Sign-in, security, and your data

A pool company's customer list, addresses, and gate codes deserve bank-grade caution. Here is the posture, in plain language.

No passwords, on purpose

You sign in by clicking a link emailed to you. That is not a shortcut; it is the security model: no password to reuse from a breached site, phish, or scribble on the truck visor. The links expire quickly and work once. Protect the email account behind it (turn on two-factor there) and you have protected PoolChecker.

One active sign-in per account

Signing in on a new device signs the old one out. It ends login sharing between techs (seats mean something) and it means a lost phone is fixed by signing in anywhere else, which instantly deadens the old session.

What protects the customer list

• Role scoping: techs see only their own routes and the pools they service; the full book of business is owner and manager territory. Details in Roles and what each person sees.
• An audit trail: every meaningful action is logged with who and when.
• Customer payment cards are never stored by PoolChecker; they live in Stripe's vault, the same infrastructure behind millions of businesses. We store only the last four digits for display.
• Customer-facing pages use long unguessable links, revocable any time, and they die automatically when a customer is cancelled.

Media and history retention

Pool gallery photos are permanent (up to 50 per pool). Routine visit media ages out on platform defaults (service photos after about a year, service videos sooner), keeping storage sane; anything worth keeping forever is one tap: Save to pool, which moves it into the permanent gallery.

The deletion tools

• A tech deleting their account: their personal identity is anonymized, but visits and timesheets remain as your business records, attributed to "Former Technician". Employer records survive employee departures; that is deliberate.
• Delete My Data (owner only): wipes the company's operational data after an emailed verification code, and requires the subscription be cancelled first, so it cannot happen in one impulsive moment. Export first; the tool is right next to it.