Privacy Policy

1. Operator and scope

TakeMoveReturn is an independently operated construction tool tracking service operated from the People's Republic of China. TakeMoveReturn is an operating name, not a registered corporation. Contact contact@takemovereturn.com about this notice or a privacy request. Business customers decide which workers, tools and places they record. Legal roles for customer-controlled data depend on the law and processing context.

2. Information handled

Available features handle the following information:

• Account name if supplied, email, authentication and session information, company membership and role. Supabase Auth handles credentials; the application does not store plaintext account passwords.
• Worker name, optional phone and employee code, status, assigned tools and activity. Worker PINs are stored as derived values, not plaintext. Do not reuse a PIN as an employee code.
• Tool asset code, name, category, brand, model, serial number, condition, current holder and location where entered, plus TAKE, MOVE and RETURN history and timestamps.
• Damage severity and description, report and resolution status, service schedules, service dates, costs and notes entered by managers. Authorized users may attach private tool and damage photos or maintenance photos/PDFs, including their original filenames and file sizes.
• Customer-configured warehouses, trucks, job sites and other location labels or addresses. These are record locations, not live GPS coordinates.
• Support correspondence, privacy requests, account exports and company reports. Hosting and authentication providers may process IP address, browser/device signals and timestamps for delivery, sessions and security.

3. Files and payments

Optional tool photos, damage photos and maintenance attachments are stored in a dedicated private Cloudflare R2 bucket; file metadata and storage usage are stored in Supabase. Only authenticated workspace members can read ready files through the application. Authorized managers can upload or remove them subject to file-type, per-record attachment counts, 5 MB image limits, 10 MB maintenance-attachment limits, and plan-storage limits. Deleted objects may be retried by a scheduled cleanup; backups and provider retention may differ. For CSV/XLSX tool imports, the selected sheet is parsed in the browser; mapped tool fields, the filename and file size are sent to the server for validation and a background import job. The original spreadsheet file is not stored in R2. Import job rows and results are stored in Supabase; Cloudflare Queues carries job and batch identifiers, not the spreadsheet rows. Paid checkout is available through Waffo Pancake for eligible workspace owners. Waffo acts as Merchant of Record and handles payment-card information separately; TakeMoveReturn does not receive or store full card numbers. TakeMoveReturn receives limited checkout, order and subscription metadata needed to connect a paid plan to the workspace.

4. Purposes

We use information to authenticate users, operate company-scoped records and tool history, answer support and privacy requests, send account emails and protect the service. We do not sell personal information or run advertising profiling. Customers should avoid entering unnecessary personal information.

5. Providers and processing locations

Cloudflare hosts and delivers the site, runs background import jobs through Queues, and stores the application cache and private customer attachments in separate R2 buckets; Supabase provides authentication and the database; Resend sends account confirmation and recovery mail through Supabase SMTP; Waffo Pancake provides Merchant of Record checkout and payment-related services. The Supabase primary database region is us-west-1 (United States). Cloudflare Workers run on a global network; both R2 buckets report a Western North America location hint, not a residency guarantee. Resend identifies the United States as its primary processing location. Waffo.com Limited is incorporated in Hong Kong and publishes its own privacy and Merchant of Record terms. See /subprocessors. Turnstile, Stripe, GA4, PostHog and Sentry are not active integrations in the inspected application. International processing may occur; this page makes no universal transfer-law compliance claim.

6. Cookies and security

Essential authentication cookies keep signed-in sessions working. No application analytics or advertising cookies were found in the current code. Current controls include authenticated workspace access, role checks, tenant-scoped database policies and non-plaintext worker PIN storage. These reduce risk but cannot guarantee absolute security. Providers may use technical identifiers for their own security processing.

7. Retention

Workspace records and tool history are kept while a workspace remains active unless a valid request, legal duty or dispute requires a different outcome. Privacy requests are retained to track handling. Operational logs, support mail, provider backups and security records may have different provider or legal periods. Internal retention targets are not represented as automated cleanup already running. We review deletion individually and retain only what is reasonably needed for service, security and lawful obligations.

8. Access, export and deletion

Signed-in users can download a limited JSON export of their own account, profile, memberships and attributed activity, and submit a privacy request in settings. Company-wide CSV reports require owner or admin access. Neither export necessarily includes every record a person may be entitled to receive. For access, correction, restriction, a fuller export or deletion, contact contact@takemovereturn.com. We verify the requester and review customer-controlled records, other people's rights, backups and legal exceptions before acting. A request does not instantly erase an account; cancellation does not itself delete a workspace.

9. Rights, children and changes

Rights differ by applicable law and may include access, correction and deletion. The service is intended for business users, not children. Material processing changes will be reflected here with an updated date. Questions may be sent to contact@takemovereturn.com.