Legal

TradeScribe Privacy Policy

Effective date: 13 August 2026
Last updated: 13 August 2026

TradeScribe is an Android app for tradespeople. You record a voice note when you finish a job, and TradeScribe turns it into a written report, a draft invoice, and a list of extra work worth quoting. This policy explains what information the app handles, where it goes, and what your choices are.

TradeScribe is operated by FirstlinkAI (a sole trader based in Calamba, Philippines) (“FirstlinkAI”, “we”, “us”). You can reach us at aifirstlink@gmail.com.

1. The two kinds of data in TradeScribe

TradeScribe holds two different kinds of personal information, and our role is different for each:

1. Your information — your account, your business profile, your subscription. For this, FirstlinkAI is the data controller: we decide how it is used, and this policy describes that.
2. Your customers’ information — the names, addresses, phone numbers, photos, and voice recordings you put into jobs. This belongs to your business. You are the data controller for it; FirstlinkAI is a processor acting on your instructions (storing it, transcribing it, turning it into reports). We never use your customers’ details for our own purposes, never contact your customers, and never sell this data. Your responsibilities for this data are set out in the Terms of Service, §8.

2. What we collect and why

Your account and business

The content you create

What we do NOT collect

• No analytics or tracking. The app contains no analytics, advertising, or crash-reporting SDKs. We do not profile you, and there are no ads.
• No location data. The app does not read your device’s location.
• No contacts. We do not read your phone’s contact list. Customer details exist only because you type them in.
• No payment card details. Subscriptions are sold only through Google Play, which processes the payment on its own systems as merchant of record. We have no payment processor of our own and no card ever reaches us.
• No messages. Texts and emails to your customers open in your own messaging or email app and are sent from your own number or address. They never pass through our servers, and we cannot read them. The document a message links to is a separate thing, and it is on our servers: when you text a report or an invoice, the PDF is uploaded so the link has something to point at. The message stays private to you and your customer; the document does not. Documents you send by link, below, sets that out in full.
• No payments from your customers. TradeScribe never takes, holds, or moves money between you and the people you work for. An invoice is a document you send; “Mark as paid” is your own note that you were paid.

Data that stays on your phone and is never sent to us — for example a draft you create with no signal, before it syncs — is stored in the app’s local database on your device and is removed if you uninstall the app. A document you text to a customer is not in that category: pressing send uploads it.

Documents you send by link

A text message has no attachment field, so a text cannot carry a PDF. It used to mean the text said your report was ready and the report stayed on your phone. The text now carries a link instead, and this is exactly what that involves.

• Nothing is uploaded until you press send. When you text a report or an invoice, the app renders the PDF, uploads it to a private storage bucket, and puts a link to it in the message. Emailing attaches the PDF to the email and uploads nothing. The share sheet hands the file to the app you picked and uploads nothing. Only the text route creates a link.
• The link opens in an ordinary browser, with no account and no password. Your customer has no TradeScribe login and never will, so the link itself is the key. It looks like https://<our project>.supabase.co/functions/v1/share-document/<token>. A shorter, branded address is planned; links already in customers’ phones will keep working when it arrives.
• The token is unguessable. It is 27 random characters — 162 bits drawn from your phone’s cryptographic random number generator — so it cannot be found by trying addresses. We ask search engines not to index these pages, and they carry no listing anyone can browse.
• Unguessable is not the same as access-controlled, and we would rather say so than let you assume otherwise. The link checks nothing about who is opening it: not a phone number, not an email address, not a login. Anyone holding the link can open the document. Forwarding the text forwards the report or the invoice — with the customer’s name, the address, and the description of the work in it. That is the same bargain as a parcel-tracking page or a shared-file link, and it is what “your customer needs no account” costs. Text it to the person it is about, and send it knowing it can be passed on.
• We never store the link itself. What is stored is a SHA-256 hash of the token — a one-way scramble that cannot be run backwards. Nobody reading our database can rebuild a working link out of it. The cost of that is real and worth knowing: a link that has been sent cannot be read back or re-sent by anyone, including us. It can only be turned off and a new one issued.
• You can stop sharing a document from the app, and the link stops working on the next attempt to open it. Every request is checked against the database row before a single byte of the file is served, so switching the row off is immediate — there is no pre-signed address in the wild to outlive the decision. You do not have to send anything new and you do not have to ask us: the app can turn off the link for a report or an invoice you have already texted. Texting the same document again does it too, because issuing a new link turns off the previous one. You can still email aifirstlink@gmail.com and we will do it for you — but you no longer have to wait for us.
• What turning a link off cannot do is take a copy back. If your customer has already opened, downloaded or printed the PDF, that copy is theirs and nothing we or you can do will recall it. That is true however the link is turned off — by you in the app, by us, or automatically. We will not pretend otherwise.
• A link has no expiry date, and there is no setting to give it one. That is a decision rather than an omission, so here is the reasoning. A service report gets opened years after the job: a warranty claim, a landlord’s paperwork, a buyer’s surveyor when the house is sold. An invoice gets opened at tax time. A link that quietly died at 30 or 90 days would fail months after you sent it, to someone with no reason to suspect the app and no way to tell you it broke — and you would never hear about it either. A link that lives until it is turned off fails the other way round: the problem is visible, it is yours, and you can fix it the minute you decide to. That is the same side of the trade Xero, QuickBooks, FreshBooks, Stripe’s hosted invoices, Jobber and Housecall Pro all take on customer-facing document links, and we take it too. We do not offer a per-link expiry option, deliberately.
• One thing turns a link off without you asking: voiding an invoice. An invoice you have formally cancelled must not stay retrievable as though it were still owed, so voiding it revokes the link to it. That is the only event of its kind — nothing else in TradeScribe switches a link off by itself. The limit two bullets up still applies: it stops the link, it does not recall a copy your customer already downloaded.
• The link record does not know who you sent it to. It holds your business and job, which document it points at, the file name, where the file is kept, the hashed token, a count of fetches and the dates. There is no customer name, no phone number and no email address on it. The fetch count counts HTTP requests, not readers: a messaging app fetches a link to build its preview, so the first fetch often happens before your customer has touched anything. It is not a read receipt and the app never shows it as one.

3. How the AI pipeline works

When you record a voice note, this is exactly what happens:

1. The recording uploads to our storage (a private bucket at Supabase, our hosting provider) once you have signal.
2. Our server gives fal.ai, a transcription service, a link to the audio that expires after 15 minutes. fal.ai turns the speech into text and returns the transcript. The audio is all it gets — not your name, not your account details, not your customer list. (If the expiring link cannot be created, the audio is sent to fal.ai directly in the request instead. Same company, same recording, different plumbing.)
3. The transcript is then sent to Anthropic, whose Claude model writes the report, the summary, and the upsell suggestions. So that the report reads like a document about a real job, Anthropic is also given your customer’s name and the job address, along with your business name and trade, the job title, description and date, the length of the recording, your currency and tax label, and your price book. Your customer’s phone number and email address are not sent — the report never needs them. Anthropic’s commercial API terms do not permit it to use this content to train its models.
4. The finished report is stored in your account and pushed to your phone.

Nothing is sent anywhere until you press record, and nothing the AI writes is sent to a customer until you review it and press send.

4. Who we share data with

We do not sell personal data, and we do not share it with anyone for advertising. Data goes only to the service providers below, each of which processes it solely to provide TradeScribe and on our instructions:

One recipient is not on this list because it is not ours: the person you sent a link to. When you text a report or an invoice, you are handing that document to whoever ends up holding the link. We store and serve it on your instruction — we do not choose the recipient, do not know who they are, and do not record them. That disclosure is yours, made when you press send, and §8 of the Terms of Service is where your responsibility for it is set out.

We will also disclose information if the law genuinely requires it, or to protect the safety of our users. If FirstlinkAI is ever acquired or merges, data would transfer to the successor under this same policy, and we would tell you first.

5. Where data lives, and international transfers

Your synced data is hosted by Supabase in Singapore (ap-southeast-1). The AI providers above process data in the United States. So if you work in the UK, the EU, the US or anywhere else, your data is stored outside your own country.

Where data moves from the UK, the EEA, or another region with transfer rules, we rely on the providers’ standard contractual clauses and equivalent safeguards.

6. How long we keep it

• Content you delete in the app (a job, a recording, a customer) disappears from the app immediately and stops counting toward your plan limits. On our servers it is marked as deleted rather than erased on the spot. That marker is what carries the deletion to your other devices and stops the item coming back on the next sync — a record that simply vanished would be indistinguishable from one that had not synced yet, and would reappear. Photos, recordings and report PDFs in file storage are also retained at this stage.
• If you want something erased for good rather than marked deleted, ask us at aifirstlink@gmail.com and we will remove it, including any photo, recording or PDF attached to it. We will confirm when it is done.
• A document you shared by link stays live until the link is turned off. A share link has no expiry date, by default or by option: it is long-lived until revoked, and there is no per-link expiry setting to change that. That is deliberate, and it is the choice whose failure mode is recoverable — a customer looking for last year’s certificate finds it, and a tradesperson who wants a link dead can turn it off in the app in seconds. The other default, links that quietly rot, fails silently months later to someone with no reason to suspect the app and no way to tell you. The reasoning in full, and the one event that revokes a link on its own — voiding an invoice — are in §2, “Documents you send by link”. Turning a link off stops it serving; it does not delete the file, and it cannot recall a copy already downloaded. The uploaded PDF and the link record are kept on the same terms as everything else in your account — until you ask for them to be erased, or until the account is closed.
• Your account and everything in it — every record, every recording, every photo, every generated document — is erased when you ask us to close the account. See §8. Deletion is completed within 30 days of the request. Two things survive it, and the next two bullets are both of them.
• One record of your free trial is kept after deletion, on purpose. The free plan is 3 jobs, once, for the life of the account. If closing the account reset that count, anyone could delete and sign up again with the same address for another 3 free jobs. So we keep a one-way hash of your email address, the number of free-trial jobs used, and the dates — and nothing else. A one-way hash is your address put through a scrambling function that cannot be run backwards: we cannot read your address out of it and we do not store the address. We can check whether an address typed at sign-up matches it, which is the only thing it is for. It carries no name, no job content, nothing about your customers, and it is not linked to your account, which is why deleting the account does not take it with it. We keep it indefinitely, because an allowance that expires is not an allowance. In practice: re-registering with the same email address does not give you a fresh 3 jobs. A different address does — this closes the obvious loop, not every one. Because we can match it back to an address, we treat it as personal data rather than calling it anonymous; our basis for keeping it is legitimate interests (stopping a one-time free trial being reset at will), and it is the one item excepted from an erasure request. See §8 if you want to object to that.
• Subscription and billing records are kept as long as tax and accounting law requires, even after account deletion. These records do not include your job content.
• Backups. We do not run scheduled backups. Our hosting plan does not include them, so there is no backup copy of your data for deleted content to linger in — when a record is deleted it is gone from our systems, with no retention window to wait out. The other side of that, said plainly because it is the part that matters to you: if you delete something by mistake, we cannot restore it. Export or send yourself anything you need to keep before you delete it.

Invoices and reports in your account are your business records. Before you delete anything, export or send yourself copies of what you need to keep — deletion is permanent, and we cannot recover deleted data for you.

7. Security

• All traffic between the app, our servers, and our providers is encrypted in transit (TLS).
• Recordings, photos, reports, and logos are stored in private buckets; nothing is publicly listable or guessable.
• Every database row is protected by row-level security: your data is locked to your business, and no other TradeScribe user can query it.
• Sign-in tokens are kept in your phone’s secure hardware-backed keystore, not in plain storage.
• Share links are the one thing here that a person without an account can use, so they are worth stating precisely. The token is 162 bits of cryptographic randomness and only its SHA-256 hash is stored, so a copy of our database yields no working link. Every request is checked against the database before any file is served, which is what makes turning a link off take effect at once. But the protection is the unguessability of the address and nothing else — the link does not check who is opening it, so whoever holds it gets the document. See Documents you send by link in §2.

No system is perfectly secure, but if we learn of a breach affecting your data, we will notify you and the relevant authorities as the law requires.

8. Your rights and choices

You can, at any time:

• See and edit almost everything we hold about you directly in the app — jobs, customers, recordings, reports, your profile, your branding.
• Delete individual content in the app.
• Stop sharing a document. You can turn off the link to a report or an invoice you have already texted from the app, without sending anything new and without asking us. Texting the same document again also replaces the old link and kills it, and voiding an invoice turns off its link automatically. If you would rather we did it, email us and we will. See Documents you send by link — including the one thing revoking cannot do, which is recall a copy your customer already downloaded.
• Delete your account and its data — the process, timescales, exactly what is removed, and the one record we deliberately keep are described at https://tradescribe.firstlinkai.com/delete-account and in the app.
• Turn off notifications in your phone’s settings at any time.
• Cancel your subscription in Google Play, which is where every TradeScribe subscription is bought — see the Terms of Service.

If you are in the UK or the European Economic Area, you additionally have the rights of access, rectification, erasure, restriction, portability, and objection under the UK GDPR / GDPR, and the right to complain to your supervisory authority (in the UK, the ICO). Our legal bases are: performance of our contract with you (running the service), legitimate interests (securing and improving it, and stopping the one-time free trial being reset by deleting an account and signing up again), and legal obligation (billing records). If you are a California resident, you have equivalent rights under the CCPA/CPRA; we do not “sell” or “share” personal information as those terms are defined there.

To exercise any of these rights, email aifirstlink@gmail.com. We respond within 30 days.

One exception to erasure, stated plainly. The free-trial record described in §6 — the one-way hash of your email address and the count of trial jobs used — is not deleted when you ask us to delete everything else. It is kept on legitimate-interests grounds, and deleting it would hand back a one-time free allowance on request, which is the whole thing it exists to prevent. You can object to it under GDPR Article 21: email us, tell us your situation, and we will weigh it and reply rather than send you a form letter.

If a request concerns your customer’s data (for example, a homeowner asks us to delete a recording that mentions them), we will refer the request to you, the tradesperson, as the controller of that data — and help you honour it.

9. Children

TradeScribe is a business tool for working tradespeople. It is not directed at children, and you must be at least 18 to hold an account.

10. Changes to this policy

If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect, and update the date at the top. The current version always lives at https://tradescribe.firstlinkai.com/privacy.

11. Contact

FirstlinkAI — sole trader
Calamba, Philippines
Email: aifirstlink@gmail.com
Support: aifirstlink@gmail.com