Privacy Policy

1. Who We Are

HomeForge is a web application for contractors, home builders and renovation companies to write quotes, collect e-signatures, run jobs, track warranty and service requests, invoice customers and communicate with them. Customers of those contractors can use a free HomeForge account to review and sign quotes, follow their project and pay invoices.

HomeForge is operated by Methodforge LTD., Unit 300, 340 Midpark Way SE, Calgary, Alberta T2X 1P1, Canada ("Methodforge", "we", "our", "us").

This Privacy Policy explains what information we collect, how we use it, who we share it with, how long we keep it and the choices you have. It applies to this website (homeforge.app), the HomeForge application (crm.homeforge.app) and related services (together, the "Services").

2. Information We Collect

Information you give us

• Account information: your name, email address, phone number, company name, job title, role and password (stored only as a secure hash by our authentication provider).
• Business content: customers, properties, quotes, line items, jobs, schedules, change orders, service requests, invoices, purchase orders, vendor bills, notes, messages, documents and photos that you or your team enter or upload.
• Communications: messages you send through HomeForge, emails sent and received through the Services, and support, demo or contact form requests.
• Billing information: subscription and seat details. Card and bank details are entered directly with our payment processor, Stripe; we do not see or store full card numbers.

Information from sign-in providers

If you choose to sign in with Google or Microsoft, we receive basic profile information from that provider. What we receive from Google, and how we use it, is described in section 3.

Information collected automatically

• Device and browser details, IP address, and pages or features used.
• Log, error and performance information that helps us keep the Services reliable and secure.

3. Google User Data

HomeForge offers Sign in with Google as an optional way to create and sign in to a HomeForge account. This section explains exactly what we do with information we receive from Google.

Data we access

When you sign in with Google, HomeForge requests only the standard openid, email and profile scopes. Through these we receive:

• Your Google account email address and whether it is verified.
• Your name.
• A Google account identifier used to link your Google sign-in to your HomeForge account.

Google may also include your profile picture link in the profile it returns; we do not use or store it. HomeForge does not request access to Gmail, Google Drive, Google Calendar, Google Contacts or any other Google service or data.

How we use it

• To create your HomeForge account and sign you in to it.
• To pre-fill your name and email address on your account profile.
• To match you to an invitation from your company or your contractor that was sent to the same email address.
• To send you service emails about your account, such as security notices and messages about your project.

We do not use Google user data for advertising, we do not sell it, and we do not use it to train artificial intelligence or machine learning models.

How we share it

Your name and email address are visible to the HomeForge organization you belong to or work with (for example, your employer's administrators, or the contractor whose quote you are reviewing), because that is how the Services work. They are processed by our authentication and hosting provider, Google Firebase / Google Cloud. We do not share Google user data with anyone else, except where required by law or as part of a merger or acquisition where the recipient is bound by this Policy.

How we store and protect it

Google user data is stored in Google Firebase Authentication and Cloud Firestore, encrypted in transit (TLS) and at rest. Access is limited to the account holder, the organizations they work with, and a small number of Methodforge staff who need it to operate and support the Services.

Retention and deletion

We keep your Google user data for as long as your HomeForge account exists. You can ask us to delete your account and the associated data at any time by emailing support@homeforge.app. We delete it within 30 days of your request, except where we must keep limited records to meet legal, tax or accounting obligations. You can also remove HomeForge's access to your Google account at any time from your Google Account connections page.

Limited Use

HomeForge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How We Use Information

• Provide, operate and maintain the Services, including creating accounts and signing users in.
• Store and display the business content you and your team create, and share it with the customers you choose.
• Generate draft quotes and suggestions with Smith, our AI assistant, when you ask it to.
• Process subscriptions, invoices and online payments.
• Send your records to accounting software you connect, such as QuickBooks Online.
• Send service emails and notifications, such as reminders, signature requests and security notices.
• Respond to support, demo and contact requests.
• Monitor reliability, prevent fraud and abuse, and keep the Services secure.
• Comply with legal obligations and enforce our terms.

We send marketing emails only where you have agreed to receive them, and every marketing email includes a way to unsubscribe.

5. Smith AI

When you use Smith, the content needed for your request (for example, the quote you are working on) is sent to our AI provider, Anthropic, to generate a response. Anthropic processes this data on our behalf and does not use it to train its models. You review every suggestion Smith makes before it is saved or sent. Google user data is not sent to Smith.

6. QuickBooks Online

If an administrator connects your organization's QuickBooks Online company, HomeForge sends the invoices, vendor bills, purchase orders and payments you issue in HomeForge to that company, along with the customer and vendor details they need. To do this it reads only what it needs to match and update those records: your company name, country, home currency and sales tax setting, your tax codes and rates, accounts, and products and services, your existing customers and vendors, and transactions for the same customer or vendor on the same date, so that a retried update never creates a duplicate. HomeForge keeps only the QuickBooks identifiers, document number and total of each record it sends, the identifiers of the customers and vendors they are for, and, for its settings page, your company name, country, home currency, sales tax setting, tax codes and rates, and bank account names. It copies nothing else from QuickBooks and does not share your QuickBooks data with anyone else. Connection tokens are stored encrypted in Google Cloud and used only to make these updates. An administrator can disconnect at any time from Settings > Integrations, which revokes HomeForge's access with Intuit and deletes the connection tokens. The identifiers of records already sent are kept, so reconnecting the same company updates those records rather than duplicating them.

7. Legal Bases and Consent

Where the law requires a legal basis, we process personal information to perform our contract with you, for our legitimate interests in operating and securing the Services, to comply with legal obligations, and with your consent (for example, for marketing emails). You can withdraw consent at any time.

8. Sharing of Information

We do not sell or rent personal information. We share it only as follows:

• Within your organization and with your customers: content you create is visible to the people in your HomeForge organization according to their roles, and to the customers you share quotes, jobs or invoices with.
• Service providers who process data on our behalf under contract: Google Firebase / Google Cloud (authentication, database, file storage and application hosting), Microsoft Azure (website hosting), Brevo (sending and receiving email in the application), Stripe (payments and billing), Anthropic (Smith AI), Intuit (QuickBooks Online, when you connect it), Twilio SendGrid (contact form email), Cloudflare Turnstile (spam and bot protection on forms) and Google Fonts (web fonts on this website).
• Legal and safety: where required by law or legal process, or to protect the rights, property or safety of our users, the public or Methodforge.
• Business transfers: as part of a merger, acquisition or sale of assets, subject to this Policy.

Loading a page on this website sends your IP address and basic browser details to Microsoft Azure, which hosts the site, and to Google, which serves our web fonts. On the contact page they are also sent to Cloudflare, and submitting the contact form sends the details you enter to Twilio SendGrid. Each provider also handles this information under its own privacy policy.

9. Cookies and Similar Technologies

We use cookies and browser storage that are necessary to keep you signed in, remember your preferences such as light or dark mode, and protect forms from spam. We do not use advertising cookies.

10. Data Retention

We keep personal information for as long as your account is active and as needed to provide the Services. When an account is deleted, we delete or anonymize its personal information within 30 days, except for records we must keep for legal, tax, accounting or dispute-resolution purposes. Business content belonging to an organization is kept until the organization deletes it or closes its account.

11. Security

We protect information with encryption in transit and at rest, role-based access controls, and restricted staff access. No system is completely secure, and we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you as required by law.

12. International Transfers

Methodforge is based in Canada. Our service providers may store and process information in Canada, the United States and other countries. Where information is transferred, we rely on contractual and other safeguards to protect it.

13. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can update most account details from your HomeForge profile. To make any other request, including deleting your account, email support@homeforge.app. We respond within 30 days.

If your information was added to HomeForge by a contractor you work with, we may refer your request to that contractor, who controls that data.

14. Children

The Services are intended for businesses and adults. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new "Last updated" date and, for material changes, notify account holders by email or in the app.

16. Contact Us

Questions about this Privacy Policy or your information can be sent to support@homeforge.app or by mail to Methodforge LTD., Unit 300, 340 Midpark Way SE, Calgary, Alberta T2X 1P1, Canada.