Privacy Policy
Last updated May 2026
Who we are
Pencilled is a diary and project management app for freelance crew. This policy explains what personal data we collect, how we use it, and the rights you have under the UK GDPR and EU GDPR.
The data controller is the operator of Pencilled. To contact us about this policy or to exercise any of your rights, email support@pencilledapp.com.
What we collect
• Account details: name, email address and password. Passwords are securely hashed by our authentication provider, Supabase.
• Diary content you create: bookings, clients, locations, day rates, travel information, invoices, notes and attachments.
• Public business information you choose to import: when you enter a company website or search for a client, Pencilled may collect publicly available business information such as company name, website, address, contact details and logo to help populate your client records.
• Optional profile data: home address, mileage rate, VAT settings and other information you choose to provide.
• Calendar data you choose to sync: when you connect a device calendar or Google Calendar, Pencilled reads and writes only the calendar events you authorise.
• Subscription status: RevenueCat stores subscription and renewal information so we can determine access to Pencilled Pro features.
• Diagnostic information: anonymous crash reports and error logs used to improve reliability and fix bugs. These logs do not contain your bookings, clients or diary content.
Google user data
If you choose to connect your Google account to Pencilled, we may request access to specific Google user data only where needed to provide features you choose to use.
Depending on the permissions you grant, Pencilled may access:
• Google Calendar data, including calendar events, event titles, dates, times, locations, notes and availability information, so that you can view, create, update or sync authorised calendar events within Pencilled.
• Gmail data, including your Gmail email address, message metadata such as sender, recipient, subject, date and thread information, and email content where required to display, organise, reply to, send, or manage emails within Pencilled. If you choose to use email attachments in Pencilled, attachment metadata or attachment content may also be accessed where needed to provide that feature.
Pencilled uses Google user data only to provide user-facing features that you request, such as calendar syncing, availability management, email viewing, email sending, and project-related communication management.
We do not use Google user data for advertising. We do not sell Google user data. We do not transfer Google user data to advertising platforms, data brokers, information resellers, or other third parties for unrelated purposes. We do not use Google user data to determine creditworthiness or for lending purposes. We do not use Google user data to train general artificial intelligence or machine learning models.
Pencilled may store limited Google user data in your Pencilled account or on your device where necessary to provide syncing, email, calendar, project management, and offline access features. Google user data is retained only for as long as needed to provide the app features you use, unless a longer retention period is required by law, security, fraud prevention, or account recovery obligations.
You can disconnect Google integrations at any time. You may also request deletion of your account and associated data by contacting support@pencilledapp.com or by using the account deletion options available in the app or account portal.
Pencilled’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we use your data
We use your information:
• To provide the app and synchronise your data across your devices.
• To manage bookings, clients, projects and diary information.
• To estimate travel time, distance and costs between locations.
• To help populate client records using publicly available business information that you choose to import.
• To process and verify subscription purchases.
• To respond to support requests and account enquiries.
• To maintain security, prevent abuse and improve the reliability of the service.
Our legal bases for processing are:
• Performance of the contract you enter into when using Pencilled.
• Your consent for optional features such as calendar integration.
• Our legitimate interests in maintaining and improving the security, reliability and functionality of the service.
Sub-processors we use
We use trusted third-party providers to operate Pencilled:
• Supabase — authentication, database hosting and file storage.
• RevenueCat — subscription and entitlement management.
• Google APIs — used only when you choose to connect your Google account for Gmail or Google Calendar features.
• Apple App Store and Google Play Store — purchase processing and subscription receipts.
• Mapping and geocoding providers — address search, location lookup and travel calculations when you use location-related features.
• Public business data and logo services — used only when you request that Pencilled import client information from a website or business listing.
We do not sell your personal data.
We do not use advertising trackers within Pencilled.
Where your data is stored
Security - We use reasonable technical and organisational measures to protect personal data and Google user data against unauthorised access, loss, misuse, alteration or disclosure.
Data is transmitted using secure encrypted connections where supported. Cloud data is stored using Supabase infrastructure and protected by access controls. OAuth tokens used to connect Google services are stored securely and are used only to provide the Google-connected features you authorise.
Access to user data is restricted to systems and service providers that need it to operate Pencilled. Human access to Google user data is limited and only occurs where necessary for support, security, legal compliance, or with your consent.
Cloud data is stored on Supabase infrastructure. Local data, including offline diary information and attachments, remains on your device unless you choose to synchronise it.
How long we keep your data
We retain your account information for as long as your account remains active.
If you delete your account, we will remove your cloud data within 30 days, except where we are required to retain limited information to comply with legal obligations, accounting requirements or fraud prevention obligations.
Your rights
Depending on your location, you may have the following rights:
• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete information.
• Erasure — request deletion of your account and personal data.
• Portability — receive your data in a portable format.
• Restriction or objection — ask us to limit or stop certain processing activities.
• Withdraw consent — disable calendar integrations or other optional features at any time.
To exercise any of these rights, email support@pencilledapp.com.
You may also delete your account through the app or account portal where available.
Complaints
If you believe your data protection rights have been breached, you may lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk or with your local data protection authority.
Children
Pencilled is intended for working professionals and is not designed for use by anyone under the age of 16.
We do not knowingly collect personal data from children.
Changes to this policy
We may update this Privacy Policy from time to time.
If we make material changes, we will notify you within the app before those changes take effect.
The latest version of this policy will always be available within the app and on our website.
Contact
If you have any questions about this Privacy Policy or how your data is handled, please contact: