Privacy

Effective November 12, 2026

Your certificates stay on your device

Certificate PDFs, the text read from them, the fields you verify or type, subcontractor and holder names, contract requirements, results and correction lists are processed only in this browser. PDFs are read with PDF.js running in your browser (text only; no rendering is used to read fields, and no OCR). Certificates and company names are never uploaded to COIGap, to an insurer or to anyone else, and COIGap has no endpoint that accepts documents. CSV exports and printable reports are created in your browser.

What is stored in this browser

• Always: the random project ID, the project name you give it, and the purchase record of a paid project (IndexedDB), plus the ID of the last project opened and a 30-day campaign label (local storage). This is what lets a payment be recovered.
• Only if you opt in ("Keep this project's documents and entries in this browser"): the requirements, certificate fields, extracted text and the PDF files themselves (IndexedDB). Turning the option off deletes them. Without opt-in they are kept in memory only and are gone when you reload or close the tab.
• During checkout only: while you are on the payment page, the tab parks your requirements and certificate fields (not the PDF files) in its own session storage, and removes them when you return.

What reaches our server

• The random project ID and a SHA-256 project fingerprint computed in your browser from the project ID and its case ID. No certificate content goes into it; the documents are not sent and are not needed to confirm a guess about them.
• For checkout: the payment provider (Square or PayPal), a random checkout attempt ID, signed tokens, and a fixed-vocabulary campaign label (for example facebook / organic_social / coigap_launch, coigap_guide, coigap_agency). Free CSV downloads are counted with a random event ID. A completed free check is counted once per project using its random project ID. Both counters use the same campaign label.
• Our order ledger and counters (SQLite) store the provider, mode, order status, amount and label, with order numbers and recovery codes only as a keyed hash. We do not store IP addresses, cookies for tracking, file names or any certificate data. Our web server and reverse proxy may keep short-lived technical logs.

Payments

Payments are handled on the hosted pages of Square or PayPal under their privacy policies. The purchase description is "COIGap Full Project Report", $49.00 USD. We never see your card details.

Contact

Questions: contact us.