Privacy

What is held about you is what the business entered in order to do the work: your name, and where they were given — your company, email address, phone number, the address of the property, and any notes they wrote about the job.

If you approved a quote or signed for completed work: the name you typed, the signature you drew, the exact wording of what you were agreeing to as it stood that day, anything you chose to type in the comment box, and the time. Your IP address is not recorded against a signature.

If the business sent you a text message: the message, and whether you had agreed to receive them. If you texted back, your reply is kept as well. Replying STOP records your number as one this business must not text again — a record we keep so that the instruction is not lost, and which nobody in their office can undo.

You are not tracked here. There is no analytics, no advertising, no tag manager, no chat widget and no session recording anywhere in MOLOTOK, and no other company’s code runs on any page. What you do on a quote or an invoice is reported to nobody but the business whose quote it is. The cookies page names the five cookies that exist and explains why there is no banner.

A link sent to you is a private address that stops working. Anybody holding the link can open the page, so treat it the way you would treat a document sent by email. The quote or invoice tells you the date it is open until, and after that the link is refused.

If you pay an invoice online, you are handed over to Stripe and your card details are given to them rather than to us. We never see a card number. We tell Stripe which invoice is being paid and, so they can send you a receipt, your email address.

Your name, your contact details, the jobs you were assigned, the hours you recorded, and any time off you asked for.

If you agreed to be texted: when you agreed, and the alerts sent to you. A reply you send back is kept too, and replying STOP stops the texts. It costs you nothing else — the same alerts, the same schedule and the same jobs are in the app either way.

Location, honestly. MOLOTOK can record where a clock-in or clock-out was made. It is switched off unless your employer turns it on. When it is on:

• Your browser asks your permission first, and you can refuse.
• Refusing never stops you clocking in or out, and never costs you an hour. A punch is always recorded whether a location is available or not. This is enforced by the database rather than promised: every location column can be empty, so there is no version of this software in which a missing position loses you the time.
• It records a position at the moment you punch, and nothing between. It is not continuous tracking and it is not running while you work.
• You can see exactly what was recorded about you, on your own timesheet. It is not a record kept from you and shown to somebody else.
• Your employer may also list the networks the business works from. If they have, the network address your punch arrived on is recorded, so a punch can be labelled as having come from the shop. It says which connection was used, not who used it — and the app describes it that way rather than calling anything verified.

If your employer is subject to a law requiring them to give you a written electronic-monitoring policy, this notice is not that policy. It describes what the software can do; your employer decides what they switch on, and telling you is their job rather than ours.

Your account: name, email address, password, and a log of significant actions taken in the app so that the account owner can see who did what. Passwords are stored hashed and never in a form anybody here could read back. If you turn on two-step sign-in, the key your authenticator app shares with us is stored too, encrypted, and is deleted when you turn it off.

Where it is. On a server in Secaucus, New Jersey. Your workspace’s database is a file of its own on that server’s disk, which it shares with other businesses’ workspaces.

What we can see. Everything, if we go looking. Fixing a problem in your workspace means getting a shell on the machine it runs on, and there is no technical barrier standing between the operator and your database. We would rather say that plainly than describe a lock that is not there. What we can promise is conduct: we look when there is a problem to fix, and we do not read your records for any other reason.

Other companies involved. Only those needed to run the service, and only what each needs:

• Fly.io hosts the server and the disk it writes to.
• GitHub runs the daily backup and stores it. The backup passes through GitHub’s machine for the minute it takes to encrypt it; what is stored is encrypted with a key GitHub does not have.
• Resend, or your own mail server — whichever is configured — delivers the email MOLOTOK sends on your behalf. Configure neither and nothing is sent anywhere: the message is recorded in your outbox and stays there.
• Stripe takes card payments, if you switch them on. Card details go to Stripe directly and never through us.
• Intuit QuickBooks, if you connect it, exchanges the records you chose to sync and nothing else.
• Telnyx, if you set texting up, delivers the texts MOLOTOK sends on your behalf and carries back the replies. They are given the phone number and what the message says. Leave either half of it unset and nothing is texted anywhere: the message is recorded in your outbox and stays there, and no company outside this list is given a phone number.

How long. For as long as your workspace exists. Your records are never deleted automatically or on a schedule; only the backup copies described below expire. If you are leaving, you have at least thirty days from the day you tell us before anything is deleted — and you do not have to ask us for the data itself. An administrator can download your records from Settings at any time, today or on the way out. That file holds every table your workspace keeps about your business, with one limit it states on its own first page: photos, uploads and signature images are listed in it but not contained in it, so save any you need to keep before you go.

Backups. Every workspace — its records and its uploaded files — is backed up every day. Each backup is encrypted with a key only we hold before it is stored, and it is kept for 90 days; separately, our hosting provider keeps a daily snapshot of the server’s disk for 60 days. Each is deleted when that time is up, so when a workspace is deleted, copies of it remain in backups for at most 90 days more. A backup is how we recover from a failure, not a copy you can ask to have individual records restored from, so download your own as well.

If we find out that your workspace’s data has been taken or opened by somebody who should not have it, we will tell you, and we will tell you what we know rather than waiting until we know everything.

That includes the case where what was taken is an email address together with the password that signs in with it, which is personal information under Pennsylvania’s breach notification law and is exactly what this software stores for everybody who has a login.

Where the people affected are your clients or your staff, the duty to notify them falls on you rather than on us, because they are your records. We will give you what you need in order to do it.

If you are a client or a member of staff, ask the business you dealt with. They hold the records, they can change them, and they can do it today — which is not true of us.

If you are the business, use the contact address on your workspace’s Settings → Subscription page.

MOLOTOK is operated by NovaLink Solutions Inc from Pennsylvania, and Pennsylvania law governs.

Pennsylvania has no comprehensive consumer privacy statute. A bill to create one, HB 78, passed the state House in October 2025 and is still before the Senate. What does apply is the Breach of Personal Information Notification Act, which is the section above and which binds a business of any size. If HB 78 becomes law, this page will be rewritten to say what it requires.

It will change when the software does — when a text-message provider is chosen, when backups exist, when the first charge is taken. It already has: the export button this sentence used to name as a future thing now exists, and the paragraph above it grew a retention window on the same day. The version that is up is the version that is true; anything that stops being true is a bug in this page, and it is a fair thing to complain about.