Glovebox
The short version
- Your business data lives on one server in Adelaide, South Australia, run by Glovebox, with encrypted backups kept for 14 days.
- You own your data. Ask and we send you an export; delete your account and it is gone at once.
- No ads, no tracking, and we never sell personal information.
- Three outside services touch your data: Cloudflare (in transit), Resend (email we send you) and Apple (if you sign in with Apple). Nobody else.
Who we are
Glovebox is job management software for trade businesses, made and run in South Australia by one operator (“Glovebox”, “we”, “us”). This policy explains how we handle personal information in the Glovebox office web app, the Glovebox iPhone app and this website, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It describes what the service does today, not what it might do later; when we add a service provider or a feature that touches personal information, this page changes first.
Our customers are trade businesses (“you”). You put information about your own customers, staff and subcontractors into Glovebox. For that information you are in control, and we handle it on your behalf.
What we collect
About you and your business
- Your name, email and a salted password hash (never the password), or your Apple account identifier if you sign in with Apple.
- Your business details: name, ABN, GST registration, phone, email, address, trade, and the bank details (BSB and account number) you want printed on invoices.
- Your team members' names, emails and roles and, if you use timesheets, their hours.
What you put in Glovebox
- Your customers' names, contact details and site addresses.
- Enquiries sent through your public enquiry form (the enquirer's name, phone, email, job address and description).
- Quotes, jobs, notes, photos, forms, certificates, invoices and payment records, and a customer's typed name and drawn signature when they accept a quote.
From the apps
- Neither app uses your location, and neither contains advertising or analytics SDKs.
- Basic technical records to keep the service running: sign-in sessions, the connection address for rate limiting while a request is handled, and the time and error code of failures.
How we use it
- To run Glovebox for you: store your jobs, send your quotes and invoices by email, and show them to your customers through the links you send.
- To send you account email: sign-in codes and password resets.
- To give you support, when you ask for it.
Glovebox has no card payments, SMS or accounting sync yet; when those arrive they will be listed under service providers below before they are switched on. We never sell personal information and we don't use your customers' details to market to them.
Where it is stored
Your business data is stored on one server in Adelaide, South Australia, operated by Glovebox, in a database and a file folder on that server. It is not spread across cloud regions and no other company holds a copy, apart from the encrypted backups below. Connections reach the server through Cloudflare's network, which passes traffic through and keeps its own edge statistics, but stores none of your content.
Every night the database and files are backed up, encrypted on the server before anything leaves it, and kept for 14 days on the server and as an encrypted copy on an off-site storage account (Proton Drive) that cannot read it.
Service providers
| Provider | What for | What they receive |
|---|---|---|
| Cloudflare | Carrying connections to the server | Traffic in transit and connection statistics; no stored content |
| Resend | Account email (sign-in codes, resets) and sending quotes and invoices | The recipient's email address and the email, including the document link |
| Apple | Sign in with Apple, if you choose it | Apple handles the sign-in; we receive an account identifier and, if you share it, your name and email |
| Proton Drive | Off-site copy of the encrypted backup | An encrypted archive it cannot open |
That is the whole list. There is no payments partner, SMS gateway or accounting integration yet.
Your rights
You can ask to see or correct the personal information we hold about you, and to have it deleted. Account owners can delete their business and account from Settings; deletion is immediate. For an export of all your business data, email us from the owner's address and we send it within a few days (a self-service export in Settings is coming). If your customer asks you for their information, you can find it in their customer record and you can delete it there.
How long we keep it
While your account is active, we keep your data. When you close your business or delete your account, its records, files and team memberships are deleted from the live system at once, and the last copy ages out of the encrypted backups within 14 days. Enquiries sent through your public form stay in your account until you delete them. Our own records of what you paid us, if anything, are kept for seven years as tax law requires.
Security
Data is encrypted in transit (HTTPS everywhere). Backups are encrypted before they leave the server. The server's own disk is not encrypted; access to it is limited to the operator, by key only, and the server keeps no access logs. Passwords are hashed. Team roles limit what each member can read: field staff never see invoices, bank details or buy prices. The operator opens customer records only to support you or to keep the service running. If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
This website
This website sets no cookies, runs no scripts and loads nothing from other sites. Our web server keeps no access logs for it. Cloudflare, which sits in front of it, keeps its own aggregate statistics.
Changes and contact
We'll update this page when our practices change, and email account owners about significant changes. Questions or complaints: support@useglovebox.app. If you're not happy with our answer, you can contact the OAIC.