Privacy Policy

CampMarshal ("CampMarshal," "we," "us") provides QR/code-based equipment tracking software for disaster-relief rental fleets, through this website and the CampMarshal mobile app. This policy explains what information we collect through both, why we collect it, who we share it with, and how you can delete it. CampMarshal is operated by Ethan Ferrier. Questions or requests about this policy can be sent to help@campmarshal.com.

Who this applies to

CampMarshal is business software: your organization (a rental fleet operator) signs up and invites its own employees as users. If you're an employee using CampMarshal at your employer's direction, your employer controls the organization-level data (equipment records, job assignments, other employees' names); we process it on their behalf. This policy also covers the separate, no-account case where anyone who scans a public equipment tag can submit a report.

Information we collect

Account & profile. Name, email address, job title, and (if you add one) a profile photo. Your password is handled entirely by our authentication provider, Supabase Auth — we never see or store it in plain text.

Location. When you scan or check in equipment, or confirm an item's location, the mobile app records your device's precise GPS location at that moment. This is what powers the live map and location-confirmation features, and is stored separately from a job site's own registered address.

Photos. Photos you choose to attach to a status update or repair report, taken with your device's camera or chosen from your photo library. These attach to the report, not to you personally.

Equipment, job, and scan activity. Every scan, status change, and job assignment you make is recorded as part of your organization's equipment history — this is the core record-keeping CampMarshal exists to provide, and is retained as an audit trail (see "How long we keep information" below).

Device & push notifications. If you enable notifications, we store a device push token so we can deliver them to your phone.

Public equipment lookups. Scanning a public-facing equipment tag doesn't require an account. If you submit a report from that page, we collect what you enter and your IP address (used only to rate-limit abuse, not stored against your identity).

How we use this information

• To operate the core service: equipment tracking, job assignment, maps, and reporting.
• To deliver push notifications you've enabled.
• To prevent abuse of public, no-login pages (rate limiting).
• To provide support when you contact us.
• To comply with legal obligations.

We do not use your information for advertising, and we do not sell it.

Who we share it with

We use a small number of infrastructure providers to run CampMarshal, each of which processes data only to provide their service to us:

• Supabase — our database, authentication, and file-storage provider. All account, equipment, job, and photo data is hosted with Supabase.
• Expo — delivers push notifications to your device using your device push token.
• Mapbox — renders the maps shown in the app, which requires sending it the location coordinates needed to draw the map you're viewing.
• Sentry — our error-monitoring provider. When the app or website encounters an unexpected error, technical details about that error (and, where relevant, account and device identifiers needed to diagnose it) are sent to Sentry so we can find and fix the problem. Sentry does not receive your equipment, job, or report content.

We don't share your information with any other third party, except where required by law or to protect the rights, safety, or property of CampMarshal, our customers, or others.

How long we keep information, and how to delete it

You can delete your own account at any time from the mobile app's account settings. Deleting your account removes your login credentials and clears your personal profile information (name, photo, job title). It does not remove the scans, status updates, and reports you made while working — those stay in place, attributed to a generic "Deleted User" label instead of your name, because they're part of your former organization's permanent equipment and safety record, which other people's work depends on. Your device push token, personal notification history, and saved items are deleted outright, since nothing else relies on those.

Your organization's administrators can also revoke your access at any time, which immediately cuts off what you can see or do without deleting your account.

Security

Data in transit is encrypted (HTTPS/TLS). Access to your organization's data is enforced at the database level (Postgres Row Level Security), scoped to your organization and your access tier — not just checked in the app itself. No system is perfectly secure, but this is the standard we build to. See our security overview for more detail.

Children's privacy

CampMarshal is business software for employees of rental fleet operators. It is not directed at children, and we do not knowingly collect information from anyone under 16.

Your rights

Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information beyond what self-service account deletion covers. Contact us at help@campmarshal.com to make a request, or ask your organization's administrator if the data in question belongs to your employer's account.

Changes to this policy

If we make material changes to this policy, we'll update the effective date above. Continuing to use CampMarshal after a change means you accept the updated policy.

Contact

Questions about this policy or your data: help@campmarshal.com. See also our terms.