SecurityYour account, and nobody else’s.

You sign in with Apple, with Google, or with a six-digit code sent to your email. A code lasts ten minutes, allows three tries, and is stored only in a scrambled form, so even a copy of the database holds no code that works. Asking for codes over and over, or guessing, is limited for each email address.

Apart from Apple or Google confirming it’s you, when you choose them, signing in is handled by Tools Down’s own server and database. On your phone, you stay signed in for 30 days from when you last used it, kept in the iPhone’s secure storage.

A customer, a job, a quote, an invoice: each one is tied to your account, and so is every link between them, so one account’s job can never point at another account’s customer. The ids of your records are made on the server, never taken from the phone.

Tools Down’s tests run with two accounts side by side, and fail any database query on an account’s records that leaves the account out.

Your records are in a PostgreSQL database in Amazon Web Services’ Ireland region, encrypted where it’s stored, reachable only by Tools Down’s own servers and never from the internet, and only over encrypted connections. Backups are kept for 14 days.

Photos and documents are in private storage in the same region, encrypted, with public access blocked and anything but an encrypted connection refused. The app talks to the server over HTTPS only.

The camera when you take a photo, the microphone when you talk, notifications once your first quote or invoice goes out, and your location only when you tap Use my location for a “near me” question. Your exact position stays on the phone: only your town and postcode area are used, and never kept. Each one, with the words your iPhone shows.

Email hello@toolsdown.app with what you saw. A person reads it. For what the models see, read AI and your data; for who makes Tools Down and how to delete everything, read Trust.