Your site photos stay yours.

The short version

SiteLight keeps your projects and captures on your phone. Nothing leaves the phone until you choose a way to build a 3D site model and send a capture set.

In the Android beta you can build on the SiteLight hosted service. Photos you send are stored in a workspace that belongs to your business, on a Kettle & Haven server, and turned into a site model on a computer Kettle & Haven runs. Your photographs are used to build your own project, nothing else.

• No account, no email address and no password. Creating a workspace asks for a business name only.
• No advertising, no analytics component, and no selling of anything you send.
• Deleting a project or the whole workspace in the app erases it from the hosted service. A workspace nobody uses for 180 days is erased automatically.

What stays on your phone

Projects, photographs, videos, measurements, drawn pieces, notes and drafts are written to SiteLight’s private storage on the phone, which other apps cannot read. You can use SiteLight entirely offline and never send anything.

Voice instructions are recognized on the phone by Android’s on-device speech service. If that service is unavailable, SiteLight asks you to type instead; it does not fall back to an online recognizer.

Reading text from a photographed document also runs on the phone. It uses a Google ML Kit text recognition model that ships inside the app, so your document does not leave the phone to be read. Google’s component reports its own usage and performance diagnostics, including device and app information. That goes to Google under Google’s terms, not to us; we never receive it. Google documents it at developers.google.com/ml-kit/android-data-disclosure.

What the hosted service receives

Only what you send, and only when you tap send. A capture set is uploaded as the exact files on your phone. A photo taken with SiteLight’s camera carries no location, because SiteLight never asks for location access. A photo you import from your gallery is sent unchanged, including any location or camera details your camera app wrote into it.

With a capture set, the service stores the project’s name and the site model built from your photos. When you create a customer link, it also stores the design that link shows: the pieces and measurements you saved for it.

The service does not keep request logs for SiteLight. Our web server skips its access log for SiteLight addresses, and SiteLight’s own log records that a request finished, without its address, your network address or its contents.

How a site model is built

The server stores your photos but does not build models itself. A reconstruction computer that Kettle & Haven runs collects each queued capture set over an encrypted connection, checks every file against the fingerprint recorded when you uploaded it, builds the model and sends back only the model files. Its working copy of your photos is deleted as soon as that job is finished or fails. If the computer stops in the middle of a job, it deletes the leftover copy the next time it starts.

If that computer is offline, your capture set waits in the queue. Nothing is lost, and nothing is sent anywhere else.

Who can see it

• You. The workspace credential is issued once, to the phone that created the workspace, and is stored on it encrypted with a key held in Android’s keystore. We keep only a fingerprint of it, which cannot be turned back into the credential.
• Crew devices you add. A pairing code you create lets one more phone work on one project. It expires after ten minutes and can be used once.
• Customers, only through a link you create. A customer link shows the proposed site model, not your original photographs, and you can revoke every link for a project at any time.
• Kettle & Haven, as the operator of the service. Your files are protected in transit and separated from every other business’s workspace, but they are not end-to-end encrypted: we run the server and the reconstruction computer, so we could technically open them. We do so only to run the service, to investigate a problem you report, or when the law requires it.

How long we keep it

While you use it, and not much longer. The hosted service keeps a workspace, with its projects, photographs, site models and customer links, while your phone or a crew device you added keeps using it.

A workspace that no phone has used for 180 days is erased automatically, with everything in it. A customer opening one of your links does not count as use: a proposal left open in someone’s browser should not keep your photographs on our server. We chose 180 days because a quote often comes back after a quiet season, and a workspace should still be there when it does.

If we have to close a workspace, for example because it was used to abuse the service, it is erased 30 days after it is closed.

When SiteLight next connects to a workspace that has been erased, it says so. The projects on your phone are unchanged, and you can create a new workspace and send them again.

Deleting your data

One project: on the phone that created the workspace, deleting a project in SiteLight erases it from the workspace as well, including its photographs, site model and customer links. If the service cannot be reached, nothing is deleted, on the phone or on the service, and SiteLight tells you why. A crew device removes only its own copy.

The whole workspace: open Connection and choose Delete this workspace. After you confirm, the service erases every project, photograph and site model in the workspace, ends every customer link and crew device it issued, and forgets the workspace credential. It happens immediately. Projects on your phone are not touched.

The hosted service keeps no backup copies, so anything erased, by you or by the 180-day rule, cannot be restored, by you or by us. That has a cost you should know about: this beta service runs on one server, and a failure of that server could lose what it holds. Keep your own copies of anything you cannot recapture.

If you no longer have the phone that created the workspace, write to hello@kettleandhaven.com with the business name you used, and we will delete it for you.

Permissions

Camera, to take site photographs, only while you are on the camera screen. Microphone, only while you are dictating an instruction, for on-device speech recognition. Internet and network state, to send capture sets you choose to send and to fetch the site model back.

SiteLight does not request location, contacts, calendar or access to your whole photo library. Imports go through Android’s file picker, which gives SiteLight only the files you pick.

What SiteLight does not do

Stated explicitly, because absence is hard to prove by reading a policy:

• No advertising, ad identifiers, attribution or install-referrer tracking.
• No third-party analytics.
• No selling or sharing of what you send.
• No pooling of your photographs with other businesses’ projects, and no use of them to train anything beyond your own project’s site model.

Children

SiteLight is a tool for contractors and is not directed at children.

Who is responsible

Kettle & Haven LLC, a Colorado limited liability company, publishes SiteLight, runs the hosted service and is responsible for the data practices described here. Questions: hello@kettleandhaven.com.

Changes

If this policy changes in a way that affects what leaves your phone or how long we keep it, the change will be described here with a new date rather than quietly replaced.