Privacy Policy

Last updated: October 26, 2026

SpeakBid ("we", "the app") helps contractors create quotes and invoices by voice, send them to customers, collect e-signatures and payments, and schedule jobs. This policy explains what data the app handles and why.

Publisher: SpeakBid · Contact: our support page

1. Data that stays on your device

Everything you type or say is stored only on your phone (in the app's private storage), unless you choose to send a document as an online link (section 2):

• Business profile (name, logo, license #, phone, email, address, payment handles such as Zelle/Venmo).
• Clients (names, phones, emails, addresses), quotes, invoices, notes and payment records.
• Jobs calendar: job dates, addresses, crew notes, status and reminder settings. Job data is not uploaded, except the job date shown to your customer (section 2).
• Signatures captured "in person" on your device (image, printed name, date/time, your device's user-agent, and a fingerprint of the document) stay on your device and inside the PDF you share.

Deleting the app, or Settings › Erase all data, removes this data from the device.

2. Online quote links (optional)

When you tap Text, Email, WhatsApp or Copy link, the app uploads a read-only copy of that one document to our link server (Cloudflare Workers, United States) so your customer can open it at a private, unguessable address. The copy contains what is printed on the document (your business details, the customer's name, line items, totals, notes, terms, payment handles) and the PDF.

The link server also records:

• Views: how many times and when the link was opened (no customer IP addresses are stored for views).
• Customer responses: accept/decline, the name they typed, and the time.
• E-signatures (if you turn them on): the drawn signature image, the printed name, the date/time and time zone, the customer's IP address and browser user-agent, a consent flag, and a SHA-256 fingerprint of the document. These are kept as an audit trail so you can show who signed what and when. If you edit the document afterwards, the old signature is marked "voided" and kept in the audit trail.
• Job schedule: if a quote is accepted and you schedule the job, the start/end date and time zone are shown on the customer's page ("Scheduled for …"). Crew notes and addresses are not uploaded.
• Payments: amounts, method type (card/bank), status and time, received from Stripe.
• Customer email for the signed copy (1.0.11, optional): if the customer has an email in the app and the server is set up for email, that address is stored with the link only to email the customer their signed copy (sent through our email provider, e.g. Resend or MailChannels, as a service provider). It is never shown on the link. You can turn this off in Settings › Customer signature.
• Push alert tokens (1.0.11, optional): if you allow alerts, your phone's Firebase Cloud Messaging token, the app language and your alert choices are stored with your account so the server can alert you when a customer opens, signs or pays. Alerts are delivered by Google Firebase Cloud Messaging. They contain the document number, customer name and amount paid, never your costs or profit. Erase all data deletes them.

Deleting a document in the app also deletes its link from the server. Settings › Erase all data deletes your link-server account and every link, PDF, signature and payment record on the server, as well as the data on the device. Links stay online until you delete them.

3. Payments (Stripe)

If you connect Stripe, card and bank payments are processed by Stripe under Stripe's own terms and privacy policy (https://stripe.com/privacy). We never see or store full card or bank numbers. Stripe sends us payment status, amount and a reference ID. Optional receipt emails are sent by Stripe.

4. Subscriptions (RevenueCat, Google Play, App Store)

SpeakBid Pro is billed by Google Play or the App Store. We use RevenueCat (https://www.revenuecat.com/privacy) to check whether your subscription is active. RevenueCat receives an anonymous app user ID (or your link-server ID), purchase receipts and the device platform. We don't receive your payment card details.

5. Voice

Voice input uses your phone's built-in speech recognition (Google on Android, Apple on iOS) under their privacy terms. SpeakBid receives only the resulting text. Audio is not stored by SpeakBid. Optional Cloud voice (beta, off by default, Settings › Voice): for very loud job sites you can turn this on. Then, only while you hold the mic button, the app records a short noise-reduced audio clip and sends it over HTTPS to the SpeakBid link server, which passes it to Cloudflare Workers AI (Whisper speech-to-text) to write it down and returns the text. The audio is processed in memory and never stored by SpeakBid or used to train models; only a daily seconds counter is kept to enforce the free usage limit. Smart line items (1.0.18, on by default, Settings › Language › Noisy places): after you finish a voice quote, the transcript text (never audio; the customer's name the app recognized is replaced with "the customer") is sent over HTTPS to the SpeakBid link server, which passes it to Cloudflare Workers AI (a Llama 3.2 3B Instruct model) to split it into line items and returns them. The text is processed in memory, not stored or logged by SpeakBid and not used to train models; only daily call counters are kept to enforce usage limits. With it off, or offline, the quote is built on your phone only. Optional AI mode (off by default) sends the transcript text to the AI provider whose key you enter, under that provider's terms.

5a. Help & support requests

SpeakBid never sends support data on its own. Data leaves your device only when you contact us:

• Contact support / Report a bug opens your email app with a prefilled message. You can see and edit everything before you tap send. The message includes a short diagnostics block: app version and build, platform and OS version, phone model, WebView version, app/voice language and device locale, whether Pro is active, and an anonymous install ID. This is a random code created on your device. It is not linked to your account, your link-server ID or any hardware ID. The diagnostics never include your customers, documents, amounts, phone numbers or keys. A screenshot is attached only if you add one.
• Send feedback (when the link server is set up) sends your message, the optional reply email you type, the same diagnostics and the install ID to our server (Cloudflare D1, United States). To limit abuse, the server keeps a salted, one-way hash of your IP address, never the IP itself. Messages may be forwarded to our support inbox (via our email or chat provider). They are deleted after 12 months at the latest, or sooner if you ask.
• Rate SpeakBid uses Google Play's in-app review sheet (or opens the store page). Your rating is handled by Google, and we only see what Google shows publicly.

5b. Invite a contractor (referral program)

If you use Settings › Invite a contractor, the link server stores your invite code, which installs redeemed it, and the reward ledger (pending/granted free months). To prevent self-referrals and abuse it keeps salted one-way hashes of the install ID, of a coarse device fingerprint (platform, phone model, OS and WebView version, screen size, time zone) and of the IP address, never the raw values. On Android, the app reads the Google Play install referrer once after install to find the invite code in the link you were sent. When a friend sends their first real quote or invoice, the server checks that document exists on the link server (it doesn't read anything else). Rewards are granted as RevenueCat promotional entitlements for your app user ID. An audit log of invite events (codes and hashes only) is kept to investigate abuse. Settings › Erase all data deletes your referral records with your account.

6. Device permissions

SpeakBid never auto-sends text messages. "Text customer a reminder" opens your messaging app with a prefilled message that you send yourself.

5c. This website

This website has no ads, analytics, tracking cookies or third-party scripts. If you use the contact form, we store your name (optional), your email, your message, the page language and a salted one-way hash of your IP address (to stop spam, never the IP itself) in Cloudflare D1 (United States). We use it only to answer you and delete it after 12 months at the latest, or sooner if you ask. Cloudflare, our host, may process technical request data (such as IP address) to deliver and protect the site.

7. Sharing

We don't sell personal data, and we don't use it for advertising. We share data only with the service providers above (Cloudflare, Stripe, RevenueCat, Google/Apple) to run the features you use, or when the law requires it.

8. Security

Links use random 24-character tokens (~143 bits), HTTPS, no-index headers and a strict content-security policy. Owner access uses a per-device secret. Signature records include a document fingerprint, so any later change to the document is detectable.

9. Children

SpeakBid is a business tool and is not directed at children under 13 (or 16 in the EU).

10. Your rights

You can access, export (PDF/CSV), correct or delete your data in the app at any time. For requests about data on the link server, including requests from your customers, contact us through our support page. California, EU/UK and other residents may have extra rights under local law. We will honor them.

11. Changes

We will post updates here and change the date above.