Privacy Policy

Sun Sub is an iPhone time clock for painters and trade crews. The app is owned and operated by Sun Painting Virginia, 2421 Ivy Rd, Charlottesville, VA 22903. This policy covers the app; the online service behind it (spvaTrack, the Sun Painting Virginia project system, which stores what the app records); the Sun Sub pages on this website, including the public report verifier at /sunsub/verify, the subscription pages, and the "Sun Sub hours" page that subcontractor companies use; and the Field App Review page our staff use for Sun Painting jobs.

It is written for you if you use Sun Sub in any of these ways:

• On your own. Anyone with a US or Canadian mobile number can sign up, add worksites, record hours and send signed hours reports to whoever they work for. You may have nothing to do with Sun Painting Virginia; in that case we are simply the company that runs the app, and this policy is our promise to you about your records.
• On a company's jobs. Companies that run their crews through Sun Painting Virginia's system (subcontractors on Sun Painting Virginia jobs) can put you on their jobs, either by creating your account for you or by inviting the account you already made. Your shifts on those jobs are that company's records, as sections 4 and 5 explain.
• As a foreman on a company job, with the crew, scope and photo tools, or as Sun Painting Virginia staff we have set up.

Sun Sub users are not Sun Painting Virginia employees. If you work on a Sun Painting Virginia project you are an independent contractor, paid on IRS Form 1099, or you work for a subcontractor company that Sun Painting has engaged. The company you work for has its own responsibilities to you; this policy is about what Sun Painting Virginia does. Sun Sub is a record of billable hours, not a way of supervising your day.

Customers of Sun Painting Virginia are covered by a separate document, the customer portal Privacy Policy. If a link in the app or in a text message took you to that customer policy, this page is the one that applies to your use of Sun Sub.

Everything below is tied to your account. Almost all of it is created by something you do in the app, or, on a company job, something your foreman or the company's office does.

a) Identity and contact

• Your mobile number. Typed by you on the sign-in screen, or by a company's foreman or office when they add you to a job or to their pre-approved roster. Your mobile number is your account: there is no username or password. Only US and Canadian mobile numbers can create an account.
• Your name. Typed by you when you create the account (it is what appears on your hours reports), or by the foreman who added you. You can change it in the app.
• Email address, optional. Asked for once when you create the account, and editable later. If you give one, it is used as the reply-to address on reports you email, so the employer can answer you directly, and it is passed to our payment provider if you subscribe on our website. If a company created your account, the office may keep one on file for you.
• Time zone, taken from your phone when you create the account. It is used to date your shifts and reports. Preferred language (English or Spanish), set by the foreman if a company added you; it controls the language of the scope-of-work document on company jobs.
• How the account was created (by you, or by a company for its crew), and, when the account was made for you, who added you.
• Company link: the company your account is linked to, when it was linked and by which route (your acceptance of an invite, your typed company name plus a code, the company's office, or your sign-in with the company's own number on file), the job you were invited to, who invited you, and whether you have switched on sharing your worksite hours with that company. Pending, declined, expired and cancelled links are kept as the record of that consent.
• When you first and last signed in, and when your phone last contacted our server.

b) Sign-in and device

• Sign-in code records. Each time you ask for a code (to sign in, or to confirm a company link) we record your number, the purpose, the time, the network (IP) address the request came from, and whether the code was used. Codes are normally generated, delivered and checked by our verification provider (Twilio Verify), so the code itself never reaches our server. If that service is unavailable, our server generates the code, keeps a hashed copy for checking it, and sends it by ordinary text; the text of that message, including the code, is kept in our message log like every text sent through our messaging service. Code requests are counted per number and per network address to limit abuse; those counts are the same records.
• Device sign-in token. After a correct code, your phone receives a long random token that signs every later request. Our server stores only a one-way hash of it. On your phone it is stored in the iOS Keychain.
• Device description at each sign-in: the device name and model as iOS reports them to apps, the iOS version, and the Sun Sub version. The app also sends its version number with every request so the server can tell which agreement version and which features your build supports.
• IP address and app identifier on consent records. When you answer the SMS checkbox, we record the IP address of your phone and the app's network identifier (which includes the app build and iOS version). When you accept the app Terms or sign a scope of work, we record the network address of that request.

c) Location precise

A location reading is your latitude and longitude, the accuracy in metres, your current location permission (While Using or Denied; "Always" only if you granted it to an earlier version, which the app no longer asks for), a flag from iOS saying whether the location looks simulated, and the time on your phone. The app takes a fresh reading only at these moments:

• When you tap Clock in and when you tap Clock out.
• When you tap Set site pin here on a worksite of your own, or switch on "Use my current location as the site pin" while adding one. That reading becomes the worksite's pin (section 2h).
• Foremen on company jobs only: when you confirm the day's crew, when you submit a before/after photo report, and when you propose a site pin for the job.

Three other actions reuse the most recent reading the app already has without taking a new one, and only if there is one: accepting the app Terms, a foreman signing the scope of work, and each photo uploaded in a report (photos are stamped with the app's latest reading, usually the one taken when the report was submitted).

Between those moments the app does not record or send your location, with one on-phone exception described next: while you are clocked in, the phone keeps reading its own location to check you are still at the site, and those readings are neither sent nor kept. No location history is kept on the phone. If a reading cannot be obtained within a few seconds, the action goes ahead without one (except clocking in and setting a pin, which need one).

The on-phone check while you are clocked in, and the automatic clock-out (version 1.4 and later). From the moment you clock in until you clock out, your phone keeps comparing its own location with the site's circle: on a company job, the job's approved site circle; at your own worksite, the pin and radius you set (in both cases about 20% wider than the verification radius, and never smaller than 100 metres). This runs while the app is in the background too, using iOS's location background mode, and iOS shows its blue location indicator for as long as it does. The readings are coarse (roughly 100 metres) and taken only when the phone moves, to limit battery use. If you have been outside the circle for more than 10 minutes, the app clocks you out automatically as of the moment you left, shows you a notification created on the phone (not a push from us), and the shift's record says "auto clock-out". Nothing from the check is sent to our server and none of its readings are kept. What the server receives is the same as for any shift: the clock-in reading and a clock-out reading, which for an automatic clock-out is the last reading taken inside the site, so where you went afterwards is never recorded anywhere; plus one word on whether the check ran for the whole shift ("continuous") or not ("interrupted", with the number of minutes the phone was not watching, for example because the app was closed or location was off). A shift the phone could not watch all the way through is recorded but marked not verified. When you are not clocked in the check does not run at all. Builds before 1.4 check only when you open the app and show a reminder instead.

Permission. The app asks for "While Using the App" location access the first time you tap Clock in (or set a pin), after showing you a screen that explains when it uses your location and when it never does. It never asks for "Always"; with "While Using the App", iOS allows the check started by your Clock-in tap to continue in the background during the shift, and shows the indicator. The first time the check starts, the app also asks permission to show notifications, for the one notification it sends: that you were clocked out. If you turn location off in iOS Settings after allowing it, the app tells you the next time you open it that clocking in needs location, and shows a shortcut to Settings; a shift you already started can still be clocked out. Location must be on to clock in; once you are clocked in, your hours keep recording even if it drops (see section 9).

What our server does with a reading. It compares the reading with the site's location and radius (the job's approved site on a company job; your own pin at a worksite) and records the distance, whether you were inside, and the accuracy. A shift counts as "on site" only when both the clock-in and clock-out readings were inside the circle and, when the app gave its word, the phone's check ran for the whole shift. It is marked not verified when the phone reports its check was interrupted, or when the site has no approved location or pin, the pin was set after the shift began, the reading is missing, the reported accuracy is worse than the current limit (100 metres), or iOS flagged the location as simulated. On a company job a supervisor reviews unverified shifts; at your own worksite nobody does, and a report simply says whether the shift was on site.

d) Hours and work records

• Shifts: the worksite or job, work date, clock-in and clock-out times, duration, whether the shift was verified on site and the plain-language reason if not, and, on company jobs, any supervisor decision: confirmed, rejected or adjusted minutes, with a memo. Live punches are timestamped by our server. Punches made without signal are saved on your phone with your phone's time and location and sent when you are back in coverage; a resent punch is never counted twice. An offline punch is refused if its time is more than 7 days old (or before your account existed), more than 2 minutes in the future, overlaps a shift already recorded, or would take that day past 16 hours; the app then drops it and tells you.
• Auto-closed shifts. A shift still open 16 hours after it began is closed by our server (this runs every half hour), marked as auto-closed, and excluded from every total and every report.
• Daily crew confirmations filed by your foreman on company jobs: who was marked present or absent on a job each day, an optional note, and the foreman's location at the time.
• Roster changes: when you were added to or removed from a company job, and invites sent to you.
• Timesheets. On company jobs, confirmed shifts are rolled into a weekly "App hours" timesheet for that company and, on Sun Painting Virginia jobs, into Sun Painting's approval records. Shifts at your own worksites never go into any timesheet.

e) Photos and notes foremen

• Foremen on company jobs can submit before and after photo reports for a job: photos from the camera or photo library (up to 12 per upload, 15 MB each), a note on each photo, a scope summary and report notes.
• Every photo is resized and re-encoded on your phone before upload. That strips the camera's embedded metadata, including any GPS tag the camera added.
• Each report is stamped with the foreman's location when it was submitted, and each photo with the app's latest reading. Photo coordinates are stored with the record but are not displayed in the app or on the office review page.
• Photos are stored on our server under random file names, outside the public web folder, and can only be viewed by signed-in Sun Painting staff with access to that job. The app itself cannot download a photo back once it is sent.

f) Signatures

• When you accept the app Terms of Use, and when a foreman signs the scope of work for a job, the app records your finger-drawn signature as a PNG image and the full name you type, with the time, which document (and version) you signed, a fingerprint (hash) of the text you were shown, the app version, the network address of the request, and the app's latest location reading if it has one.
• The signature image is stored for the record. It is not shown back to you in the app; the scope screen shows only who signed and which version of the document.

g) SMS consent records

• The sign-in screen has an optional box for work-related texts. It is unchecked by default and you do not need to tick it to use the app or to work.
• We record your answer the first time you sign in (yes or no), and every later "yes", together with the exact wording you were shown, its version and language, a fingerprint (hash) of that wording, the time, your phone's IP address and the app's network identifier. The answer is recorded only after the code has proved you control the number.
• These records are append-only: we add to them and never edit them. A "yes" you gave earlier is not cancelled by leaving the box unchecked on a later sign-in; to cancel, reply STOP to any text (see section 6).
• We also keep a log of every text sent through our messaging service and every reply you send us, including STOP, HELP and START replies, with the carrier details our messaging provider attaches. Sign-in codes delivered by Twilio Verify are not in that log; only the fact that a code was requested is recorded.

h) Worksites and pins

• A worksite you add is a name, an optional address, and, if you set one, a pin: latitude, longitude, the radius you chose (50 to 500 metres) and when the pin was set. The pin is the location reading taken when you tapped Set site pin here; it is stored as the site's centre, not as a record of where you were.
• A worksite you archive is hidden from you, not deleted, because shifts you recorded there keep referring to it (so a report can still name the site). Archived worksites are archived for good when you delete your account.
• The pin's coordinates, radius and set date are printed on any signed report that includes a shift at that worksite, so whoever reads the report can see what the on-site check was made against. Do not pin a worksite at a place you would not want an employer to see on paper.

i) Signed hours reports

• When you create a report we record the period and time zone, the employer's name and email address you typed (the email is optional; both are the employer's information, which you are responsible for entering correctly), your name and the last four digits of your number as they were at that moment, the totals, and one entry per shift in the period: date, site, site kind (company job or your worksite), clock-in, clock-out, minutes, whether the time was stamped by our server or by your phone offline, which location check applied, whether the shift was on site, the employer-review status on company jobs, and, for worksite shifts, the pin (section 2h). Shifts that were not counted are listed with the reason. We keep the PDF we generated, the signed data record inside it, its digital signature, the identifier of the signing key, and a fingerprint (SHA-256) of the exact file we issued.
• Each time you email a report we record when, to which address, and how many times it has been sent. The email is sent from our address through our email provider (Google), with your email address as the reply-to if you gave one, and the PDF attached.
• Verification log. Every time anyone checks a report at the verifier, uploads a file to it, opens a report's record page (for example by scanning its QR code) or calls the verification API, we record the report it matched (if any), the file's fingerprint, the verdict, the method, the time, and the IP address and browser identifier of the person checking. That person may be you, an employer, or anyone who holds the file; we keep the log to spot forged reports and abuse of the verifier. When a file carries a valid signature but matches no report we issued, the attempt is flagged and an alert email is sent to our staff.

j) Subscription and payments

• Bought in the app (App Store). The purchase is made with your Apple Account and handled entirely by Apple. Apple sends us a signed receipt for the transaction and ongoing status notifications, from which we store: Apple's original transaction identifier (the number that identifies your subscription for its whole life) and the latest transaction identifier, the product bought, whether it was a sandbox (test) or production purchase, the status, the current period end date, whether auto-renew is on and, if it is off, Apple's reason code. To tie Apple's notifications to your account we give Apple a random account token (a UUID we mint for your account, unrelated to your phone number or Apple ID). We never receive your Apple ID, your card, your billing address or your purchase history for other apps.
• Bought on our website (card). Checkout and billing are run by our payment provider, Stripe. We create a Stripe customer for you with your name, mobile number and, if you gave one, email address, and store Stripe's customer identifier, the subscription identifier, the price identifier, the status, the current period end, whether it is set to cancel, and when a payment last failed. Your card details are entered on Stripe's page and never touch our server. Stripe's own privacy policy covers what it collects to process your card.
• Complimentary access. Our office can mark an account as having complimentary access until a date; that date is stored on your account.
• We keep a log of the billing events Apple and Stripe send us (event identifiers, type and time) so that a repeated notification is never applied twice.

k) Company roster and the company page

• A subcontractor company can keep a pre-approved roster of mobile numbers (with optional names) on its Sun Sub hours page; that is what lets you link the company by typing its name. If your number is on a company's roster, that fact exists before you have any account, added by the company's office or foreman, who confirm they got your number from you for work.
• The company's page also lists the workers linked to it, pending invites, and 60 days of shifts (section 5).

Information the app sends to your phone

To do its job, the app downloads your account details, your worksites, and, on company jobs, the names and addresses of the jobs, the supervisor's name, the crew list, the job's approved site location and, if you open it, the scope-of-work document, which carries the customer's name and project details. Company information is customer information you are trusted with under the Terms of Use. The app keeps a cached copy of your account, jobs and worksites on the phone, protected by the phone's passcode, so the Work tab opens without signal; signing out deletes it.

Apart from its own settings and the cached copy of your account, jobs and worksites, the only personal data Sun Sub keeps on your phone is your sign-in token (in the Keychain) and any punches waiting to upload. The app's built-in test mode (sign in with 111-111-1111) runs entirely on sample data generated on the phone and sends nothing to us, to Apple or to Stripe.

• To sign you in and keep your account safe: the one-time code, the device token, the device and sign-in records, and the per-number and per-address limits on code requests.
• To record and verify your hours: punches and their location readings are compared with the site (a company's approved circle or your own pin) so verified shifts need no follow-up calls.
• To build, sign and send the reports you ask for: your shifts in the period, your name and the employer details you enter become the report; our server signs it and emails it where you tell it to.
• To let anyone check a report: the fingerprint of each issued file, the signed record and our public keys let the verifier tell an untouched file from an altered or forged one, and the verification log lets us spot forgeries.
• To connect you with a company, only when you say so: the roster, invite and link records exist to prove that a company link was made with your consent, and to know whether your worksite hours may be shown to that company.
• To get you paid on company jobs: confirmed hours roll into the company's weekly timesheet and, on Sun Painting Virginia jobs, Sun Painting's approval records.
• To run the crew on company jobs: foremen add and remove crew, confirm who was on site, sign the scope of work, and file photo reports.
• To document the work and settle questions: before/after photos, notes and the punch record protect you and the company if there is a dispute about a shift or a site.
• To run your subscription: the subscription identifiers and status decide whether report creation, emailing and self-service company linking are unlocked, and let you manage or restore a purchase.
• To communicate with you by text: sign-in and company-link codes, company invites, and, only with your consent, work-related texts.
• To keep records we are required to keep: consent records, signed acknowledgements, billing records, and payroll and project records.
• To run and protect the service: operational logs and error reports on our server.

We do not use your information for advertising, profiling, or any automated decision about you. Whether a shift is "on site" is a fact printed on your report and, on company jobs, a flag for a human supervisor to review; it is not a decision about your pay.

You

In the app you can see your name, mobile number and email, whether you are linked to a company, your worksites, your active company jobs, every shift you have worked with recorded minutes (and confirmed minutes on company jobs), whether it was verified on site and the reason if not, every report you have created and where it was sent, and your subscription status. The app does not show you your coordinates, your signature images, your sign-in devices or your consent history; ask us and we will send them (section 9).

Nobody, for an account on its own

If you signed up yourself and have not linked a company, your worksites and the hours you record at them are seen by no one but you (and, on our side, the staff who run the server, under the access rules in section 8) until you create a report or link a company. There is no roster you appear on and no company page that lists you.

The people you send a report to, and anyone who checks it

A signed hours report is a document you choose to hand out. Whoever you email it to, or share the file with, sees everything in it (section 2i), including your name, the last four digits of your number, your email address if you gave one (as the reply-to), and the coordinates of any worksite pin. Anyone who has the file, its report id, or its QR code can open the report's record page on this website or upload the file to the verifier, without signing in, and will see the numbers we hold for that report: your name and the last four digits of your number, the employer's name, the period and time zone, the totals, when it was issued and whether it has been revoked. The record page does not show the per-shift table or the pin coordinates; the file does. Whoever uploads the file itself to the verifier and gets an authentic, revoked or record-valid-file-altered result also sees the per-shift record we hold for that report (each shift's date, site name, times, hours, time source, location result and review status), but never the pin coordinates.

A company you link

A company is linked to your account only by one of the two consent steps in the Terms of Use: you accept its invite in the app, or you type its name and confirm with a code sent to your number. Once linked, the company's office sees you on its Sun Sub hours page: your name, mobile number, when you linked, whether you share your worksite hours, and every shift you record on its jobs. Your foreman and the other crew on each job see the crew list (name, mobile number, role and whether you are clocked in) as before. Shifts at your own worksites appear on the company's page only while you have switched on Share my worksite hours with my company; they show the worksite's name, the times and whether the shift was on site, not the pin coordinates. Switch it off and they disappear from the company's view. Your reports, your other worksites' details and your subscription are never shown to a company. A company whose pre-approved roster carries your number can see that number and name on its roster before you link, because its own office put it there.

Your foreman and the company you work for

On company jobs, your foreman adds and removes crew and marks who was present each day. The company owns its roster and receives confirmed hours as a weekly "App hours" timesheet. On Sun Painting Virginia jobs that is the same record Sun Painting uses to approve that company's hours for the job. If a company created your account for its crew, the company's office manages the link; you can still delete the account (section 9).

Sun Painting Virginia staff

Supervisors and project managers use the Field App Review page in spvaTrack for Sun Painting Virginia jobs. They can see field-app records only for the jobs they are assigned to; office administrators can see all jobs. For those jobs they see your name and mobile number; each company-job shift with its punch evidence (distance from the site, accuracy, and flags for offline, simulated-location and permission state; the underlying coordinates are part of the record); daily crew confirmations by name; photo reports with photos and notes; site-pin proposals on a map; and a crew directory with language, terms status, first and last sign-in, how the account was created, any complimentary-access date and who added you. Accounts that signed up on their own appear in that directory as "Independent (Sun Sub)"; their worksite shifts are not shown there. Staff confirm, reject or adjust company-job hours with a memo, approve or reject site pins, can grant complimentary access, and administrators can deactivate an account or revoke a report. Staff who administer the server can, in the course of that work, read any record on it.

The customer

Your hours are never shared with a customer. On Sun Painting Virginia jobs, site photos may be shown to the customer as a record of the work that was done. There is no automatic feed to customers: a Sun Painting staff member would share them deliberately, and the photos carry no embedded location data.

Service providers

These companies process data for us so the app can work. Each receives only what is listed, and none of them may use it for their own purposes.

• Twilio (text messaging and verification): your mobile number and the text of messages we send you; the replies you send us and the carrier details attached to them. With Twilio Verify, Twilio also generates, delivers and checks your sign-in and company-link codes, and applies its own fraud checks to code requests.
• Apple (app distribution and in-app subscriptions): Sun Sub is delivered through the App Store and TestFlight, and the in-app subscription is sold and billed by Apple. Apple receives from us only the random account token described in section 2j; we receive from Apple the transaction and status data listed there. What Apple collects when you install an app or make a purchase is governed by Apple's own privacy policy. On the phone, location, StoreKit and the Keychain are Apple system features; the sign-in token is not synced to iCloud.
• Stripe (card payments on our website): your name, mobile number, optional email address and an internal account number, so it can create your customer record and run the subscription; your card details, which you enter on Stripe's page and we never see. Stripe sends us the subscription events described in section 2j.
• Google (email): reports you email to an employer, and the alert emails about suspicious verifications, are sent through our Google email account, so Google handles the message, the recipient's address and the attached PDF as our email provider.
• Amazon Web Services (hosting): our server, database, report PDFs and photo files run on Amazon EC2 in the US East (Northern Virginia) region. Everything in section 2 is stored there.
• Google Cloud Translation (Spanish scope of work only): when someone opens a company job's scope-of-work document in Spanish, its text is sent to Google for translation. That text is the customer's estimate wording, the project title and address, and the customer's name and company. No crew data is sent.
• Google Maps (office review only): when a Sun Painting reviewer clicks "View on map" for a site pin a foreman proposed, their browser opens Google Maps at those coordinates.

Other business systems Sun Painting uses that are connected to the same texting service can read the text-message log (mobile numbers and message text) and send work texts through it. They are used to run Sun Painting's business, never for advertising.

Legal and business reasons

We will disclose information if required by a valid subpoena, court order or other legal process; to protect the rights, property or safety of Sun Painting Virginia, our users, our customers or the public (for example, sharing a forged report and the verification log with the employer it was presented to); or as part of a sale or merger of the business, in which case records go with the business under this policy.

Sun Painting Virginia sends work texts through a business texting service (Twilio). All messages are sent by or on behalf of Sun Painting Virginia.

• Sign-in codes are sent only when you request one on the sign-in screen. Requesting a code is your consent to receive that one message. Message and data rates may apply. Requests are limited per number, per network address and overall to stop abuse; when the limit is hit, wait a few minutes and try again.
• Company-link codes. When you type a company's name in Account → Company link, we send a second code to your number to confirm that it is really you linking the account. The app says a code was sent whether or not the company matched, so the screen cannot be used to find out which companies know which numbers.
• Company invites. When a company's foreman or office adds your number to a job or to their crew, you receive one text naming the company and, if there is one, the job, telling you to open the app to accept or decline, with instructions to reply STOP. If the company created your account for you, that text also carries the download link. The person who added you confirms that you gave them your number for work.
• Work-related texts (job assignments, shift and schedule notifications) are sent only if you tick the optional consent box on the sign-in screen. Ticking it sends a one-time confirmation text. Consent is not required to use the app or to work on any job. Today the only texts Sun Sub itself sends are the sign-in and company-link codes, the company invite, that confirmation, and replies to keywords.
• Message frequency varies. Message and data rates may apply.
• Opting out. Reply STOP to any message to stop work texts and company invites. You will get one confirmation and no further texts. Reply START to rejoin. STOP does not stop sign-in or company-link codes, which you receive only when you ask for one in the app. You can also tell us by phone or email and we will record it.
• Help. Reply HELP to any message, email support@sunpaintingva.com or call (434) 207-2025.
• Our number. Work texts and invites come from (434) 443-7550. Save it as Sun Painting Virginia. Codes are delivered by our verification provider and may arrive from a different number.
• Carriers are not liable for delayed or undelivered messages.

• Codes are valid for about 10 minutes and lock after too many wrong attempts. The record that a code was requested is kept as part of your account's sign-in history.
• Device sessions last 90 days, or until you sign out, delete your account, or an administrator deactivates it. A device record (with the hashed token, never the token itself) is kept for each sign-in.
• Hours, punches, daily crew confirmations, signatures, photos and notes are payroll and project records. We keep them for as long as we need them for payroll, project records, disputes, warranty questions and our legal obligations, which can be several years. Punches are append-only: a supervisor can adjust the confirmed minutes of a company-job shift, but the original punch, including its location reading, is never edited.
• Issued reports are kept indefinitely, including after you delete your account. The point of a signed report is that the person you gave it to can check it later; that only works if we still hold the record, the signature and the fingerprint of the file. A report can be revoked (marked as withdrawn, so the verifier answers "revoked") at your request or if it is found to rest on false records, but the record itself is not erased. The verification log is kept with the report.
• Worksites are archived, never deleted, because shifts and reports refer to them.
• Company link, invite and roster records are kept as the record of consent, including links you later cancel. A company can remove your number from its roster at any time.
• Subscription records (identifiers, status, billing events) are kept as billing records for as long as we are required to keep them, normally at least seven years for tax purposes.
• SMS consent records and message logs are kept as proof of consent for as long as we are required to keep them.
• Accounts you delete (Account → Delete account, or a request to us): the account is closed immediately. Your name is replaced by "Deleted user", your email address is removed, your mobile number is removed and replaced by a placeholder that keeps only its last four digits (so a report that says "phone ending in 1234" still matches its record), every phone is signed out, your worksites are archived, you are removed from company jobs and unlinked, and a card subscription on our website is cancelled. An App Store subscription is not cancelled by deleting your account, because only Apple can cancel it: cancel it first in iPhone Settings → your name → Subscriptions, or Apple will keep charging you (the confirmation in the app says so). An App Store subscription you keep can be attached to a new Sun Sub account you later create by tapping Restore purchases. Your shifts and reports stay attached to the closed account under the rules above; the name and last four digits printed inside a report you already issued do not change, because the report is signed. The number becomes free to create a new account, which starts empty.
• Dormant self-created accounts. If an account you created yourself has not signed in for 180 days and that number signs in again, the old account is retired and a new, empty account is created for the number. The retired account is closed the same way as a deleted one: signed out everywhere, unlinked, name and email removed, its worksites archived, its number replaced by a placeholder that keeps only the last four digits, and a card subscription on our website cancelled (on a best-effort basis; an App Store subscription is not cancelled). Its shifts and reports stay attached to the retired record; they are not shown to the new account.
• On your phone: signing out removes the sign-in token and the cached copy of your account, jobs and worksites. Punches that could not be uploaded stay on the phone, even after you sign out, until they are sent or refused (see section 2d).

• Encrypted in transit. The app talks to our server only over HTTPS (TLS) and allows no exceptions.
• Your sign-in token lives in the iOS Keychain on your phone. Our server stores only a one-way hash of it; a copy of our database would not contain a usable token.
• Codes are held and checked by our verification provider; if our server ever generates one itself, the copy it checks against is hashed, and every code expires after about 10 minutes.
• No account guessing. The sign-in screen gives the same reply whether or not a number has an account, and the company-link screen always says a code was sent, so neither can readily be used to find out who uses Sun Sub or who works for whom. Code requests are throttled per number and per network address.
• Company links need your consent twice over. A company can only be linked by you accepting its invite on a phone you are signed in to, or by your typed company name plus a fresh code to your number, and only if that company's office has put your number on its roster first.
• Access is limited. Every request from the app is checked against your account, your worksites and, on company jobs, your assignments and role. On the office side, supervisors and project managers see only the jobs they are assigned to; a company sees only its own linked workers. Photos are served only to signed-in staff with access to that job. Report PDFs are served only to the account that created them; the public verifier shows the summary record, not the file.
• Records are tamper-resistant. Punches are written once and never edited; live punches carry our server's time; offline punches are bounded and cannot overlap or backdate past your account; resent punches are recognised and not double-counted; a foreman's site pin has no effect until the office approves it; and a pin you set on your own worksite only counts for shifts that begin after it was set.
• Reports are signed. Our server signs each report's data with a private key that never leaves the server (RSA-PSS with SHA-256), publishes the matching public keys at /sunsub/keys, and keeps a fingerprint of the exact file it issued. Any change to the file is detected by the online verifier (byte-exact match against the file we issued). The embedded record is digitally signed and can be checked offline with our public key. The printed pages themselves are not signed — always trust the verifier's numbers, not the numbers printed on a file that fails the byte-exact check.
• Billing messages are verified. Apple's notifications and receipts are checked against Apple's root certificate, and Stripe's webhooks against a signing secret, before we change anything about your subscription; each event is applied at most once.
• Text-message webhooks from our messaging provider are signature-checked before we act on STOP, HELP or START.

No system is perfectly secure. If you think your account or a device has been misused, sign out of the app and contact us right away; an administrator can deactivate your account, which cuts off every device at once, and you (or your foreman) can set it up again afterwards.

Location permission

You choose While Using or Never in iOS Settings (the app never asks for Always), and you can change it at any time. Location must be on to clock in and to set a worksite pin — that is how Sun Sub places your hours at the site, and the app blocks a clock-in without it, showing a shortcut to Settings. Once you are clocked in, your hours keep recording even if location is turned off: your clock-out still records, marked "not verified". If you turn location off after allowing it, the app explains once, the next time you open it, why clocking in needs location and offers a shortcut to Settings. The Account tab shows your current setting, a short note on what location is used for, a "Why location?" link to the full explanation and, when location is off, a shortcut to Settings.

Worksite pins

A pin is optional. Without one, shifts at that worksite still record; they are simply marked not verified and a report says "—" for the location check. You can move a pin, change its radius, or archive the worksite at any time. Remember that a pin's coordinates are printed on reports that include shifts there.

Camera and photo library

Only foremen on company jobs are asked, and only when adding photos to a report. Declining only prevents adding photos.

Text messages

Reply STOP to stop work texts and invites, START to rejoin, HELP for help, or tell us by phone or email. Sign-in and company-link codes still arrive when you request one.

Your name and email

Change them in the app (Account). Your mobile number is your account and cannot be changed; to move to a new number, sign up with it and delete the old account.

Company link and sharing

Nothing links your account to a company until you accept an invite or confirm a link with a code. Share my worksite hours with my company is off by default and can be switched off again at any time. If you created the account yourself, Unlink (clock out first) removes you from the company's jobs and stops sharing; the hours you already recorded on its jobs stay in the company's records. Accounts a company created for its crew are managed by that company's office; ask them to remove you, or delete the account.

Subscription

Cancel an App Store subscription in iPhone Settings → your name → Subscriptions or through Manage subscription in the app; Apple decides refunds under its policies. Cancel a card subscription bought on our website through Manage subscription (Stripe's portal). Cancelling stops the next renewal and keeps the features until the end of the paid period. Deleting your account cancels a card subscription; it cannot cancel an App Store subscription, so cancel that with Apple first.

Reports you have issued

You can see and re-send every report in Account → My reports. You cannot edit a report; create a new one instead. If a report should no longer be relied on, ask us to revoke it and the verifier will say so to anyone who checks it.

Sign out

Sign out from the Account tab (finish your shift first; you cannot sign out while clocked in). Signing out revokes the token on that phone and clears your sign-in, account, job and worksite data from the app; punches still waiting to upload remain (see section 7). If you share a phone with someone, use "Upload now" on the Account tab so your pending punches are sent before you sign out.

See your hours

The My hours tab shows every shift with recorded minutes (and confirmed minutes on company jobs) and its verification status. If something looks wrong on a company job, talk to your foreman or supervisor, or contact us; at your own worksites, what was recorded is what a report shows.

Delete your account

Account → Delete account closes the account at once, after a confirmation; you cannot delete while clocked in, and an App Store subscription must be cancelled with Apple first. Section 7 lists exactly what is removed and what is kept. If you would rather a person handled it, or want a copy of your data first, ask us as described next.

Ask for your records, corrections or deletion

Email support@sunpaintingva.com or call (434) 207-2025 from the number on your account, or tell us which number it is. We may text that number to confirm it is you.

• Access: we will send you a copy of what we hold about you, including your shifts and punches with their location readings, your worksites and pins, your reports and their verification logs, your company link and invite records, your subscription records, roster confirmations naming you, your signatures and acknowledgements, your sign-in devices, and your SMS consent records.
• Correction: we will fix your name, email, language, time zone or company where the app does not let you do it yourself.
• Deletion: the same as the in-app button (section 7), plus deletion of what we are not required to keep, including your sign-in device records and unused code requests.
• What we cannot delete: shifts you recorded and reports you issued (so a report you handed to someone stays checkable), hours and punches on company jobs that have been confirmed or paid, signed acknowledgements, SMS consent and opt-out records, billing records, and photo reports attached to a project. These are payroll, consent, billing and project records that we are required to keep, or records whose whole purpose is to outlast the account; we will tell you which ones apply and for how long.

We aim to answer within 45 days, and we will tell you if we need longer.

Virginia, California and Canadian residents

Sun Painting Virginia is a Virginia business. Virginia's Consumer Data Protection Act and California's Consumer Privacy Act apply only to businesses above certain size thresholds and, in Virginia, do not cover information about you in an employment or contractor context. Canada's PIPEDA may apply to Canadian users. Whether or not a law requires it, you can make any of the requests above and we will handle them as described here.

Sun Sub is a work tool for adults. It is not directed to anyone under 18, and we do not knowingly collect information from anyone under 18. If you believe a minor has created an account or been added to a company's crew, tell us at support@sunpaintingva.com and we will close the account and remove the information we are not required to keep.

This is how the information in section 2 maps to Apple's App Privacy categories. Everything listed as collected is linked to your identity (your Sun Sub account) and used only for app functionality. None of it is used for tracking.

"Tracking" here has Apple's meaning: linking your data with other companies' data for advertising, or sharing it with data brokers. Sun Sub does neither.

When we change this policy we will post the new version at this address with a new effective date and version number. If a change is material, for example a new kind of data or a new way your location is used, we will also tell you before it takes effect: by asking you to accept updated terms in the app, or by another notice from Sun Painting Virginia.

Version history: 1.0, effective August 31, 2026 (first version). 1.1, effective September 4, 2026 (background location removed; location captured only at punches and foreman actions). 1.2, effective September 8, 2026 (open sign-up for anyone; worksites and pins; signed hours reports and the public verifier; company link with consent; subscriptions through the App Store and on our website; in-app account deletion). 1.3, effective October 29, 2026 (app version 1.4: the on-phone still-on-site check runs for the whole shift, in the background too, and clocks you out after 10 minutes off site; the check's readings stay on the phone; one local notification; the phone's "continuous / interrupted" word on the check is sent with the clock-out).

Questions, requests or concerns about this policy go to Sun Painting Virginia:

Ayuda en español: llame o escriba y le atendemos en español. Spanish-language help is available by phone or email.