Privacy Policy

Effective: 2026-10-27

Jesse R Oliveira, operator of Alloy and Alloy Field.

Information we collect

We receive account identifiers, name, verified email, and sign-in status from our authentication provider, Clerk. You may provide company details, role, company and job addresses, map coordinates, contact details, profile images, and information used to review company access. The service stores invitations, membership records, saved opportunities, estimates, proposals, drawings, uploaded files, project photos, schedules, deliveries, awards, and other workspace content you enter.

We also record notification preferences, accepted policy versions and acceptance times, and optional product-update email choices. Our hosting and authentication services process technical information such as IP addresses, browser/device information, requests, and security or diagnostic events to operate and protect the service. Open beta is free and does not require a payment card. Where an existing paid subscription or billing record is present, Stripe-hosted pages handle payment information and subscription management. Alloy stores company-to-provider customer and subscription identifiers, subscription and billing-period status, payment-event identifiers, trial dates, and referral-credit records needed to manage access and billing. Billing support may retain your request and information needed to verify and resolve it. Alloy’s own application forms and database do not store full payment card numbers or card security codes. We do not collect phone numbers for marketing texts in this release.

How we use information

We use information to authenticate users, manage companies and memberships, show relevant commercial jobs, calculate approximate nearby distances, deliver invitations and project notifications, store and share work as you request, support users, maintain existing subscription, trial and referral-credit records and provide billing support, investigate abuse, and maintain service reliability. Location checks use the company or job location you supply, not continuous tracking of your device. Optional product-update email choices are separate from project and account messages.

What other people can see

Company administrators can see company members and manage permitted access. A publisher’s open job listing, selected site location, contact information, scope, and requirements are available to eligible users browsing opportunities. Invitation-only jobs and project materials are limited by project access. Submitted proposals and project updates are shared with authorized participants. Private estimates are intended to remain private until you choose to share a proposal or other output.

Do not put confidential internal prices, personal information, or documents into public job descriptions or shared attachments unless you intend to disclose them. Recipients may keep copies after you remove content from Alloy.

Service providers and other disclosures

We use Cloudflare to host the service and store application data and uploaded files; Clerk for account authentication and verification; Resend for application email; Geocodio to convert submitted addresses into coordinates; and Stripe for hosted payment entry, recurring subscription billing, invoices, refunds, and subscription management. Checkout and subscription-management screens are disabled during open beta. Historical billing support may use Stripe company/customer identifiers; Stripe receives payment information directly on its hosted pages and sends payment and subscription status back to Alloy. Billing providers may retain records for their financial, security, fraud-prevention and legal obligations. An address lookup sends the relevant address to Geocodio. Email delivery sends the recipient address and message content to the email provider. These providers may process information in the United States and other locations where they operate.

Opening an external map or other third-party link sends you to that provider, whose privacy practices apply. Externally hosted images included in workspace content can also contact their hosting provider when displayed. We may also disclose information when required by law, to protect people and service security, or as part of a business transfer subject to applicable protections and notice requirements.

We do not operate an advertising network or sell personal information in this release. No advertising cookies or cross-site behavioral advertising tools have been intentionally added to the application. Authentication and infrastructure providers may process diagnostic and security information under their own policies.

Cookies, browser storage, and tracking choices

Sign-in uses essential session technologies. Browser storage preserves unfinished forms, interface preferences, and your tutorial status. See Cookies & Storage for details and controls. The current app does not change its behavior in response to a browser “Do Not Track” signal. It does not sell or share personal information for cross-context behavioral advertising; a Global Privacy Control signal does not enable any such activity.

Retention and security

Account and workspace records remain stored while needed to provide the service and support ongoing projects. This release does not automatically delete all records after a fixed period. We review closure and deletion requests individually; legal, financial recordkeeping, security, dispute, backup, and shared project-record needs may require retaining some information. We will explain material limitations when responding to your request. Do not assume deleting an account also deletes copies held by project participants.

We use access controls, authenticated sessions, and encrypted network connections. No service can guarantee absolute security. Protect your account, use appropriate sharing settings, and contact support promptly if you suspect unauthorized access.

Your choices and requests

You can update available account/company details and notification preferences through settings. Optional product emails can be turned off separately from project notifications. Text marketing is not enabled. Contact support@alloyforged.com to request access, correction, deletion, account closure, or assistance with a privacy concern. We may verify your identity and authority before responding; do not send passwords or identity documents unless a secure process is specifically arranged.

Depending on your location and the laws that apply to the operator, you may have additional rights, including rights to know, correct, delete, or obtain information, and to exercise applicable rights without unlawful discrimination. We will assess requests under applicable law.

Age and updates

Alloy is intended for adults using commercial construction services, not children under 18. Contact support if you believe a child has provided information. We will post changes here with a new effective date. For material changes, we will provide a notice in the service or by email and request renewed acknowledgment where appropriate.