Privacy Policy

What we collect

Account data: your name, your email address, a password hash if you set a password, and the firm you belong to and your role in it.

Firm and billing data: firm name, subscription status, trial dates, and the customer and subscription identifiers held by our payment processor. Card numbers are entered directly with the payment processor and never reach our servers.

Project data: everything your firm enters or retrieves for a project. That includes the project name, the site address and location, the county and municipality, drainage areas, soils, rainfall, stage-storage data, outlet devices, notes, every saved revision of the model, run results, generated reports, and the frozen copies of rainfall, soil and parcel data. A parcel record can include the owner’s name as it appears in the public or commercial record it came from.

Authentication and audit data: timestamps of sign-in, two-factor and password events, trusted device records, failed sign-in attempts by email address, a record of who changed what in your firm, the time of your last activity, and the IP address and user agent recorded when you accept the terms or the privacy policy. Your IP address also reaches our network layer on every request, the way any web request carries it, and is used there for routing, rate limiting and abuse prevention.

Operational data: request identifiers, error reports, and diagnostic traces produced when something fails.

A plan reviewer who opens a share link needs no account. We record nothing about the reviewer beyond the request itself and an aggregate page view.

Why we collect it

To operate the service, authenticate you, keep each firm’s data separate from every other firm’s, bill your firm, keep a record of who changed what, reproduce a past calculation, diagnose failures, and comply with law.

Our legal bases, where that framing applies, are performance of the contract for account, project and billing data; legitimate interests for security, abuse prevention, audit and aggregate product analytics; and legal obligation for tax and accounting records.

We do not sell your data, we do not share it with advertisers, and we do not use your project data to train models.

Cookies and analytics

PondSheet sets a session cookie for authentication, a cookie that remembers which firm you are working in, and, where you choose it, a trusted-device cookie so a known browser is not asked for a code on every sign-in. Those are the only cookies the application sets. There are no advertising cookies and no third-party trackers.

The map in the project screens loads from Google. Your browser requests the map and address suggestions from Google directly, so Google receives your IP address, the map area, and any address you type into the search. Google handles those requests under its own privacy policy.

Product analytics is Plausible, running on a server we operate ourselves rather than a hosted analytics service. It sets no cookies, uses no cross-site identifier, and records page views and a small number of named events, such as the use of a free calculator, in aggregate. The request that records a page view carries your IP address to that server the way any web request does; Plausible uses it only to tell one visit from another within a single day, and does not store it.

Error tracking is a GlitchTip instance we host ourselves. An error report carries the request identifier, the route, the release, and the error and its stack. We do not attach your name, your email address or your account identifier to it. Reports from your browser are relayed through our own server rather than sent from your browser directly, so your IP address is not part of them. Error reports are not used for any purpose other than fixing faults.

Who processes it for us

We use a small number of subprocessors. Each receives only what it needs for its function, under an agreement that limits it to that purpose.

We will publish a change to this list before a new subprocessor begins processing customer data. Write to [email protected] to be told about changes.

• Stripe: payments, subscriptions, invoices and sales tax. Receives the billing email address, the firm name and the firm’s identifier. When you subscribe, you are taken to a page Stripe hosts, and the card details and billing address you type there go to Stripe directly and never reach us.
• Resend: transactional email such as sign-in links, two-factor codes, password reset, invitations and billing notices. Receives the recipient address and the message.
• Cloudflare: the network in front of PondSheet and the object storage behind it. Every request you make passes through it, so it sees your IP address. Its object storage holds files such as generated report PDFs, model files and SWMM input files, which contain the project data and the names printed on the report.
• Google: the map, satellite imagery and address search in the browser, and address lookup and the site map image on the report from our server. Receives the site location and any address searched, and, from the browser, your IP address.
• Realie: a commercial parcel data provider. When a signed-in user places a site and the public parcel layers have no match, our server sends Realie the site location and address to find the parcel. Receives nothing else.
• GlitchTip: error tracking, on infrastructure we operate ourselves rather than a third-party service.
• Plausible: product analytics, on infrastructure we operate ourselves rather than a hosted service. Receives the page path and the IP address of the request, and keeps neither against a person.
• Our hosting provider: the servers PondSheet runs on. The database and the parcel lookup service we operate run on those same servers rather than as separate managed services, so no further party holds your project data.
• We may also disclose data where law requires it, to protect the service and its customers, or to a successor in a merger or acquisition, in which case this policy continues to apply until it is replaced with notice.

Public data sources

To retrieve public data for a project, our server sends the site location to public government services: NOAA for Atlas 14 rainfall depths, the US Census Bureau for the county and municipality, and the USDA soil survey, which receives the site outline, for soil groups. These requests carry the location only. They carry no name, email address, firm, project name or calculation.

These are public services and not our subprocessors. Each handles requests under its own policies.

International transfers

PondSheet is operated from the United States and data is processed there. If you use it from another country, you are sending data to the United States. Where a transfer mechanism is required by law, we rely on standard contractual clauses with our subprocessors.

Retention

Account and project data is kept while your firm has an account. Saved revisions of each model and generated reports, with the run and data that produced them, are kept unchanged for the firm’s records so that a calculation submitted to a reviewer stays reproducible.

Authentication and audit records are kept for as long as they are useful for security and dispute resolution. Failed sign-in records are kept for rate limiting and then expire. Billing records are kept for the period tax and accounting law requires, typically seven years.

Your firm can ask us to delete all of its data by writing to [email protected] from an owner’s email address. We then delete the firm’s projects, revisions, frozen data, runs, reports and stored files, and the accounts of members who belong to no other firm. Backups then purge on their ordinary rotation, within ninety days. Billing records stay for the period the law requires.

You can ask us to delete your own account while your firm keeps its account. We then remove your name, your email address and your sign-in data. The firm’s projects and reports stay with the firm, and a record that an account produced them remains without identifying you.

Security

Passwords are stored hashed with Argon2id, never in plain text. Sign-in with a password is followed by a code sent to your email address, unless you have marked the browser as trusted. Traffic is encrypted in transit. Files held in object storage, including generated reports, are encrypted at rest by that provider. Separation between firms is enforced at the data access layer and tested, not left to a filter someone remembers to apply.

Administrative access is limited to what is needed to operate the service, and administrative actions are logged.

No system is perfectly secure. If a breach affects your personal data we will notify you and any regulator as law requires, without undue delay.

Your rights and choices

You can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to processing, or provide it in a portable form. Write to [email protected] and we will respond within the period the applicable law allows. You can correct your name in your account settings yourself.

Your firm can download each generated report as a PDF with its SWMM 5 input file and PondSheet model file at any time. On request we will export a firm’s projects in a machine-readable form.

Some of these rights are limited by records we must keep for tax, accounting and security. Where we cannot act on a request, we will say why.

If California law applies to you, you have the rights to know what we hold, to have it deleted or corrected, to limit the use of sensitive personal information, and not to be treated worse for asking. We do not sell personal information and we do not share it for cross-context behavioral advertising, as California law defines those terms, and we have not done either. You may send a request through an authorized agent, and we will verify it before we act on it.

If you are an employee of a firm that uses PondSheet, your firm controls its project data. We will route a request about that data to your firm and support them in answering it.

You may complain to your data protection authority. We would rather you told us first.

Children

PondSheet is not for children. It is professional software, we do not direct it to anyone under sixteen, and we do not knowingly collect their data. If we learn we have, we delete it.

Changes to this policy

We may update this policy. The version identifier and effective date at the top change when we do, and the application requires you to accept a new version before you continue using it.

Contact

Crux Labs LLC, for PondSheet. Privacy questions, access requests and deletion requests: [email protected].