Privacy Policy
1. Who We Are
FieldCraft is maintained by SquaredR, based in India. For the purposes of data protection law (including the EU General Data Protection Regulation and the India Digital Personal Data Protection Act, 2023), SquaredR is the data controller for personal data collected through this website (contact form submissions and support correspondence). SquaredR does not store any personally identifiable information from licence purchases — buyer identity and payment data are held exclusively by Gumroad.
Contact: hello@squaredr.tech
2. What This Policy Covers
This Privacy Policy covers the FieldCraft website (fieldcraft.squaredr.tech), the licence purchase process via Gumroad, and the npm package distribution. It does not cover what you do with FieldCraft after you install it — you are the data controller for any data your applications collect, and you must provide your own privacy policy to your end users.
3. Data We Collect
We collect very little data. Here is a complete list of what we process, why, and on what legal basis.
3.1 Website Visits
The FieldCraft website does not:
- Set cookies (tracking, analytics, session, or otherwise).
- Run third-party tracking scripts (no Google Analytics, no Facebook Pixel, no ad networks).
- Require user accounts or logins.
- Use fingerprinting or any other tracking technique.
The website is hosted on Vercel. As part of standard web infrastructure, Vercel automatically processes server logs that include your IP address, browser type, operating system, referrer URL, and request timestamps. These logs are retained by Vercel for up to 24 hours and then automatically deleted. SquaredR does not have direct access to Vercel’s raw server logs.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) — necessary for website security, stability, and abuse prevention. This processing is performed by Vercel as a data processor on our behalf.
3.2 Contact Form Submissions
The Pro page includes a contact form built with FieldCraft itself. When you submit this form, we collect the information you provide (typically your name, email address, company, area of interest, and message).
Your submission is forwarded as an email via Resend, a third-party transactional email service. The email is sent from our verified domain (noreply@squaredr.tech) to our internal address. SquaredR does not operate a persistent mailbox or email inbox. Resend acts as a relay: it delivers the email and retains a copy on its infrastructure for up to thirty (30) days, after which it is automatically and permanently deleted by Resend. SquaredR does not separately store, back up, or archive contact form submissions in any database.
This means that if you contact us, your name, email address, and message will exist only within the Resend platform for up to 30 days. If we have not read and responded to your enquiry within that window, the submission is permanently lost.
Purpose: To respond to your enquiry.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) — necessary to respond to a direct communication you initiated.
Retention: Up to 30 days (Resend’s automatic retention period), then permanently deleted. SquaredR does not maintain any independent copy. We do not add your email address to any marketing list, newsletter, or database unless you explicitly request it.
3.3 Licence Purchase Data
When you purchase FieldCraft Pro, the payment is processed by Gumroad (a third-party payment platform). SquaredR does not collect, process, or store your credit card number, CVV, full payment details, email address, or name. All buyer identity and payment information is held exclusively by Gumroad.
When a purchase occurs, Gumroad sends a webhook notification to our backend. This notification is used transiently to generate your licence key. The only data we extract and persist is:
- A Gumroad transaction reference ID (an opaque string that links to the purchase on Gumroad’s side).
- Purchase date.
- Product purchased.
Your email address and name, which may be included in the Gumroad webhook payload, are not persisted in our database. They are discarded after the licence key is generated and delivered via Gumroad. SquaredR has no ongoing record of who you are — only that a valid purchase was made.
Legal basis: Not applicable — no personal data is stored by SquaredR. The Gumroad transaction reference ID is an opaque identifier that cannot be used to identify a natural person without access to Gumroad’s records.
3.4 Licence Key Data
Each licence key is associated with the following non-personal information in our database:
- Licence key (a randomly generated opaque string).
- Gumroad transaction reference ID.
- Purchase date.
- Licensed production domain(s).
- Activation status and activation date.
- Update eligibility expiry date.
- TOTP authenticator secret (encrypted).
None of the above constitutes personal data. The licence key is a random string, the domain is a business asset (not a person), and the TOTP secret is encrypted and cannot identify an individual.
When you activate FieldCraft Pro on a production domain, the licence validation process transmits your licence key and the domain name to our validation endpoint. This is necessary to verify that the licence is valid for that domain. No IP addresses, browser fingerprints, or other identifying data are logged by this endpoint. Only the key, domain, timestamp, and validation result (pass/fail) are recorded.
3.5 Support Correspondence
If you contact us via email for support, bug reports, or licence enquiries, we retain the correspondence to provide ongoing support and maintain context for follow-up issues.
Retention: Support correspondence is retained for two (2) years after the last communication, then deleted.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) — necessary to provide support and resolve potential disputes.
3.6 npm Package Telemetry
The FieldCraft npm packages display a console banner showing the version number on first load. This is a local console.log statement only — no network request is made and no data is sent to SquaredR or any third party.
The website hosts an optional, anonymous telemetry endpoint that counts aggregate installs. This endpoint receives no personally identifiable information — only a package name and version string. No IP addresses are logged by this endpoint. This telemetry can be fully disabled by setting the FIELDCRAFT_TELEMETRY_DISABLED environment variable before importing the package.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) — understanding aggregate adoption to prioritise development.
3.7 Cookies and Analytics Consent
This website uses Google Analytics (via Google Tag Manager) for basic page-view analytics only. We do not use Google Analytics for advertising, remarketing, user profiling, or cross-site tracking. Google Analytics uses cookies to distinguish unique visitors and track page views.
In compliance with the EU ePrivacy Directive, UK PECR, and Google’s Consent Mode v2 requirements, analytics cookies are blocked by default until you provide explicit consent. When you first visit the site, a consent banner appears at the bottom of the page. You may:
- Accept: Analytics cookies are enabled. Google Analytics receives anonymised page-view data (page URL, referrer, browser type, screen resolution, approximate geographic region). No personally identifiable information is collected or sent to Google.
- Decline: Analytics cookies remain blocked. Google Analytics receives no data. Your choice is recorded in a cookie (
fc_consent) so the banner does not reappear.
The consent cookie (fc_consent) itself is a first-party, strictly necessary cookie that records your consent preference (granted or denied). It contains no personal data, does not track you, and expires after one (1) year. You can change your preference at any time by clearing the fc_consent cookie from your browser and reloading the page.
Google’s Consent Mode v2: We implement Google Consent Mode v2 with the following default state: analytics_storage: denied, ad_storage: denied, ad_user_data: denied, ad_personalization: denied. When you accept cookies, only analytics_storage is updated to granted. Advertising signals remain permanently denied — we do not use Google Ads or any advertising platform.
Legal basis: Consent (GDPR Art. 6(1)(a)) — analytics cookies are only set after your explicit opt-in.
4. Data We Do Not Collect or Store
To be explicit, SquaredR does not:
- Store buyer email addresses, names, or any personally identifiable information from licence purchases. This data is held exclusively by Gumroad.
- Collect or store credit card numbers, bank account details, or any payment instrument data.
- Maintain user accounts with email/password credentials. Your licence key and TOTP authenticator are your sole credentials.
- Access, collect, or store any data submitted through forms you build with FieldCraft. All form submission data stays on your infrastructure.
- Track your browsing behaviour across websites. On-site page-view analytics (Google Analytics) are consent-gated and anonymised — see Section 3.7.
- Log IP addresses during licence validation requests.
- Sell, rent, or share personal data with advertisers or data brokers.
- Create user profiles or segments for advertising purposes.
- Use automated decision-making or profiling that produces legal or similarly significant effects.
5. Third-Party Services and Data Processors
We use a limited number of third-party services. Each is listed below with their role and relevant privacy policy:
| Service | Role | Data Shared | Privacy Policy |
|---|---|---|---|
| Vercel | Website hosting | IP address, request metadata (server logs, auto-deleted after 24h) | Vercel Privacy Policy |
| Gumroad | Payment processing and buyer identity | Name, email, payment details (held exclusively by Gumroad; SquaredR receives only a transaction reference ID) | Gumroad Privacy Policy |
| Resend | Transactional email relay (contact form) | Name, email address, message content (retained for up to 30 days, then auto-deleted; no persistent mailbox) | Resend Privacy Policy |
| Google Analytics | Page-view analytics (consent-gated) | Anonymised page views, browser type, screen resolution, approximate region (only with your consent; no PII) | Google Privacy Policy |
| npm (GitHub/Microsoft) | Package distribution | Standard registry access logs | GitHub Privacy Statement |
We do not use any third-party analytics, advertising, marketing, or customer data platforms beyond the services listed above.
6. International Data Transfers
SquaredR is based in India. Vercel processes website data in the United States and other regions. Gumroad processes payment data in the United States. Resend processes contact form emails in the United States.
For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to countries that have not received an adequacy decision from the European Commission, the following safeguards apply:
- Vercel: EU Standard Contractual Clauses (SCCs) and EU-US Data Privacy Framework certification.
- Gumroad: EU Standard Contractual Clauses (SCCs) as part of their terms of service.
- Resend: EU-US Data Privacy Framework certification. Contact form data is retained for up to 30 days, then auto-deleted.
- Google (Analytics): EU-US Data Privacy Framework certification. Analytics data is only transmitted with your explicit consent.
- SquaredR (India): Where we process personal data of EEA residents, we rely on the EU Standard Contractual Clauses. India has not received an EU adequacy decision as of the date of this policy.
7. Data Retention Summary
| Data Category | Retention Period | Justification |
|---|---|---|
| Server logs (Vercel) | 24 hours | Vercel’s automatic deletion; infrastructure security |
| Contact form submissions (Resend) | 30 days (auto-deleted by Resend) | No SquaredR copy; Resend retains for delivery/debugging, then permanently deletes |
| Support correspondence | 2 years after last communication | Ongoing relationship; potential disputes |
| Licence key data (non-personal) | Duration of licence | Licence validation and abuse prevention; no PII involved |
| Validation logs (non-personal) | 12 months | Abuse detection; contains only key, domain, timestamp, result |
| Telemetry (aggregate installs) | Indefinite (anonymised, non-personal) | No personal data involved |
Consent cookie (fc_consent) | 1 year | Records your analytics consent preference (granted or denied); strictly necessary, no PII |
8. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
8.1 Under the EU General Data Protection Regulation (GDPR)
- Right of access (Art. 15) — Request a copy of all personal data we hold about you.
- Right to rectification (Art. 16) — Request correction of inaccurate personal data.
- Right to erasure (Art. 17) — Request deletion of your personal data, subject to legitimate retention obligations (e.g. tax records).
- Right to restriction of processing (Art. 18) — Request that we stop processing your data while a dispute is being resolved.
- Right to data portability (Art. 20) — Request your data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21) — Object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.
- Right to lodge a complaint — You may file a complaint with a supervisory authority in your EU/EEA member state.
8.2 Under the India Digital Personal Data Protection Act, 2023 (DPDP Act)
- Right to access information — Request a summary of your personal data and processing activities.
- Right to correction and erasure — Request correction of inaccurate data or erasure of data no longer necessary for the purpose it was collected.
- Right to grievance redressal — You may contact our grievance officer (details below) or the Data Protection Board of India.
- Right to nominate — Nominate another person to exercise your rights in the event of your death or incapacity.
8.3 Under the California Consumer Privacy Act (CCPA)
If you are a California resident, you have the right to know what personal information we collect, request deletion, and opt out of any sale of personal information. We do not sell personal information.
8.4 How to Exercise Your Rights
To exercise any of these rights, email us at hello@squaredr.tech with the subject line “Data Subject Request”. We will verify your identity and respond within thirty (30) days. If we need more time due to the complexity of your request, we will notify you within the initial 30-day period and may extend by up to sixty (60) additional days.
For erasure requests, please note:
- Contact form data is held by Resend (not SquaredR) and is automatically deleted after 30 days. SquaredR does not maintain an independent copy. Support correspondence via email can be deleted upon request.
- Our licence system does not contain any personal data (no email, no name, no IP addresses). There is nothing to erase, access, or port from the licence database.
- Your purchase records, email address, and payment details are held by Gumroad, not by SquaredR. To exercise data subject rights over that data, you must contact Gumroad directly via their Privacy Policy.
9. Your Data in FieldCraft Deployments
When you use FieldCraft to build forms, all form submission data stays on your infrastructure. SquaredR has zero access to it. You are the data controller for that data and are solely responsible for:
- How you collect, store, and process data submitted through forms you build with FieldCraft.
- Complying with all applicable data protection laws (GDPR, CCPA, DPDP Act, HIPAA, or any other regulation relevant to your use case).
- Providing your own privacy policy to your end users.
- Implementing appropriate technical and organisational security measures for data you collect.
SquaredR provides a form rendering tool. We are not a data processor, sub-processor, or any other party in the data processing chain for data your applications collect. We bear no responsibility for how you handle your users’ data.
10. Children
The FieldCraft website and npm packages are developer tools not directed at children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at hello@squaredr.tech and we will delete it promptly.
11. Security
We implement appropriate technical and organisational measures to protect the data we process, including:
- All data in transit is encrypted using TLS (HTTPS).
- Licence key validation uses secure, encrypted connections.
- TOTP authenticator secrets are encrypted at rest in our database.
- Our licence database contains no personally identifiable information, which significantly reduces the impact of any potential data breach.
- We do not store payment instrument data or buyer identity data (this is handled entirely by Gumroad’s PCI-compliant infrastructure).
No method of transmission or storage is 100% secure. If we become aware of a data breach affecting personal data (e.g. contact form submissions or support correspondence), we will notify affected individuals and the relevant supervisory authorities as required by applicable law (including the Data Protection Board of India under the DPDP Act and supervisory authorities under the GDPR) without undue delay. A breach of our licence database would not constitute a personal data breach, as it contains no information that can identify a natural person.
12. Changes to This Policy
We may update this Privacy Policy if our data practices change (e.g. if we add analytics, a newsletter, or a new payment processor). Changes will be posted on this page with an updated “Last updated” date. Since SquaredR does not store email addresses, we cannot notify you directly of changes. For material changes, we will provide notice through Gumroad’s product update notifications and through the FieldCraft Pro package itself (e.g. a console notice on update). Check this page periodically if you are concerned.
13. Grievance Officer (India DPDP Act)
In accordance with the Digital Personal Data Protection Act, 2023, the following person is designated as the Grievance Officer for the purposes of this policy:
- Name: SquaredR Grievance Officer
- Email: hello@squaredr.tech
The Grievance Officer will acknowledge your complaint within 48 hours and resolve it within thirty (30) days.
14. Contact
For any questions, concerns, or requests related to this Privacy Policy or your personal data:
- Email: hello@squaredr.tech
- Website: /pro (contact form)
- Subject line for data requests: “Data Subject Request”