Privacy Policy

1. Who we are

Lumber Loader (the "app") at lumberassist.com is operated by Ken Paine ("we", "us"). For any privacy question or request, contact us at privacy@lumberassist.com.

2. The most important thing: the app works without an account

The app runs in your browser. Signed out, it never sends your planning data to us — your settings, current order, and saved inventories are kept on your device only (in your browser's local storage). You can plan loads, solve layouts, and print or save a PDF manifest entirely offline and anonymously.

Accounts and sync are optional. You only send data to our server if you choose to create an account and sign in.

3. What we collect, and why

If you use the app without an account

• Nothing reaches our server. Your work is stored locally on your device and stays there until you clear it. (Technically: browser localStorage, not cookies.)

If you create an account and sign in

We collect and store on our server only:

We do not collect payment information (the app is free), and we do not ask for any personal information beyond the above.

Information handled automatically

• Password-reset requests: when you ask to reset your password, we briefly record the IP address the request came from, to protect the reset system from abuse. This is deleted automatically, typically within about a day.
• IP addresses in transit: like any website, our servers process the IP address your device connects from so we can send responses back and rate-limit abusive traffic. The web server we operate keeps standard access logs (which include IP addresses) and deletes them automatically after about 14 days. Where a page is still delivered through our hosting provider's network, that provider keeps its own standard access logs as well.

What we do NOT do

• No advertising or analytics trackers, no tag managers, no third-party marketing scripts, no session-replay. The app loads no third-party code.
• No cookies. The app uses your browser's local storage, not cookies.
• No selling or sharing of your personal information (including no "sharing" for cross-context behavioral advertising).

4. Why we process your data

We only process the personal data described above for the reasons we've already stated: to provide the account and cross-device sync you signed up for, to send you a password-reset email when you ask for one, and to keep the service secure (for example, storing passwords only as hashes and briefly rate-limiting password-reset requests). We don't use your data for advertising or profiling, and we don't process it for any purpose unrelated to running the app. You can end this processing at any time by deleting your account (Section 8).

5. Who we share data with (our service providers)

We don't sell or rent your data. We use a small number of providers strictly to run the service, and they may process your data only on our behalf:

Each of these providers is bound by a data processing agreement that permits them to process data only to provide their service to us, and not for their own purposes. Hostinger's forms part of its terms of service (hostinger.com/legal/dpa), as does Resend's (resend.com/legal/dpa).

Like most service providers, ours in turn rely on their own sub-processors to operate. Amazon SES, named above, is the one that actually carries your reset email. Resend publishes its full current list at resend.com/legal/subprocessors, and Hostinger lists its own in the agreement linked above. Where all of this happens is covered in Section 7.

We may also disclose information if required by law (e.g. a valid legal request), or to protect the rights, safety, or security of our users or the service.

6. How long we keep it

• Account data (email, password hash, display name, and your saved work): kept for as long as your account is active. You can delete your account at any time from the signed-in account panel; this permanently erases your account and all data synced to it from our servers (this cannot be undone). Data kept only on your own device is not affected.
• Deleted saves: when you delete a saved load or tally, it is removed from your devices right away and permanently deleted from our servers about 30 days later (a short grace period so the deletion reaches all of your devices first).
• Inactive accounts: if an account is not used for 24 months, we email a warning to the account address and permanently delete the account about 30 days after that if it is still unused. Simply signing in during that time keeps the account.
• Password-reset records (including the short-lived reset IP): automatically deleted after they expire — typically within about a day.
• Backups: our host keeps routine database/server backups on a rotating cycle, retained for about 3 months. Data you delete — including a deleted account — may remain in these backups until they age out and are overwritten (up to about 3 months), after which it is gone from the backups too.
• On-device data: stays on your device under your control until you clear your browser storage or sign out.

7. Where your data is processed

Your data is processed in the United States, on the infrastructure of the providers listed in Section 5. If you use the app from outside the United States (for example, from Canada), your personal data is transferred to and stored in the United States.

8. Your choices and rights

You can, at any time:

• Use the app without an account — the simplest way to share nothing with us.
• Sign out, which stops syncing and clears your account details from that device.
• Edit or delete your saved work inside the app.
• Delete your entire account and everything synced to it, instantly, from the account panel in the app (Account → Delete account). This permanently erases your account and all synced data from our servers and cannot be undone; work saved only on your own device is unaffected.
• Reset your password from the sign-in screen.
• Contact us at privacy@lumberassist.com to ask what we hold about you or to correct it. We'll respond within a reasonable time.

Depending on where you live, you may have additional rights (for example, to access, correct, delete, or port your data, or to complain to the relevant privacy regulator). To exercise any of them, email us at the address above; we don't charge for this and won't treat you differently for asking.

"Do Not Track" / global privacy signals. We don't track you across websites and we don't use advertising cookies, so there is nothing to opt out of. Because we don't perform cross-site tracking, browser "Do Not Track" and Global Privacy Control signals don't change what we do — we already don't collect that kind of data.

9. Security

We take reasonable measures to protect your data: passwords are stored hashed with bcrypt (never in plain text); the connection to our app and server uses HTTPS; the password-reset system uses single-use, short-lived, expiring codes/links and stores only a one-way digest of them; and each account's data is isolated to that account. No system is perfectly secure, so we can't guarantee absolute security.

10. Children

Lumber Loader is a tool for lumber-industry professionals and is not directed to children. We don't knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we'll delete it.

11. Changes to this policy

If we make a material change, we'll update the "Last updated" date at the top and post the revised policy at this URL before the change takes effect. For material changes that affect how we handle your personal data, we'll also email the people who hold an account with us (using the email address on the account). Your continued use after the effective date means you accept the updated policy.

12. Contact

Questions or privacy requests: email privacy@lumberassist.com. The app is operated by Ken Paine.