Privacy notice

Subscription and enrollment records

Apple processes App Store purchases, and Stripe processes company web subscriptions. Fetch stores verified transaction references, subscription periods and status, seat counts, account-generation bindings, and minimal records needed to prevent duplicate subscriptions or repeated trials. Fetch does not receive full payment-card numbers from these billing flows. Pseudonymous purchase-ownership and provider-choice records may remain after account deletion to prevent transferring another account’s purchase or creating duplicate billing; creating a new account does not automatically transfer an old subscription. Verification email is sent through the configured email delivery provider. New public accounts do not receive paid access until a subscription or explicit complimentary grant is verified.

What the app stores

Fetch StormOps stores property pins, editable contact fields, canvassing attempts and opportunity stages, inspection and claim fields, optional project and collected values, notes, assignments, routes, follow-ups, territories, priority-score factors, saved storm-report snapshots, generated evidence cases, and generated drone-report records. Private lead-handoff requests can include a message from one workspace member and a decision note from an authorized manager; those messages remain part of the company's protected lead history and are not a public feed. Each signed-in member may save the name that homeowner reports should list as the first contact. Photos are stored in private object storage. Online JPG and PNG uploads are stored as the verified bytes supplied by the member, so embedded image metadata such as camera details or coordinates can remain; photos compressed through the offline queue are re-encoded and ordinarily do not retain the original embedded metadata. Members should remove metadata they do not want their authorized company workspace to retain. A timestamped activity log records important property, status, pipeline, follow-up, and evidence-report changes. Public support requests store the requester's name, contact email, optional company name, selected topic, message, status, and submission time. To limit abuse of that public form, Fetch StormOps derives a 32-hex-character, 128-bit truncated SHA-256 key from the submitting connection address and stores the derived key—not the raw address—in expiring public-support rate-limit rows. The key is used only for service security and App Functionality, never advertising or tracking.

Sign-in information

Public enrollment, when enabled, verifies an email address before creating a private account and workspace. Enrollment verification links expire after 15 minutes; the server stores a hash rather than the raw link secret. Expired verification records are removed by bounded cleanup on enrollment requests and scheduled maintenance, so physical removal may occur after expiry. An invitation is required to join another company’s private workspace. An invited member uses the exact invited email address and may choose a separate Fetch StormOps password. The Fetch password is transmitted over TLS and converted server-side into a salted, deliberately slow one-way verifier protected by a server-side secret. Fetch StormOps never stores a plaintext or reversible password. Google and Apple sign-in may also be offered as optional methods for separately approved identities; Fetch StormOps never receives those providers' passwords and does not link accounts merely because their email addresses match. For Sign in with Apple, Fetch StormOps retains each distinct revocable refresh credential issued for Fetch StormOps so it can revoke the authorization during account deletion. Each credential is encrypted before database storage, is never returned to the app, and is cleared with its stored Apple subject hash after Apple confirms revocation. If Apple is temporarily unavailable, local identity cleanup remains pending and retries instead of silently completing without revocation. Accounts that have not used Apple sign-in do not create Apple revocation credentials or contact Apple during deletion. Deleting Fetch StormOps access does not delete a member's separate Google, Apple, or email-provider account.

Product reliability and outcome measurement

Fetch StormOps records a limited set of authenticated product events—such as app opens, storm-scan success and duration, report and evidence-case generation, routes, navigation launches, appointments, and recorded inspection outcomes—to measure field reliability and improve the workflow. Navigation events record that directions were launched for a workspace pin but do not copy the address or coordinates into product-event metadata. Event metadata is restricted and does not accept homeowner names, addresses, phone numbers, email addresses, notes, claim numbers, or photo content. Events remain associated with the workspace and acting member so authorized analytics can be scoped correctly; member name, email or account identifier may label or filter authorized per-representative analytics, and optional project values, collected values, pipeline stages, inspection outcomes, and activity records may be aggregated for company workflow analytics. Departing-member attribution is deidentified. Fetch StormOps uses these records for operations, pilot validation, and aggregate evidence-to-inspection calibration, not advertising.

Homeowner and contact information

Fetch StormOps does not automatically retrieve homeowner identities from public-record databases. Homeowner names, phone numbers, and email addresses are entered manually by authorized workspace members based on direct contact, permission, or another lawful source. Workspace members are responsible for entering and using contact information lawfully and honoring do-not-knock and do-not-contact instructions.

Location data

Fetch StormOps requests a one-time location when an authorized member opens the field map so it can start at the member's current area. Depending on the member's device setting, the operating system may provide a precise or approximate location; Fetch StormOps accepts either result and records the accuracy supplied by the device. If the member turns on live tracking, the app continues using that device location while Fetch StormOps is open to follow the map, order nearby stops, and show recent team presence. Turning tracking off clears the saved live-presence coordinate, and stale live presence is cleared after approximately two minutes without an update. The web app, Android Trusted Web Activity, and native iPhone app use location only while Fetch StormOps is open; none requests background location or runs continuous background GPS. Fetch StormOps does not use location for advertising.

Roof pitch reader

The optional roof pitch reader asks for motion access only after a member starts it and may ask for rear-camera access only after the member turns on the alignment guide. It calculates the displayed angle from the phone's gravity sensor; the camera view is not recorded, uploaded, or stored. Pitch readings remain on the device until the member closes the tool and are not added to a property record automatically.

Notifications

If a member enables background alerts, Fetch StormOps stores that device's notification registration, alert coordinates, radius, and selected hail and wind minimums. The web and Android experiences use a Web Push subscription delegated through the browser that owns the verified Fetch StormOps host; the Android shell does not add Firebase or a separate FCM token. The native iPhone app instead registers an APNs device token linked to the signed-in member and company workspace; Apple receives that token and the generic notification payload when native delivery is requested. When the 24/7 scheduler is connected, the server checks public storm sources every five minutes and uses those settings only to deliver requested storm and follow-up notifications. Lock-screen notifications use generic wording and do not include homeowner names, property addresses, notes, claim information, or the member's saved alert coordinate. Alert deliveries are deduplicated and retry through a bounded outbox. Turning alerts off deactivates the registration; notification permission can also be removed in the browser, Android, or iPhone settings.

Weather, maps, and address matching

The app requests weather, geocoding, and map imagery from third-party sources. Queries may include a map coordinate or address. Mapbox supplies the primary satellite and street map, with USGS/USDA and OpenStreetMap imagery available as a fallback. Address suggestions use the OpenStreetMap-based Photon service and may use the current map coordinate to infer nearby city and state context for a partial street address; submitted U.S. street addresses may be checked with the U.S. Census Geocoder, and dropped points may use OpenStreetMap reverse geocoding to check nearby address context. Fetch StormOps sends the saved property coordinate to the server-side Mapbox Geocoding API to find a street address. Requests use permanent geocoding so an accepted address can remain in the company CRM and its authorized offline cache. An unambiguous rooftop candidate within 10 metres may be attached automatically; other nearby numbered addresses are shown for explicit confirmation. A rooftop proximity match is not a guarantee of parcel ownership. Existing addresses change only when a member chooses or enters a correction. The tapped roof coordinate never changes during address lookup, and requests do not include homeowner identity. Before navigation, Fetch StormOps may recheck the entered address against those free address sources solely to warn when it appears materially separated from the saved roof pin. A member's preferred navigation app is stored only in that browser on that device and is not a company-wide setting; launching directions sends the saved pin coordinate to the selected maps provider. If live tracking is enabled while Fetch StormOps remains open, the current coordinate can also reveal the arrival actions when the device is near the active route stop. Address reports query NOAA/NWS/NCEI, Iowa Environmental Mesonet, CoCoRaHS, and, for Texas addresses, the Texas Water Development Board's TexMesonet. Fetch StormOps also archives storm reports and radar-cell snapshots it observes so later reports can show a timeline. Mapbox, Apple Maps, Google Maps, NOAA/NWS/NCEI, Iowa Environmental Mesonet, CoCoRaHS, TWDB/TexMesonet, OpenStreetMap/Photon, the U.S. Census Bureau, and USGS/USDA imagery services apply their own privacy practices.

Sharing and retention

Workspace data is shared with members authorized for that workspace and with infrastructure providers needed to operate the app. Fetch StormOps requires service providers that process user data for the service to protect it consistently with this notice and applicable privacy and security obligations. Each company workspace keeps separate properties, settings, evidence cases, drone reports, analytics, photos, invitations, and team access. Fetch StormOps does not sell workspace data or use it for third-party advertising. An evidence case freezes the selected property, saved public-weather report, workflow, inspection checklist, verified photo index, and activity history at generation time. A drone report freezes the selected verified-photo manifest, contractor-entered inspection observations, saved report-contact name, and exact address-storm snapshot; each report's SHA-256 integrity reference is verified before download. Deleted properties and photos are first moved to Recently Deleted so an owner or administrator can correct an accidental deletion; their private photo objects are not publicly accessible. Recently Deleted records, evidence cases, drone reports, and product events remain in private workspace storage until the workspace is permanently deleted; Fetch StormOps does not currently promise automatic purging after a fixed number of days. Pending invitation records expire after seven days; raw invitation secrets are never stored. Support requests are visible only to the Fetch StormOps site owner, remain open until addressed, and are automatically removed 90 days after resolution. Each public-support submission also creates aligned one-hour and 24-hour connection-key buckets. The hourly bucket's configured expiry falls one to two hours after submission and the longest daily bucket's configured expiry falls 24 to 48 hours after submission. Expired rate-limit rows are purged opportunistically and by daily maintenance, so Fetch StormOps does not promise physical deletion at the exact expiry instant. Complete Fetch StormOps account deletion removes the identity's memberships across all companies, Fetch password credential and outstanding recovery records, saved presence, notification registrations, consent records, and direct attribution; retained company business records are deidentified. Permanent workspace deletion closes access immediately and uses a retrying deletion job to remove workspace memberships, field records, evidence cases, drone reports, product events, invitations, consent records, plan records, and private photo objects. The separate public storm archive is not user or workspace data.

Your controls

Members can edit field records, turn off tracking, disable notifications, switch among companies where they have active membership, and initiate complete deletion of their Fetch StormOps identity across all company memberships from account controls. Deletion is blocked while the identity owns a workspace; every owned workspace must first be transferred to an active administrator or permanently deleted. Owners and administrators control roster membership, secure invitations, workspace filters, bulk exports, Recently Deleted recovery, and property or photo removal. The portable workspace archive includes structured records and a private-photo manifest, but not the photo files themselves; some history sections are preservation-only and its in-app restore is not a full provider backup. Deleting a Fetch StormOps account removes its Fetch password credential and recovery records but does not delete a separate Google, Apple, or email-provider account. The public account-deletion page explains each path. For workspace access, export, correction, or deletion questions, contact the workspace owner or administrator.

Security

Fetch StormOps relies on verified public enrollment or invitation-bound email access, salted deliberately slow password verifiers protected by a server-side secret, optional verified Google or Apple sign-in, signed secure sessions, server-side role checks, workspace-scoped database queries, private object storage, expiring invitation tokens stored only as SHA-256 hashes, request-rate limits, no-store API responses, and an activity log for important changes. Plaintext and reversible passwords are never stored. Security measures reduce risk but no internet service can guarantee absolute security. Do not share passwords, invitation links, exported reports, or downloaded archives with unauthorized people. Report suspected unauthorized access through the Support page and remove the affected member or invitation promptly.

Children

Fetch StormOps is a business service for adults and is not directed to children under 13. Workspace owners must not invite children or knowingly enter children's personal information into the service. If you believe a child's information was submitted, use the Support page so the record and workspace authority can be verified and addressed.

Changes and contact

Material changes to this notice will carry a new effective date and may require signed-in members to acknowledge the updated notice before continuing. The workspace owner is the primary contact for company-controlled field records. For product security, access, or privacy help, use the public Support page.

Important weather limitation

Fetch StormOps displays qualifying records returned by its selected public sources for the requested area and rolling 365-day window, but no public archive captures every hailstone or guarantees complete geographic coverage. The map starts at 0.75-inch hail and 50 mph wind. Address reports include hail from 0.50 inch and wind from 50 mph, and only return point reports, radar signatures, or archived swaths within 1.0 mile of the property coordinate. The hard one-mile geodesic zones drawn around 1-inch-or-greater radar signatures visualize that distance rule. A star marks the episode's maximum-size signature center, while dark-to-light shading encodes distance from that point; neither the star nor the shading is a measured impact, damage, or hail-intensity swath. Radar guidance and preliminary storm reports do not prove that hail, wind, or damage occurred at a specific structure and should not be treated as an insurance or engineering determination.

Publisher and contact

Fetch StormOps is operated by The Cross & Company LLC.

Support: support@getfetchroofing.com · (470) 652-0023
Privacy and security: privacy@getfetchroofing.com