Privacy Policy

We collect as little about you as possible

Heavy Metal Assets is a tool your company uses to track its equipment and the work performed on it. We are built to hold as little personally identifying information about you as we can.

The only personal details tied to you are the name, email address, and account reference that your company provides so it can attribute equipment use, maintenance, and record-keeping. In almost every case these are company-issued email addresses, not personal ones.

What we track

We track equipment and maintenance details. Beyond the account your company provides, the only things associated with you are the entries you submit — things like receipts, the location of work performed, meter and fuel readings, service records, and equipment updates.

We do not track anything about you personally: no advertising identifiers, no third-party analytics or tracking SDKs, and no location tracking. The only locations we keep are the work location you choose to record on a submission and the position stored in photos taken with the in-app camera, described below.

The iOS and Android apps send your phone's time zone and its current offset from UTC with each request, and we store them with the records you submit, so those records show the local time they were made. A time zone covers a wide region, so it does not tell us where you are.

Any photos you add are of equipment, receipts, or the work itself — never personal photos — and we never ask for identifying details about you beyond the name and email your company provides. There is nothing personal to collect while you use the application, so there is nothing personal to worry about.

Photo location

Photos you take with the camera inside the iOS or Android app include the phone's GPS position at the moment the photo is taken, to show where a receipt or equipment photo was taken. The position is stored in the photo itself and is part of the company's record, like the photo.

The app asks for location only while you are using it, and only to stamp a photo; it never follows your location in the background. If you deny location access, or turn it off later in your phone's settings, you can still take photos and attach them: they are simply saved without a location.

A photo you pick from your phone's library keeps the location and the date and time your phone's camera already stored in it, as evidence of where and when it was taken.

This is company data, not your personal data

The information you submit belongs to the company you work for. It is associated with the company's equipment and is essential to maintaining that equipment for safety and performance.

Because it is a record of the company's assets and how they are operated and maintained, it is treated as company data — not as your personal data.

In data-protection terms, Heavy Metal Assets is a data processor acting on behalf of the company you work for, which is the data controller. The business records, maintenance logs, and expense receipts submitted during your work belong to that organization. That is why decisions about retaining or removing those records rest with the company, not with any single user's account.

Deletion — your rights and your company's rights

Your company may request deletion of its data at any time.

You may delete your account at any time, directly in the app under More (…) → Delete Account, or on the Delete Account page of this website. Your access and your sign-in credentials are deleted immediately when you confirm, and you are signed out on every device.

Your account is a single personal account, so deleting it applies everywhere it is used. When you request deletion, your access to conduct business on behalf of any company that uses Heavy Metal Assets is removed, and each of those companies is notified to remove you. That may affect your contract or employment relationship with those companies — and it is your right to make that request.

Requesting deletion deletes your login credentials: your password, your two-factor settings (authenticator secret and backup codes) and your passkeys are removed, and every active session and signed-in device is signed out, so the account can no longer be used. Deleting your account also means you are choosing to stop maintaining and submitting equipment records for the companies you work with, which may affect your working relationship with them.

The administrator of each company you work with then confirms the removal on the company's side. That step only notifies the company; it does not delay the deletion of your access and credentials, which has already happened. An administrator can instead invite you back. Because the account is yours, being brought back is your choice: any company you work with can send a reactivation link, but your account stays disabled and you cannot sign in until you open that link, accept it, and set a new password. No one can reactivate you without your consent.

There is no separate profile of personal information to erase, because we never built one: the only details ever tied to you are the name and email your company uses to attribute equipment use, maintenance, and record-keeping. Those remain part of the company's equipment records; what ends is your personal relationship with the application — you can no longer sign in or use it unless you accept a reactivation invitation.

What remains after your account is deleted

What is deleted: your access and your login credentials — your password, your two-factor settings and your passkeys are removed (a passkey's private key stays on your own device, where it can no longer sign in), and every session and signed-in device is revoked. What is retained: the equipment records, maintenance logs, receipts, and service history you submitted (the company's records), along with your name and the email you signed up with, kept solely as attribution on those records.

Approving a deletion request confirms it and keeps your account permanently disabled. Your name and email stay attached to the equipment records you worked on, because those records establish who performed a given piece of work on a company's equipment — much like you can close a store account but cannot erase the history of purchases you made. They remain only for that purpose, and nothing else personal was ever collected to remove.

Google Play's account-deletion policy includes an explicit exception for data that must be kept for legal, regulatory, or tax obligations. Being able to show who performed maintenance on a company's equipment is exactly that kind of record, so it — and any records the company's own retention policy requires in connection with your use and maintenance of its equipment — is retained even after your account is removed.

How your data is protected

All data is encrypted in transit. Access is governed by role-based permissions and scoped to your company, and the mobile apps keep your sign-in credentials in the device's secure, hardware-backed storage, on that device only. Face ID, Touch ID, or your phone's screen lock can also lock the app when you return to it. We follow security best practices to protect both your account and the company's fleet data.

Your choices and withdrawing consent

You can withdraw consent at any time. To stop the app using the camera or your location, deny camera or location access to Heavy Metal Assets in your phone's settings (iOS Settings, or Android Settings → Apps). The app keeps working: without location, photos attach with no position, and without the camera, you can still attach photos from your library.

To stop all use of your account, delete it in the app under More (…) → Delete Account, or on the Delete Account page. What is deleted and what is kept is described above.