Sign-in, security, and your data

A pool company's customer list, addresses, and gate codes deserve bank-grade caution. Here is the posture, in plain language.

No passwords, on purpose

You sign in with a 6-digit code emailed to you. That is not a shortcut; it is the security model: no password to reuse from a breached site, phish, or scribble on the truck visor. Each code expires after 10 minutes, only the newest one works, and five wrong guesses lock that email address out for 15 minutes. Protect the email account behind it (turn on two-factor there) and you have protected PoolChecker.

One active sign-in per account

Signing in on a new device signs the old one out. It ends login sharing between techs (seats mean something) and it means a lost phone is fixed by signing in anywhere else, which instantly deadens the old session.

What protects the customer list

• Role scoping: techs see only their own routes and the pools they service; the full book of business is owner and manager territory. Details in Roles and what each person sees.
• An audit trail: every meaningful action is logged with who and when.
• Customer payment cards are never stored by PoolChecker; they live in Stripe's vault, the same infrastructure behind millions of businesses. We store only the last four digits for display.
• Customer-facing pages use long unguessable links, revocable any time, and they die automatically when a customer is cancelled.

Media and history retention

Pool gallery photos are permanent (up to 50 per pool). Routine visit media ages out on platform defaults (service photos after about a year, service videos sooner), keeping storage sane; anything worth keeping forever is one tap: Save to pool, which moves it into the permanent gallery.

Customer-list files you upload to the importer are not kept. The copy is erased the moment the import starts. A preview you never confirm expires after 24 hours, and a daily cleanup then erases its copy. See Import your customers.

The deletion tools

• A tech deleting their account: their personal identity is anonymized, but visits and timesheets remain as your business records, attributed to "Former Technician". Employer records survive employee departures; that is deliberate.
• Delete My Data (owner only): wipes the company's operational data after an emailed verification code, and requires the subscription be cancelled first, so it cannot happen in one impulsive moment. Export first; the tool is right next to it.