data. Financial/provider records, logs and backups, local files and recent photo and sign-in request-budget entries remain separate.

Trial and product emails

Verified paid trials may receive factual confirmation and pre-renewal notices with the provider’s renewal time, base price and tax disclosure. Optional product emails require a separate explicit email opt-in and chosen timezone; web or app measurement choices do not subscribe you. Choose or withdraw this permission in Email preferences or the unsubscribe link in a product email. Product sends stay blocked until a business postal address and signed delivery-feedback configuration are available. No tracking pixel is included. Our email provider processes the recipient, fixed service/product copy and an opaque unsubscribe reference. Delivery records distinguish acceptance, delivery, failure and suppression; provider acceptance does not prove inbox arrival. We retain your preference, unsubscribe hashes, suppression and message status while the account remains, including after saved-product-data deletion. Full account closure removes these local records; provider records remain separate. Pending recipient-bearing email bodies are cleared after acceptance or a terminal state. Short-lived anonymous budget entries prevent deletion from resetting the daily limit. Already-sent mail may arrive after withdrawal.

Your choices and questions

Visit Your data to export account records, delete saved product data, or permanently close your Fencekind account. Visit Help to save a privacy question. Support conversations are private to your account and authorized Fencekind support staff. You can read replies in Help and choose email update notices for each conversation. No general support response time is promised during the preview; applicable privacy-request deadlines still apply.