Privacy policy

Last updated: 24 September 2026.

This policy explains what GradeLab stores, why, where, for how long, and how you delete it. It is written for the people who use the app (shop owners and technicians) and for the customers whose phones they inspect.

Who we are

GradeLab is an inspection app for independent phone repair shops and resellers, made and operated by an independent developer ("the developer", "we"). Contact: [email protected].

For the data a shop records about its customers and their devices, the shop is the party responsible for that data and GradeLab processes it on the shop's behalf. For your account, GradeLab is responsible.

What the app stores

• Your account: your email address, a password (stored hashed by our authentication provider) or a sign-in link, the time you signed in, and the identifier of the shop you belong to.
• Your shop: name, address, phone, email, logo and report terms, as entered by the owner, and the list of members and pending invitations (email addresses and roles).
• Inspections: the device's brand, model, storage, colour, IMEI and serial number; the photos taken during the inspection, each stamped with the shop name, the last digits of the IMEI, the photo slot and the time; the checklist answers, the cosmetic assessment and the grade; the technician's name and drawn signature; and, when the customer signs, the customer's name and drawn signature.
• Subscription: which plan the shop is on, the product bought, the store it was bought from and the renewal date. We never see payment details: the App Store and Google Play handle payment.
• Usage statistics: which features are used and how often (for example how many inspections and reports a shop completes, which plan it is on, app version and platform, and errors the app reports). We use this only in aggregate, to understand how GradeLab is used and to improve it. It is not used for advertising, not sold, and not shared with anyone for their own purposes.
• Technical data: our servers keep short-lived request logs with IP addresses and timestamps for security and debugging. The app does not use advertising identifiers and does not track you across other apps or websites.

Why we store it

• To run the service you signed up for: recording inspections, producing reports and keeping them in sync between the phones of a shop.
• To keep a reliable record: a completed inspection is evidence of a device's condition on a given day, so its photos, hashes, grade and signatures are kept unchanged.
• To bill subscriptions and enforce plan limits.
• To secure the service and answer support requests.
• To produce statistics about how the app is used, so we can improve it.

We do not sell personal data and we do not use it for advertising.

Where the law asks for a legal basis: providing the service you signed up for (contract), keeping the service secure, reliable and improving it (legitimate interest), and, for anything else, your consent, which you can withdraw.

Emails we send

We email you only about your account and the service: sign-in links, invitations, password resets, receipts and renewals from the store, security notices, and changes to the service or to these documents. We do not send marketing email unless you ask for it, and every marketing email would carry an unsubscribe link.

Where it is stored

Data is stored on our phone app (locally, on the device that recorded it and on the other phones of the same shop) and on our servers hosted by Supabase on Amazon Web Services in the United States. Photos and signatures are kept in private storage that only members of the shop can read.

If you use GradeLab outside the United States, your data is transferred to and stored there. We rely on the safeguards our providers offer for such transfers.

Providers that process data for us:

• Supabase (database, file storage, authentication, server functions): https://supabase.com/privacy
• RevenueCat (subscription management: receives your account identifier and purchase events from the stores; no payment details): https://www.revenuecat.com/privacy
• Google Analytics for Firebase (usage statistics: which screens and features are used, the shop's plan, app version, platform and a random app-instance identifier; never your name, email, IMEIs or photos; advertising features are switched off): https://firebase.google.com/support/privacy
• Sentry (crash and error reports: app version, device model and operating system, the screens involved and the technical details of the failure; never names, IMEIs, photos or your IP address): https://sentry.io/privacy/
• Apple App Store / Google Play (payment, receipts and app distribution, under their own privacy terms): https://www.apple.com/legal/privacy and https://policies.google.com/privacy
• Email delivery for sign-in links, invitations and password resets.

Each of them has its own privacy policy for the data it receives; we choose them with care but do not control them.

Public report links

A completed inspection gets a link and a QR code that the shop can hand to its customer or a buyer. Anyone holding the link can open the page. It shows the shop's name and logo, the device model, storage and colour, the photos with their hashes, the checklist answers and cosmetic assessment, the battery health, the grade with the reasons behind it (and, when the technician changed the computed grade, the reason they typed), the shop's report terms and the times of the signatures, with the IMEI masked to its last six digits. It never shows the full IMEI, the serial number, signer names, the signature images, or the notes technicians type on checklist items. Photo links on that page expire after one hour and are refreshed on each visit, and the page is rate limited. A shop can take the link out of circulation by deleting the inspection's shop data.

How long we keep it

• Account and shop data: for as long as the account or the shop exists.
• Inspections: for as long as the shop exists. They are the shop's business records; a technician leaving the shop does not remove them.
• Photos: deleted from our servers 12 months after the inspection is completed. The grade, checklist, signatures, the photo hashes and the public report page stay; the shop keeps the PDF it produced and the copies on its phones.
• Server logs: up to 7 days.
• Backups: our hosting provider keeps database backups for up to 7 days after a deletion, then they expire. Photos are not part of those backups.

Deleting your data

You can delete your data and your account at any time, without asking us and without giving a reason. Both options are in the app, under Settings, and take effect immediately.

• Delete account removes your login and everything on your phone. A shop you are the only member of is deleted with everything in it. A shop with other members keeps its inspections, because they are the shop's business records and the customer's report link must keep working; the technician name you typed stays on those signatures.
• Delete shop and all its data (owners) removes every device, inspection, photo, signature and invite of the shop from our servers and from your phone. Public report links stop working.

Without the app, email [email protected] from your account's address. See https://gradelabapp.com/delete-account.

If you are a customer whose phone was inspected and you want the record removed, contact the shop that inspected it; it holds the record. If you cannot reach the shop, write to us and we will help.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete the personal data we hold about you, to object to or restrict its processing, and to complain to a data protection authority. In the app you can see and correct your account and shop data, export a shop's inspections as CSV, and delete your account or your shop. For anything else, email [email protected]; we answer within 30 days.

Website and cookies

gradelabapp.com uses no advertising or analytics cookies and no third-party trackers. A public report page fetches the report and its photos from our servers when you open it, which places the same request logs as the app; nothing is stored in your browser beyond what is needed to display the page.

Children

GradeLab is a tool for businesses and is not intended for anyone under 18.

Security

Data travels encrypted (TLS). Access on the server is restricted per shop by database rules, so a member of one shop cannot read another shop's data. Photos are hashed at capture so any change can be detected. Keep your password private and sign out of shared phones.

Security incidents

If we become aware of a breach affecting your personal data, we will tell you and, where required, the relevant authority within the time the law sets, with what we know and what you can do. Our terms of use explain the limits of our responsibility for incidents that originate on your phones, your accounts or links you shared.

Changes to this policy

We will post changes here and update the date at the top. If a change affects how your data is used, the app will tell you before it applies.