Privacy

This page covers two things: partscheduler.com, the website you are reading; and the PartScheduler app at app.partscheduler.com, where shops sign up and run their work. Their facts differ (the website sets no cookies, while the app sets a few), so each has its own part. The sections after the two parts apply to both.

Who we are

We are PFM Design LLC, a Michigan limited liability company, doing business as PartScheduler. On this page “we” means PFM Design LLC. “You” means whoever is reading: a visitor to the website, someone signing a shop up, a shop that uses the app, or one of the people in that shop.

We handle data in two different roles, and it matters which one applies.

• Where we decide. For counting visits to the website, for signups and billing, and for the accounts and security records the app needs in order to work, we decide what to collect and what to use it for. This page is our account of those decisions.
• Where we act for the shop. The shop puts in its own records (its jobs, parts and files, and the details of its customers and vendors) for the shop’s purposes. We hold them on the shop’s behalf and use them only to provide PartScheduler to that shop, or where the law requires.

Part 1: The website

This part covers partscheduler.com: every page of the website, including this one and the blog. Its free-trial buttons take you to the app’s signup page, which Part 2 covers; a button for one plan adds that plan to the link, and nothing about you. We invented the jobs, parts and customers in the home page’s demos and video and in the blog’s screenshots and video of the app; no real shop’s records appear anywhere on the website.

The free-trial box

The box at the top of the home page, and at the foot of each blog page, asks for three things, none of them required: your shop’s name, your name and the email you want to sign in with. The website keeps none of them: nothing on it reads what you type or stores it in your browser, though your browser’s own form filling may offer to remember it, as it would on any site. When you press the box’s button, your browser sends what you typed to the app’s signup page at app.partscheduler.com, which opens with those details filled in; Part 2 says what the app does with them. Your browser sends them inside the request, not in the page’s address, so they stay out of your browser’s history and out of any record of the addresses you visited. If you never press the button, what you typed goes nowhere.

Cookies

The website sets no cookies. Nothing it puts on your device can identify you or follow you anywhere: no cookies and no session storage, and nothing in local storage unless you switch visit counting off, when one item remembers that choice. The website counts visits, as the next section explains, and has no tracking pixel or advertising code.

Your browser does keep its own copies of the website’s files (the styling, the fonts, the photographs, the videos) so it loads faster next time. That is the ordinary browser cache every site uses; it holds our files and nothing about you, and we cannot read it.

So nothing asked you to agree to anything when you arrived. A consent banner for cookies that do not exist would be theater, and you would have learned a little more to click past the next one. The visit counting has a switch instead, on the Cookie Policy page.

The app is different: it does set cookies, which Part 2 covers and the Cookie Policy lists one by one.

Counting visits

We count visits to the website to learn which pages and blog posts people read, how long they stay and where they came from. Plausible, a company based in Estonia that keeps its data in the European Union, does the counting. For each page you open, a count carries:

• the address of the page, including which of the home page’s tabs you opened;
• the address of the site that sent you, and the campaign words an ad adds to a link;
• your browser, operating system and kind of device, read from the description of itself that every browser sends;
• how long the page was open in front of you, and how far down you scrolled.

Your browser sends the count to partscheduler.com, and our host, Vercel, passes it to Plausible with your IP address. Plausible uses the address to work out your country, region and city, and to make a code that counts you once for the day, and then keeps neither: it stores no IP address, and it deletes the secret behind the day’s code every 24 hours, so it cannot connect today’s visit with tomorrow’s. No count holds your name or your email address. Nothing you type into the free-trial box reaches Plausible, and neither does anything a shop enters when it signs up in the app. We see totals in Plausible’s dashboard, never a person.

A browser that sends Global Privacy Control or Do Not Track is never counted. To switch counting off in your own browser, use the switch on the Cookie Policy page.

What the website loads

Everything the website needs comes from partscheduler.com itself. The fonts come from here rather than from Google, the videos play from here rather than from YouTube, and the website embeds no scripts, widgets, videos, maps or images from anybody else; even the code that counts visits is part of the website’s own files. Apart from our host, Vercel, described next, and the visit counts it passes to Plausible, reading the website tells no other company that you were here.

Hosting

Vercel hosts the website. As with any web host, their servers handle the requests your browser makes, which means they process your IP address in order to deliver the page to you, and pass it on with each visit count. Their own privacy notice covers what they do with that.

Get in touch

Part 2: The app

This part covers the PartScheduler app at app.partscheduler.com. A shop signs up on the app’s signup page, and its owner or an admin then adds everyone else by inviting them. We can also create a shop’s account ourselves.

What signing up collects

Our signup page asks for the plan your shop wants, the shop’s name, the owner’s name and the owner’s sign-in email. It also reads the time zone your browser reports, so the shop’s dates come out right, and it records which version of the Terms the owner agreed to.

If you filled in the website’s free-trial box, the signup page opens with the shop’s name, your name and your email already in it. The app checks each one by the signup page’s own rules, drops any that fail, and holds the rest for up to 10 minutes in a cookie that only the signup page receives. It deletes that cookie as soon as the signup page sends you on to Stripe, and until you sign up it keeps those details nowhere else. You can change or clear any of them before you go on.

The page then sends your browser to Stripe’s own payment page, where you enter your card and billing address. The card number goes to Stripe, never to us, and Stripe runs its own fraud checks on the card. Stripe then sends us records of the signup and of each payment after it: the subscription, its plan and status, amounts and invoices, the name and email on them, and card details such as its brand and last four digits, never the full number. Before we store those records, we strip out card expiry dates, card and bank account fingerprints, bank routing numbers and account endings, and the addresses and phone numbers on the payment, invoice and checkout records. The one exception is a shop that takes a money-back refund or a chargeback, described below.

We keep a signup record with the shop’s name, the owner’s name and email, the plan the shop picked, and Stripe’s references for the signup. To hold each email address to one free trial, the record also keeps a simplified form of the address. Signing up sends the owner an email with a link to set a password, which works once and expires after three days. If we cannot set up the shop, for example because the address has already had a free trial, we cancel the subscription before anything is charged and send one email that says so.

Each business gets one free trial and one money-back guarantee. To hold to that, when a shop takes a money-back refund, or its bank takes a payment back from us in a chargeback we lose, we keep a short record for 5 years: the fingerprint Stripe gives each card or bank account that paid (a code from which the card or account number cannot be worked out), the street address and ZIP code of each billing address, the domain of the owner’s email address (never a free or internet-provider email service such as Gmail or Comcast), and the shop name given at signup. When a new shop signs up, and when a shop asks for a refund, we compare its details with those records. If one matches, a person looks before any refund is paid, and we keep a note of which kind of detail matched. A match never stops a signup, and no shop ever sees another shop’s details.

What the app collects

About the people in the app:

• Accounts. Each person who signs in has a name, an email address and one role in their shop: owner, admin, scheduler, operator or viewer. They may add a recovery email and phone number, kept for the case where they lose access to their account email; the app sends nothing to either. Supabase’s sign-in service stores passwords, hashed, and checks them when you sign in. None of PartScheduler’s own tables holds a password.
• The shop’s people. The shop’s roster can hold each person’s name and role, and a contact email and phone if the shop adds them. People who record work at a shared shop-floor computer choose a 4-digit PIN, which the app stores only in a one-way form it never reads back. The job history records who made each change, and work entered at a shop-floor computer carries the name of the person whose PIN was used.
• The security log. The app records sign-ins and sign-outs, password changes and resets, invitations, role changes, and changes to shop-floor computer logins and PINs. Each entry stores the IP address and browser details of the request. Nobody using the app can edit or delete an entry. Each person can see their own 20 most recent entries, IP addresses included, on their account page.

About the shop, and the messages that pass through the app:

• The shop’s records. Jobs, purchase-order numbers, part numbers and revisions, quantities, due and ship dates, unit prices, materials with their suppliers and certs, machine queues, per-operation piece counts, and shipments with carrier, tracking number and packing slip. Also the shop’s own profile: its name, addresses, contact email and phone, website, logo, time zone and working days.
• The shop’s customers and vendors. Company names and codes, billing and delivery addresses, contact names and job titles, email addresses, work and cell numbers, websites and notes. The shop enters these, and we hold them for the shop. The app sends nothing to a shop’s customers or vendors.
• Files. Prints, CAD models, photos, purchase orders and the like, up to 100 MB each and only of the file types the app accepts. The app keeps them in private storage. A file opens only through a link that lasts five minutes, which the app issues after checking that the person asking belongs to that shop. Your own browser turns STEP and IGES models into 3D views and preview pictures, using an engine served from PartScheduler itself; no CAD file goes to an outside conversion service. The preview pictures sit alongside the file. PartScheduler is not designed or approved for export-controlled technical data; do not upload it. The Terms say exactly what that covers.
• Help messages. When someone sends a problem report or feature request with the in-app help button, the app saves its text, the page it came from and who sent it. It also emails the full text to our support mailbox, and the sender gets a copy if their login has an email address.
• Email delivery records. For invitations, and for the email that tells a new shop’s owner the shop is ready, the app records whether the email was delivered, bounced or marked as spam, with the address it went to and when.
• Billing. The signup and payment records described above. Nothing in the app itself asks for card details; the card goes to Stripe on Stripe’s own page.
• The cancel survey. When an owner cancels on the Billing page, the app first asks five optional questions, each answered with a score from 1 to 10, and offers a comment box. If the owner sends the answers, the app saves them with the shop’s records and emails them to our support mailbox. The owner can skip the survey, and then the app saves nothing from it.

The app does not ask for your location and does not record your screen.

How we use it

• To run the app: setting up a shop that signs up, signing people in, and showing each shop its own jobs, boards, files and reports.
• To bill the shop: the free trial, its end, and each payment after it, through Stripe.
• To keep it secure: the security log, limits on repeated sign-in, password-reset, shop-floor PIN and signup attempts, and a list of ended sign-ins.
• To give support and fix problems: answering help messages, reading error reports and, when needed, looking at a shop’s data, as set out further down.
• To send the app’s emails: password resets, invitations, notices of a role change, PIN setup links, a notice to whoever sent an invitation that bounced, help-message mail, and, for a shop that signed up, the email that says the shop is ready, a reminder to the owner before the free trial ends, and the one email that says a signup could not go ahead. When an owner cancels, the app also emails our own support mailbox, never anyone else, with the survey answers and what happened: the shop, its plan, how long it stayed and any refund. That is the whole list: the app sends no marketing email.
• To write to a shop’s owner about the account: a change to the Terms or this page, billing, a security problem, or PartScheduler closing. These come from us, not from the app.
• To suggest addresses when someone types one into a customer, vendor or company form.
• To meet legal obligations: keeping records the law requires, or answering a valid court order.

We do not use any of it to advertise to you or to build a profile of you.

Cookies and browser storage

Unlike the website, the app does set cookies. They are its own, and four are in use: one keeps you signed in, one remembers which machine a shop-floor tablet shows, one remembers for 15 minutes which job you have open in the jobs list, and one holds what you typed into the website’s free-trial box for up to 10 minutes, so the signup page can fill it in. The Cookie Policy describes a fifth, retired one, which nothing sets any more. Your browser also keeps your light or dark setting, and, for the open tab only, where you were in each list, how you set up the jobs list, and when the app last reloaded itself after a crash.

There are no advertising cookies, and the app’s own code has no analytics or advertising code. In that code, the only measurement of how people use the app is the sample of error and timing reports sent to Sentry, described below. The app sets no cookies for any other company, but your browser reaches two other companies directly, and either may set cookies of its own: Supabase, which serves the app’s files, and Google, whose map loads when you open a map beside an address or the company details panel on the shipping page. The Cookie Policy lists each of the app’s own cookies, what it holds and how long it lasts, and says what Google receives when a map opens.

What your browser talks to

The website loads nothing from anybody else, but the app does not work that way. Files and pictures (prints, previews, logos, machine photos) travel straight between your browser and Supabase’s storage, through short-lived links our server issues, some as soon as a page opens. Error reports and timing samples go from your browser to Sentry; a map, when you open one, loads from Google. Carrier tracking links and “Open in Google Maps” links send the tracking number or address to that site, but only when you click them. Everything else goes through PartScheduler’s own server: signing in, reading and saving records, address suggestions.

Who handles data for us

Everything from here to the end of the page covers both the website and the app.

These are the outside services the website and the app use to handle personal or shop data, what each one does, and what it receives. We share data with them only to run PartScheduler. We update this list when the services we use change.

Vercel

Hosts the website and the app, and runs their server code. Every request passes through Vercel, with your IP address, browser details and the address of the page.

Supabase

Holds the app’s database (every account and shop record) and its uploaded files, and stores passwords, hashed, and checks them at sign-in. Files and pictures travel straight between your browser and Supabase’s storage, so Supabase also sees your IP address and browser details when one loads. In the United States (AWS us-east-1).

Resend

Sends email. For the app, it receives each recipient’s address and the message itself, which can include names, the shop’s name and sign-in links, and reports back whether it was delivered.

Sentry

Receives error reports from the app, from your browser and from our server, and performance timings for a sample of about 10% of activity. Before the app sends anything, it removes cookies, sign-in details, tokens, search text, the values a database error would print, and the text of anything clicked, and either drops what a request submitted or blanks out its sensitive fields. The app adds no IP address to a report, but reports from your browser go straight to Sentry, so Sentry’s servers see the address they come from, as any server does. What a report carries is the error and its message, your browser details and the page address, which can carry internal record numbers. Screen recording is off.

Upstash

Limits repeated sign-in, password-reset, shop-floor PIN and signup attempts, and how quickly someone can repeat the same action, and keeps the list of ended sign-ins. It receives IP addresses, random sign-in IDs, and a shortened one-way fingerprint of an email address, but never the address itself. Its entries expire on their own.

Google

Suggests addresses: when someone types an address into a customer, vendor or company form, our server sends what they have typed so far, with a random session token, to Google’s Places service. Your browser loads nothing from Google for this. Separately, opening a map (the popup beside an address, or the company details panel on the shipping page) loads Google Maps in a frame from Google, which then receives the address to display, your IP address and browser details, and may set its own cookies. It loads only when you open one of those.

Plausible

Counts visits to the website. By way of our host, it receives the address of each page you open, the site that sent you, your browser’s description of itself, how long the page was open and how far you scrolled, and your IP address, which it uses to work out your location and a visitor count for the day and does not store. It sets no cookies, and it keeps its data in the European Union. The app sends it nothing.

DreamHost

Hosts our support mailbox. Anything you send with the Get in touch button, replies to the app’s emails and the text of help messages land there, and so do the cancel emails described in Part 2.

Stripe

Takes payments. At signup our server gives Stripe the shop’s name, the owner’s name and email, the time zone and the plan the shop picked, and the owner enters the card and billing address on Stripe’s own payment page, so the card number goes to Stripe, never to us. Stripe sends us the signup and payment records described in Part 2, and the Stripe page also sees your IP address and browser details, as any website does. Stripe also emails the owner directly: a receipt for each payment, a reminder 7 days before the free trial ends, and a notice when a payment fails or the card on file is about to expire.

We also use Better Stack to check from outside, around the clock, that the app is up. Its checks load the app’s status endpoint and its sign-in pages, none of which return shop data, and it receives none.

Apart from these services, we give personal or shop data to someone else only when the law requires it, such as under a valid court order, or to a buyer of the business, as set out below.

Where we keep it

Supabase stores the app’s database and uploaded files in the United States, in the us-east-1 region of Amazon Web Services. The other services above may handle data elsewhere. We have not confirmed every one of their regions, so we do not claim that all data stays in the United States.

Copies can also sit on our own computers: a safety copy taken before we change the database, or a full copy we are preparing for a shop. This page covers them too, and when we delete a shop’s data, we delete them with the rest.

When our staff look at a shop’s data

PartScheduler staff look at a shop’s data only to give support, to fix a problem, to keep the service running, or when the shop asks.

The shop’s own log does not yet record that access. The security log in Part 2 covers sign-ins and other events inside the app; when our staff reach a shop’s data from outside the app, nothing appears in that log.

How long we keep it

Signup and billing records. The signup record (the shop’s name, the owner’s name and email, and Stripe’s references) stays even after we delete a shop’s data, so that the same email address cannot start a second free trial. The record we keep after a money-back refund or a lost chargeback stays for 5 years from the day we make the record, also after we delete a shop’s data, and we then clear its details. We keep the content of each payment record Stripe sends us for 5 years, also after a deletion, because billing records are kept for that long; after that we clear it and keep only the fact that the record arrived. Stripe keeps its own records under its own policy.

Nothing in the app is deleted on a schedule. Accounts, the security log and its IP addresses, the shop’s records and files, help messages and email delivery records all stay for as long as the shop’s account exists. Removing a job, part, customer, vendor, file or person inside the app archives it, which hides it without erasing it. The app does erase two things: a machine’s photo, when someone removes or replaces it, and working copies it clears or rebuilds as it goes, such as a half-filled shipment once someone records that shipment.

After a shop leaves, we keep its data until the shop’s owner asks us to delete it. We then delete it by hand within 30 days of the request (from the app’s database and file storage, and from any working copy we made ourselves) and tell the owner when we have finished. If the owner wants a full copy first, we send it before we delete anything. Copies in our backups age out within 30 days of the deletion. We may keep records the law requires us to keep, such as billing records, and our email with the shop, including help messages that reached our support mailbox, the cancel emails among them. We keep the signup record, the billing records and the refund records, as described above. When we delete a shop, we also keep a short internal record of the deletion: the shop’s name, Stripe’s references for it, and any cancel-survey answers its owner sent, comments included.

Some records sit with the services above and follow their schedules, not ours: our host’s request logs, error reports at Sentry, email records at Resend, and visit counts at Plausible, which stay while we keep our account there. Messages in our support mailbox stay until we delete them.

Getting a copy

While a shop uses PartScheduler, it can download its data from inside the app in three ways:

• the jobs list, as a CSV file with whatever filters are applied, by anyone who can open the jobs list;
• the on-time delivery report, as a CSV file, by owners and admins;
• any file, one at a time.

There is no single button that exports everything. The shop’s owner can ask us for a full copy at any point, and we send it to the owner, including after the shop leaves, before we delete anything.

If we ever stop offering PartScheduler, we will give at least 60 days’ notice and help each shop get a full copy of its data.

No selling, no ads, no AI features

We do not sell personal data or shop data, rent it out, or share it for advertising.

The app has no AI features. Nothing in it sends your data to an AI service, and we do not use your data to train AI models.

Security

The Security page sets out what protects the app and, just as plainly, what is not in place. In short: Supabase’s sign-in service stores passwords, hashed; none of our own tables holds one. Files sit in private storage behind links that expire after five minutes, and the app reaches your browser only over HTTPS. The page’s scripts cannot read the sign-in cookie, and it travels only over HTTPS. The cookie also carries a signature, so our server rejects any change to it.

There is no multi-factor sign-in. PartScheduler holds no SOC 2 or other certification, and has had no independent audit or penetration test.

Your choices, wherever you live

You do not need to live in a particular state or country to ask. Anyone can ask us what we hold about them, ask us to correct it, or ask us to delete it, using the Get in touch button. We may need to confirm it is you before we act.

An app login belongs to a shop’s account, so removing one is the shop’s decision, and the record of what was done under it, the security log included, stays with the shop’s data. Where the data is part of a shop’s records, we act on the shop’s instructions, as the next section explains.

We do not sell personal data or share it for advertising. On the website, a Global Privacy Control or Do Not Track signal switches off visit counting, so a browser that sends either is never counted; in the app, which counts no visits, a signal has nothing of ours to switch off.

If a shop holds your details

If you are one of a shop’s customers, vendors or staff, the shop decides what it keeps about you in PartScheduler and why. We hold that data for the shop, and we will not change or delete it at your request without the shop’s say-so. Ask the shop.

If you work for the shop, that includes the job history, which credits each change to the person who made it, and the work recorded under your PIN, such as piece counts. How a shop uses its records about its own people is a matter between you and the shop.

Children

PartScheduler is a tool for running a machine shop. Children have no reason to use it, and we do not knowingly collect anything about them.

If something goes wrong

If we learn that a shop’s data has been exposed to someone who should not have it, we tell that shop’s owner promptly and say what we know.

If the business changes hands

If PFM Design LLC or the PartScheduler business is sold or merged into another company, the data described here goes with it, the new owner takes on the promises on this page for the data collected under it, and we tell each shop’s owner.

Changes to this page

If any of this changes, the date at the top changes with it. We will not start using your email address or your shop’s data for something new without telling you first. Before a material change to how we handle a shop’s data takes effect, we email the shop’s owner at least 30 days ahead, the same notice the Terms give.

Contact

To ask about anything on this page, to make a request, or to send PFM Design LLC a legal notice, use the Get in touch button. It starts a new email to us in your mail program, if your device has one set up. If you use the app, the help button (the question mark) reaches us too.

Get in touch