Privacy Policy

Last updated: September 17, 2026

Draft for review. Have a qualified attorney review this policy before public launch, and add your legal business name and contact address.

Who we are

Woodchuck is software that tree care businesses (“Businesses”) use to manage places where they drop wood chips and logs. This policy explains what information Woodchuck handles and how.

Two kinds of people

Account users — owners and staff of a Business who sign in to Woodchuck.
Drop recipients — homeowners and others whose details a Business stores, including people who fill in a Business's signup form.

For drop recipients' information, the Business decides what is collected and why; Woodchuck processes it on the Business's behalf. Questions or requests about that information should go to the Business that collected it, which can view, export and delete it in Woodchuck.

What we collect

Account users: email address, hashed password, the Businesses you belong to and your role, and an activity log of sensitive actions.
Drop recipients: name, drop-off address and map location, phone number, drop preferences, notes, and the date you agreed to the signup terms.
Security data: a one-way, salted fingerprint of the IP address that submitted a signup form, used only to limit abuse.
Integration credentials: tokens a Business provides to connect messaging tools. These are encrypted with AES-256 and never shown again after they're saved.

How information is used

To rank drop sites, route crews and send dispatch messages a Business requests.
To let a Business contact drop recipients about drops.
To secure the service, prevent abuse and fix problems.

We do not sell personal information or use it for advertising.

Service providers

We use these providers to run Woodchuck: Supabase (database and sign-in), Netlify (hosting), Geocodio and Mapbox (turning addresses into map locations and calculating routes), and Google Fonts (typefaces). A Business may also connect its own messaging tools (for example Telegram, GroupMe, WhatsApp, Slack, Discord, Microsoft Teams, Quo or Twilio). Messages sent through those tools are subject to the tool's own terms.

Separation between Businesses

Each Business's data is walled off at the database level. People can only access a Business's data if that Business has added them.

Retention

Signup requests that aren't approved or rejected are deleted after 180 days. Rejected requests are deleted immediately.
Expired invitations are deleted after 30 days, and activity logs after one year.
When a Business owner deletes a Business, all of its data is deleted right away. Database backups age out on the provider's schedule.

Your choices and rights

Account users can update or delete their data from inside the app, or by contacting us. Drop recipients should contact the Business that holds their details, which can export or delete them. Depending on where you live, you may have extra rights to access, correct or delete your information. We will help Businesses respond to those requests.

Security

We use encryption in transit (HTTPS), encryption for integration credentials, role-based access, database-level separation between Businesses, and strict browser security headers. No system is perfectly secure. If we learn of a breach that affects your information, we will notify the affected Businesses as required by law.

Children

Woodchuck is not meant for children under 16, and we don't knowingly collect their information.

Changes

We will post any changes here and update the date above. For significant changes, we will tell account users in the app or by email.

Contact

[Add your support email and mailing address here.]