BidGlory privacy notice

1. Who handles what

BidGlory is business software licensed to a company (the "Customer"). The bid, job, product and client records inside a BidGlory instance belong to that Customer, who decides what goes in and who may see it. ProjectThunder Systems operates the hosted service and processes those records on the Customer's behalf. If you are an estimator using BidGlory at work, your employer is the Customer.

2. What the app sends to our servers

• Your sign-in. The user name or e-mail address you type and your password, sent over HTTPS to obtain a session token. The password is not stored on the device. The token is held in the iOS Keychain and expires.
• The records you open and edit. Bids, bid items, rooms, jobs, job log entries, purchase orders and product data.
• Client and contact details. Company name, contact person, phone and mobile numbers, fax, e-mail address, and postal and ship-to addresses.
• Photos and files you attach to a bid, including photos you take with the device camera from the bid screen.
• A sign-in audit record. Date and time, the user name presented, whether the attempt succeeded, the IP address it came from, and the browser or app identifier. It exists to detect password guessing and account misuse.
• A crash report, if the app crashes or hits an internal error. The iPad and iPhone app sends these automatically to Sentry, a crash-reporting service that processes them for us, so that we learn about a failure without waiting for someone to report it. The app does not ask before sending one and has no setting to turn this off. The Android app does not send crash reports (section 7). A report contains the kind of error and where in the app's code it happened; the app version, and whether that version was built for the demo or the production service; technical details of the device and the app at that moment, such as the device model, operating system version, memory, battery level, screen size and orientation, language setting, and when the app and the device were started; and a list of the kinds of event that came just before the error (for example, that the app came to the foreground or that a button was pressed), with their times but not which screen, button or record. Before a report is sent the app removes who you are, the device's name, which record you were working on, and the text of an error message wherever it could repeat something from your data. The report does not contain your network address, although, as with any connection over the internet, Sentry's servers can see the address it is sent from. A report is not linked to you or your account, and crash reports are not used for advertising, analytics or tracking.

3. What we do not do

BidGlory contains no advertising or analytics SDK and no advertising identifier. The crash reporter described in section 2 is not an analytics tool: it sends nothing unless there is an error, it does not record sessions, which screens you visit, what you type or your network activity, and it takes no screenshots. We do not track you across other companies' apps or websites, we do not sell or share your information with data brokers, and we do not use your data or your Customer's records to train models. The app does not ask for your location, your device's address book, your photo library, your microphone or your calendar. The only device-sensor permission it requests is the camera, and only for a photo you deliberately take to attach to a bid.

4. What stays on your device

Your device keeps four things inside the app's private storage. The first three are there so the app keeps working without signal:

• your session token, in the iOS Keychain;
• a read cache of answers the server has already given, so screens still open offline;
• an outbox of edits you made while offline that have not yet reached the server;
• a copy of every proposal you open as a PDF or Word document from a bid. Each one is the file the server generated, with the client's name and address and the bid's items and prices, saved in the app's cache folder so your device can show it. Each time you open one, the app saves a new copy.

The two local database files are marked so that iOS keeps them encrypted at rest — unreadable until the first time the device is unlocked after it restarts — and excluded from iCloud and iTunes backups. One consequence is worth stating plainly: restoring a backup onto a replacement device does not carry unsent edits across.

Signing out deletes the token, erases the read cache and deletes the proposal copies. It deliberately does not delete the outbox. Those are your own edits that have not been sent, and deleting them would destroy your work. They stay on that device under your account, are sent the next time you sign in on it, and cannot be read or sent by anyone else who signs in on that device. An unsent edit is never quietly sent long after the fact — past a fixed age it is shown to you for a decision instead.

The app deletes the proposal copies when the device is signed out: when you sign out, when your session expires or is ended and the app returns to its sign-in screen, and when the app starts and cannot confirm that anyone is signed in. It also deletes them when someone else signs in on the device, removing every copy that is not that person's, including any left from an earlier session. Earlier versions of the app saved these copies without recording who opened them; the app deletes those at the same moments, all of them, whoever signs in. If your session expires while you have unsaved edits, the app asks you to sign in again on top of your work and keeps the copies until someone does. While you are signed in the app keeps them, because the viewer you opened one in may still be showing it; closing the viewer does not delete it. If a copy cannot be deleted at that moment, the app tries again at the next sign-out or the next sign-in by someone else. The device may also clear the app's cache folder sooner to free up storage, and deleting the app removes them. Until they are deleted iOS keeps them encrypted at rest the same way, unreadable until the first unlock after a restart, and leaves them out of iCloud and iTunes backups. To show a proposal the app hands it to a viewer app you choose, and that app may keep its own copy under its own rules.

5. Your controls

• Sign out on the device, which clears the token and the read cache as described above, and deletes the saved proposal copies. If you have unsent edits, the app tells you before it signs you out and lets you stay signed in to send them first.
• Change your password from the account screen.
• Deactivation and deletion. BidGlory accounts are created and deleted by your organisation's BidGlory administrator, not by self-service, so there is no in-app "delete my account" button that deletes it on the spot. The account menu's Request account deletion link opens section 8, which says how to ask and what is deleted and kept. To ask what personal data is held about you, contact your administrator or write to us at the address below, and we will act on the Customer's instruction.

6. How long we keep it

Business records live for as long as the Customer's instance does; the Customer decides when they are removed. Server-side records of individual device edits are kept for a bounded period after the edit and are then purged. Sign-in audit records are retained for security investigation.

7. The Android app

The BidGlory app for Android is distributed through Google Play. It is the same app as the one for iPad and iPhone, and sections 2 to 6 apply to it as written, except for the differences below.

• No advertising, analytics or tracking. As on iOS, the app contains no advertising or analytics SDK and uses no advertising ID, and it does not track you across other companies' apps or websites.
• Crash reporting is off. The Google Play build is made with crash reporting switched off, so it contains no crash-reporting software and sends no crash reports.
• Your session token is kept in the app's encrypted preferences, encrypted with a key held in the Android Keystore, instead of in the iOS Keychain. As on iOS, your password is not stored on the device.
• The read cache and the outbox are kept in SQLite databases in the app's internal storage, which Android keeps private to the app: one database file for each, with the working files SQLite keeps beside a database. If the outbox file is ever damaged, the app does not delete it: it renames it and keeps it in the same place, so the unsent edits in it are not destroyed. The app does not add encryption of its own to these files. Encryption at rest comes from the device: on a device with a screen lock, Android's file-based encryption, which devices launched with Android 10 or later are required to use, keeps app-private storage unreadable until the device is unlocked for the first time after it restarts. On an older device, whether storage is encrypted depends on the device.
• Saved proposals are kept in the app's internal cache folder, which is private to the app and encrypted at rest by the device in the same way. As on iOS, the app deletes them when the device is signed out and when someone else signs in on the device. Android may also remove them sooner when it needs the space or when you use Clear cache in the app's storage settings, and uninstalling the app removes them.
• Backups. The app opts out of Android backup, and its data-extraction rules exclude all of its storage, including the read cache, the outbox and the token, from both Google cloud backup and device-to-device transfer. As on iOS, restoring or transferring onto a new phone does not carry unsent edits across.
• Connections. The app connects to BidGlory only over HTTPS, so everything it sends and receives is encrypted in transit. Plain HTTP is allowed only in developer (Debug) builds, and only to a BidGlory server on the developer's own computer (the Android emulator's 10.0.2.2 address and localhost). That exception is not part of a release build.
• Permissions. The app asks for internet access and for the state of the network connection (INTERNET and ACCESS_NETWORK_STATE), which Android grants without asking you. The only other permission in the app is one the AndroidX support library adds for the app's own internal use (DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION); only apps signed with BidGlory's own key can hold it, and Android never asks you about it. It requests no permission that Android would ask you to grant: not the camera, location, contacts, microphone, calendar or storage.

8. Delete your account

BidGlory accounts are created by your company's BidGlory administrator. You cannot create or delete an account yourself, in the app or on the website. To have your account deleted, use either route:

• Ask your company's BidGlory administrator, who deletes and anonymizes accounts from the Users screen.
• Or email privacy@bidglory.com from the address on your account, with your name and your company's name. Your company is the Customer (section 1), so we confirm the request with its administrator and, on its instruction, delete and anonymize the account.

What is deleted, and what is kept:

• Your account is deleted and anonymized. Once it is deleted it can no longer sign in on the website or in the app, and every session it had is signed out. Your name, user name, e-mail address, phone number and password are erased and replaced; the account record keeps its number, with "Deleted user" as its name. The emptied record stays because the bids and jobs you worked on point to it.
• Copies of your details. Where BidGlory copied your name, user name, e-mail address or phone number (audit and change records, saved versions of bids, the customer portal's sales-rep card and your replies there, and job notices), they are replaced with "Deleted user" or removed. Text that matches your name only because someone else has the same name (another user, a customer, a contact or a room) is not changed; if another user has exactly your name, the salesperson text on bids is left as it is, because it cannot be told apart. Free text that someone typed (notes, descriptions, comments) is not searched or changed.
• Proposals already sent to a customer are kept exactly as they were sent, as the customer's record of what was offered. If a sent proposal showed your name or phone number as the salesperson, it still does.
• Business records you created or edited (bids, jobs, clients, purchase orders, photos and files) belong to your company and are kept for as long as it keeps them. Deleting your account does not delete them; they stay attributed to "Deleted user".
• Sign-in and administrator audit records are kept for security investigation. They are not deleted automatically. Once your account is deleted they identify it by its number only: your name and user name in them are replaced by "Deleted user" and your e-mail address is removed. They still record the date, the outcome, and the network address and browser of each sign-in.
• The history of changes to records, which names who made each change, is deleted automatically 365 days after each change, unless your company's installation is set to keep it for a different period. Once your account is deleted it names "Deleted user" instead of you.
• Server-side records of edits sent from the app are deleted automatically 45 days after the edit, unless your company's installation is set to keep them for a different period.
• Agent access tokens. If you created agent access tokens (Agent access in the website's account menu), each token's record (its name, permissions, dates and a one-way hash of its secret, never the secret itself) is kept, and the token is revoked and stops working when your account is deleted. The log of each call made with one of your tokens records which tool was called, when, and the outcome, never the arguments themselves, and is deleted automatically 90 days after the call, unless your company's installation is set to keep it for a different period.
• Comments and replies on a bid in the customer portal, and the portal's record of activity on a bid, are kept permanently, including after the bid is deleted. Once your account is deleted, your replies there show "Deleted user".
• On your device. Signing out of the app deletes your session token, the read cache and the saved proposal copies (section 4). Uninstalling the app then removes the rest of its files, including any edits that were never sent.

Questions about this notice? Email support@bidglory.com. See also the licence agreement.