SecurityYour account, and nobody else’s.

You sign in with Apple, with Google, or with a six-digit code sent to your email. A code lasts ten minutes, allows three tries, and is stored only in a scrambled form, so even a copy of the database holds no code that works. Asking for codes over and over, or guessing, is limited for each email address.

Apart from Apple or Google confirming it’s you, when you choose them, signing in is handled by Tools Down’s own server and database. On your phone, you stay signed in for 30 days from when you last used it, kept in the iPhone’s secure storage.

A customer, a job, a quote, an invoice: each one is tied to your account, and so is every link between them, so one account’s job can never point at another account’s customer. The ids of your records are made on the server, never taken from the phone.

Tools Down’s tests run with two accounts side by side, and fail any database query on an account’s records that leaves the account out.

Your records, photos and documents are stored with Amazon Web Services in Ireland, encrypted where they’re kept and as they travel, with access limited to those who need it. Backups are kept for 14 days.

The camera when you take a photo, the microphone when you talk, notifications once your first quote or invoice goes out, and your location if you allow it, which your phone asks the first time you tap Use my location for a “near me” question. Once it’s allowed, your town and postcode area go with your messages, until you turn it off in your phone’s settings. Your exact position never reaches Tools Down: only your town and postcode area are used. Tools Down keeps no copy of them, but a “near me” web search sends them to Exa, which may. Each one, with the words your iPhone shows.

Email hello@toolsdown.app with what you saw. A person reads it. For what the models see, read AI and your data; for who makes Tools Down and how to delete everything, read Trust.