Privacy Policy

01Who we are

Start Here is a set of shop-floor tools — a box maker, a nut and bolt generator, a measurement vault, cut-list and setup calculators — operated by Start Here Tooling Co. (“Start Here”, “we”, “us”). This policy covers starthere00.com, the signed-in app, and our mobile app.

Questions about anything here go to zero@starthere00.com, or through the support form.

02What we collect

Account information

Your email address, the name you give us, and your preferred units (mm or inches). Passwords are handled by our authentication provider and stored only as salted hashes — we never see or store your plaintext password.

What you make

The work you save: projects, objects, cut pieces, measurements, box and nut-and-bolt designs, machine setups, checklists, notes, and saved email addresses you send cut lists to. All measurements are stored in millimetres; mm/inch is a display preference only.

Voice capture

If you use voice measurement capture, we process the audio you record to turn it into a number. Audio is sent to our speech-to-text provider for transcription, and the resulting text is sent to our AI provider to extract the measurement. We keep the parsed measurement and, where you have corrected a result, the correction — so the tool gets better at hearing you. We do not use your recordings to train third-party AI models.

The recording itself is processed ephemerally: it is held in memory only as long as it takes to transcribe and parse, and is not written to our storage or kept after the request that produced it. The measurement is what survives. Your device may also keep its own temporary copy of the clip until the app finishes with it — that copy never leaves the device.

Payment information

Subscriptions and Scrap Bin purchases are processed by Stripe. Card numbers never reach our servers. We store the subscription status, plan, billing period, and the Stripe identifiers needed to keep your account in sync.

Usage and device data

Pages viewed, tools used, features clicked, which variant of an A/B test you saw, approximate location derived from IP, browser and device type, and IP address. IP addresses are also used to rate-limit public forms and abuse-prone endpoints.

What you send us

Messages you submit through the support or contact forms, including your name, email and whatever you write in them.

03How we use it

• Run the tools and save your work between sessions.
• Authenticate you and keep your account secure.
• Take payment, manage subscriptions, and send receipts.
• Answer support requests — the email you write from is used to reply to you.
• Send service email you can't opt out of while you hold an account: welcome, billing receipts, failed payments, cancellations.
• Send marketing email and our newsletter, only where you asked for it. Every one has an unsubscribe link.
• Understand what people actually use, measure conversion, and run A/B tests on copy and layout.
• Detect and block abuse, spam, and prompt-injection attempts against our AI-backed features.
• Meet our legal and tax obligations.

04Why we are allowed to (UK/EU)

If you are in the UK or EEA, we rely on: contract — to give you the service you signed up for and take payment; legitimate interests — to secure the service, prevent abuse, and understand usage in aggregate; consent — for marketing email, non-essential cookies, and voice capture, which you can withdraw at any time; and legal obligation — for tax and accounting records.

05Who we share it with

We use the following providers to run the service. Each receives only what it needs, and each is bound to handle it on our instructions.

• Supabase — database, authentication and file storage. Holds your account and everything you save.
• Vercel — hosting, request logs, and privacy-friendly traffic analytics.
• Stripe — payments, subscriptions and invoices.
• Resend — delivery of transactional and support email.
• AssemblyAI — speech-to-text for voice measurement capture.
• Anthropic — parsing a transcript into a structured measurement.
• Google — Analytics and Tag Manager for usage measurement; Search Console for search performance.
• Meta — advertising conversion measurement. Where we send an email address it is hashed before it leaves our servers.
• Notion — our internal log of contact-form enquiries and orders.
• beehiiv — newsletter delivery, if you subscribe.
• Twilio — SMS, where you have opted into text-message features.

Transfers from our servers

Some of the sharing above happens on our servers rather than in your browser or app: we send your email address and subscription details to Stripe to bill you, your email address and message text to Resend to deliver mail, your recorded audio to AssemblyAI and the resulting transcript to Anthropic, contact-form submissions to Notion, an email address to beehiiv when you subscribe to the newsletter, a hashed email address to Meta for conversion measurement, and a phone number to Twilio only where you have opted into text-message features. This happens server-to-server, so it is invisible from your device — which is exactly why it is listed here.

We may also disclose information if the law requires it, to enforce our User Agreement, or as part of a merger or sale — in which case we will tell you before your information moves.

06What our apps send from your device

Software libraries built into an app can send data off your device on their own account, whether or not it ever reaches us. Here is everything in ours that does.

Mobile app (iOS and Android)

• Supabase SDK — carries your sign-in and your saved work between the app and our database. Your session token is held in the device's secure keychain.
• Expo / EAS Updates — checks for an over-the-air update to the app. That check sends your app version, platform and device model to Expo's servers. It carries none of your account data.
• Our own API — the measurements, recordings and settings you create in the app, sent to starthere00.com under your account.

Website

In the browser we load Google Analytics and Tag Manager, the Meta pixel, and Vercel's analytics. These send page URLs, referrer, device and browser type, approximate location from IP, and the identifiers described under Cookies. Stripe's hosted checkout collects your card details directly — that data goes to Stripe, not to us.

Webviews and links out

The mobile app does not collect or transmit your data through an embedded webview. Where it links to the web — managing your plan, or this policy — it hands the link to your device's own browser and the open web takes over from there. Our website is not wrapped in an app webview either.

07Cookies and tracking

Essential cookies keep you signed in and hold your session. The site does not work without them.

Analytics and advertising cookies measure traffic, conversion and experiment results. You can refuse them through your browser, or by sending a Global Privacy Control signal, without losing access to any tool.

We honour Do Not Track and Global Privacy Control signals for non-essential tracking where your browser sends them.

08How long we keep it

• Account and saved work — for as long as your account is open. Delete the account and it goes immediately (see Deleting your account); encrypted backups roll off within 30 days after that.
• Voice recordings — not retained at all. They are processed in memory and discarded once the measurement has been read out of them.
• Billing records — up to 7 years, because tax law requires it.
• Support messages — up to 2 years, so we have the history of a problem.
• Analytics — up to 26 months, then aggregated or deleted.

09Your rights

Wherever you live, you can ask us to do all of the following, and we will not charge you or treat you differently for asking:

• Get a copy of the personal information we hold about you.
• Correct anything that is wrong.
• Delete your account and the data in it.
• Export the measurements and designs you have saved.
• Opt out of marketing email and of analytics tracking.
• Object to or restrict processing, and — in the UK/EEA — lodge a complaint with your data protection authority.

Email zero@starthere00.com or use the support form. We respond within 30 days. We will ask you to confirm you control the account's email address before we act on a request.

California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use it for cross-context behavioural advertising beyond the conversion measurement described above.

10Deleting your account and data

You can delete your account yourself, at any time, without asking us and without reinstalling anything. Two ways in:

• Signed in on the web — Account settings → Delete your account. In the mobile app, the same button is under Settings → Account.
• Locked out, or you've already uninstalled the app — the public instructions and request route are at starthere00.com/delete-account.

Deleting removes your profile and sign-in, everything you saved (projects, cut lists, measurements, designs, plans, setups, checklists, saved recipients), your place on any list we captured through the tools, and any pending shop invitations to your address. Any subscription or add-on is cancelled at the same time. Doing it yourself takes effect immediately; a request by email is actioned within 30 days once we have confirmed you control the address.

Want a copy before it goes? Ask us and we will send an export of your data first. If you own a Shop, deleting your account closes the shop — the people on it lose shared access, but their own accounts and their own saved work are untouched.

11How we protect it

Traffic is encrypted in transit. Data is encrypted at rest by our database provider. Access to your rows is enforced in the database itself by row-level security, not just in application code, so one account cannot read another's work. Administrative access is limited to those who need it, and privileged API keys are never exposed to the browser.

No system is perfect. If a breach ever affects your personal information, we will notify you and the relevant regulator as the law requires.

12Where your data lives

We are based in the United States and our providers process data in the United States and other countries. Where information moves out of the UK/EEA, that transfer is covered by Standard Contractual Clauses or an equivalent safeguard in our agreement with the provider.

13Children

Start Here is not intended for children under 16, and we do not knowingly collect their personal information. If you believe a child has given us data, write to zero@starthere00.com and we will delete it.

14Changes to this policy

When we change this policy we update the date at the top. If a change materially affects your rights, we will email account holders before it takes effect. Continuing to use Start Here after that means the new version applies to you.

15Contact

Start Here Tooling Co.
Address on file — contact us at the email below
zero@starthere00.com

For anything else — a tool misbehaving, a billing question — the support page reaches the same people at zero@starthere00.com.