Last updated: October 10, 2026
This Privacy Policy explains what information CoContractor ("CoContractor," "we," "us," or "our") collects, how we use it, who we share it with, how long we keep it, and the choices you have.
In short: we use information to run the Service for the roofing and contracting companies that use it and the people they work with. We don't sell personal information, we don't use it for targeted advertising, and we don't buy information about property owners from data brokers. Some features send information to AI providers, including DeepSeek, which stores it in China (see AI Features). Our Terms of Service cover using the Service.
CoContractor runs the CoContractor service: our website, our mobile app, our web app, and the pages and messages we deliver for the companies that use us, such as estimates and contracts, inspection reports, invoices and payment pages, appointment bookings, texts, and emails (together, the "Service"). This policy covers:
When a company keeps records in the Service about its customers, crews, and team, the company decides what to collect and how to use it, and we handle that information for the company to provide the Service. The company's own privacy notice covers how it uses that information. If you're a property owner with a question about how a company uses your information, ask that company. You can also contact us, and we'll help or pass your request on.
This policy doesn't cover other companies' services, even when the Service links to them or works with them, such as Stripe's payment pages, Google, Apple, or QuickBooks. Their own privacy policies apply.
When you create an account, we collect your name, email address, and password, which is stored in a protected form that no one, including us, can read. If you sign in with Apple or Google, we receive your name and email address (or Apple's private relay address) from them, and from Google your profile photo. You can add a phone number and a profile photo. We also keep the companies you belong to, your role and what it allows, the locations you work from, your working hours and time off, your notification, storm, and other settings, and who invited you.
When you set up a company, we collect its name, logo, brand color, phone, email, website, and office address, the payment terms and other settings it chooses, and its plan, seats, and billing details. If the company takes payments from property owners, Stripe collects what it needs to set up the company's payment account, such as the owner's identity and bank account, in Stripe's own forms. We receive only whether the account is ready to take payments.
The records a company keeps in the Service: properties and their addresses; the names, phone numbers, email addresses, and addresses of property owners and other contacts; notes, including ones you dictate; photos and videos, including their sound and, when you measure with the camera, depth information; documents, such as insurance claims (which can include policy and claim numbers, insurer and adjuster details, and amounts), roof reports, and manufacturer documents; measurements and roof drawings; estimates, contracts, and signatures; appointments; invoices and payments; texts and emails with property owners; team chat; commissions and sales credit; and a history of who did what and when. If a company imports its records from JobNimbus, we copy its contacts, jobs, files, and estimates into the Service. This information belongs to the company.
Companies add the details of the people they work with. We also receive information directly from these people when they use a page or message we deliver for a company:
We don't buy information about property owners from data brokers. Addresses on the map come from map providers, and everything else comes from companies and the people themselves.
When someone signs an estimate or contract through a link on their own device, we record their name and email, the signature they draw, the time and their time zone, the choices they made, their IP address and browser, and their location if their browser shares it. When someone signs in person on a rep's device, we record their name, the signature, the time, and that it was signed in person, plus the rep's location if the rep signed them on our website and the browser shares it. We keep this as proof of the signature. The signer's name, email, and signature are on the contract, which the company can see. The IP address, browser, and location aren't shown in the Service.
We keep the texts and emails sent and received through the Service, with any photos and files attached, and whether they were delivered. For emails, our email provider can tell us when they're opened or a link in them is clicked, which can include the IP address and browser of the person who opened it. We keep a list of phone numbers that replied STOP so that no company can text them from our number until they reply START.
We collect information about how the Service is used: screens and pages viewed (including which record was open), which buttons are tapped (but not what's typed or written on them), features used, errors, and crash reports, along with device and browser details such as the model, operating system, language, time zone, app version, and IP address. In the app, this goes to PostHog together with your name, email, and company. We also record when each person first and last opened the app, which version they used, and their device or browser type, and we keep each device's notification token and name so we can send notifications.
So you can work without a signal, the app keeps copies of records on your phone, such as properties, property owners' names, notes, and changes waiting to be sent, and it caches photos and files. Signing out removes most of this. Changes that haven't been sent stay, locked to your account, until they're sent, along with some cached files and a list of recently viewed properties. Deleting the app removes everything. These copies are protected by your phone's own security and can be included in your phone's backups, so use a passcode.
When you visit our website, our servers receive your IP address and browser details. We set our own cookie that remembers how you first found us: the page you landed on, the site or link that brought you, any campaign tags in that link, and your approximate location (country, region, and city), which we work out from your IP address without storing the IP address with it. We also count the pages you view and whether you tap through to the App Store. If you create an account, or sign in with Apple or Google, in that browser, we connect those visits to your account. Our ad pages also save the campaign tags and ad click details from the link that brought you in your browser's storage.
If you ask for a demo on our website, we collect your name, company, phone number, email, and team size, and we may call and text you about the demo, as the form says. The form also keeps a copy in your browser so a request isn't lost. If you joined our earlier waitlist, we kept your name, email, and message.
When you contact support in the app or by email, we keep your messages and any photos or videos you send, with your name, email, and company.
When you use Brigg, the assistant in the app, we keep your conversations with him: what you ask, his answers, what he looked up to answer and what it returned, the screen you asked from, and your app or browser version and time zone. Our team reads them to fix problems and make his answers better. Your company can't see them. To find addresses near you, the app sends your phone's location with your question; we use it only for that lookup and don't keep it. We don't keep the photos you send him, only that one was sent and which property it came from. Your conversations are deleted when you delete your account, or when your company is deleted.
We get maps, addresses, satellite and Street View imagery, and roof and solar data from Mapbox, Google, and OpenStreetMap, and storm, radar, and warning data from government agencies such as the National Weather Service and NOAA. This information is about places and weather, not people.
We contact roofing companies that may want CoContractor. For this, we get business contact details from data providers such as Apollo and Clay, through a marketing agency we work with, and from public sources such as company websites: company names, websites, phone numbers, locations, and social media pages, and the names, job titles, work email addresses, phone numbers, and LinkedIn profiles of people who work there. We keep the emails we send and any replies, and a list of the people and companies who asked us not to contact them. We don't contact companies this way when we know they already use CoContractor.
With your permission, the mobile app uses your phone's location while you're using the app. It doesn't track your location in the background.
When someone signs an estimate in a web browser, we record their location if the browser shares it. We estimate a website visitor's approximate location from their IP address. You can turn off location access at any time in your phone's settings. Some features, such as centering the map and recording where you were, don't work without it.
We use sensitive information, such as precise location, the contents of messages, and sign-in details, only to provide the Service and keep it secure. We don't sell personal information, we don't use it for targeted advertising, and we don't use a company's records to market to its customers.
Some features send information to AI providers so they can read and write for you:
We don't train AI models on your information, and we don't send information from your Google account to AI providers. AI results can be wrong, so review them before you rely on them. You don't have to use Brigg.
Companies use the Service to text property owners and others they work with, from a CoContractor number. Each text names the company that sent it. If you ask us for a demo, we may also text you about it. Reply STOP to stop texts from that number, START to get them again, or HELP for help. Message and data rates may apply.
We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories of sharing in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
If you connect Google Calendar, Google asks you to let CoContractor view and edit events on your calendars and see when you're free or busy. We use this access only to add, change, and remove your CoContractor appointments on your main Google Calendar, and to read when you're busy there so appointments aren't booked over it, including when Brigg books one for you. We never read the details of your other events. Teammates who book for you, and property owners who book from an inspection report, see your busy times only as times that aren't available. We don't store your busy times; we read them when they're needed and keep them only briefly in memory.
If you sign in with Google, we receive your name, email address, and profile photo and use them only to create and run your account.
We don't use Google user data for advertising, we don't sell it, and people don't read it except with your permission, for security, or as the law requires. We don't send Google user data to AI providers, and we don't use information from Google Workspace APIs, or any other Google user data, to develop, improve, or train AI or machine learning models.
CoContractor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and its use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy.
You can disconnect Google Calendar in the app at any time (Settings, Calendar sync), or remove CoContractor's access in your Google Account settings.
Parts of the Service also use Google Maps Platform. Street View is shown live and never stored, and the roof scan heights we get from Google are removed from saved roof drawings after 30 days. Google's use of information is covered by the Google Privacy Policy.
We keep information for as long as the account it belongs to exists, unless this section says otherwise.
If you'd like us to delete information we still hold about you, email us. We'll delete it unless we need to keep it to comply with the law, resolve disputes, prevent fraud, or enforce our agreements, and we'll ask our service providers to do the same where we can.
We protect information with encryption while it travels (TLS), encryption at rest by our database and file storage providers, controls that keep each company's records separate and limit what each person sees to what their role allows, and limits on which of our staff can access customer information. No way of sending or storing information is completely secure, so we can't promise that it will never be accessed without permission.
Keep your password to yourself, use a passcode on your phone, and tell us at admin@cocontractor.com if you think someone else got into your account. If a security incident affects your information, we'll tell you as the law requires.
We store information in the United States. Some service providers process it in other countries, including DeepSeek in the People's Republic of China (see AI Features). The Service is meant for use in the United States. If you use it from somewhere else, your information is transferred to the United States.
Depending on where you live, you may have the right to know what personal information we hold about you and how we use it, to get a copy of it, to correct it, to have it deleted, and to opt out of its sale, sharing, use for targeted advertising, or use for decisions that have legal or similar effects on you (we don't do any of those). You can:
We'll confirm a request comes from you, usually by email, and answer within 45 days. If we need more time, we'll tell you why and take up to 45 more. You can make a request through an authorized agent, and we may ask for proof that they act for you. If we turn down a request, you can appeal by replying to our answer, and we'll respond within 45 days. If we deny your appeal, you can contact your state's attorney general. We won't treat you differently for using these rights.
You can also:
If you're a property owner, subcontractor, or crew member whose information a company keeps, you can also ask that company. It controls its records, and we'll help it answer you.
Some U.S. state laws ask us to describe the personal information we collected in the past 12 months in their categories. The sections above give the details.
We collect this information from the sources, use it for the purposes, and disclose it to the recipients described in Information We Collect, How We Use Information, and How We Share Information, and we keep it as described in How Long We Keep Information. We haven't sold or shared any of it, and we don't use it to make decisions that have legal or similar effects on anyone.
The Service is not meant for anyone under 18. We don't knowingly collect information from children. If we learn we have, we'll delete it promptly. We don't sell or share the personal information of anyone under 16.
We may update this Privacy Policy. We'll post the new version on this page and change the date at the top. If a change affects how we use information we already have, we'll tell you in the app or by email before it takes effect, and ask for your permission where the law or our providers require it.
If you have questions about this Privacy Policy, or want to make a request about your information, email us at admin@cocontractor.com.