Privacy Policy

Who we are

HVACR Passport is operated by Chad Reeves, sole proprietor, trading as HVACR Passport. We provide a platform that tracks HVAC equipment from manufacture through installation to homeownership, including warranty records, service history, and parts ordering.

This policy covers our websites, our web applications, and our mobile apps HVACR Passport (for homeowners) and HVACR Passport Contractor (for HVAC contractors and technicians).

Questions: [email protected]

What we collect

Information you give us

Account information. Your email address, first and last name, and a password (stored only as a cryptographic hash — we never store or can recover your actual password). Optionally a phone number.

Professional credentials. If you register as a contractor, home inspector, or other trade professional, we collect your license number and the state that issued it, along with the organization you belong to.

Equipment and property information. For installed equipment, we record the installation address (street, city, state, postal code), installation date, permit number, and the contractor who performed the work. Homeowners are linked to the units they own.

Service and technical records. Service visit logs, commissioning readings (refrigerant pressures, temperatures, airflow, electrical measurements), inspection results, parts used, support tickets, and messages exchanged between users of the platform.

Information collected automatically

Audit records. The platform maintains an audit trail of changes to equipment records. Each entry records the user, a timestamp, and the IP address the action came from. This exists to make the equipment chain of custody verifiable, which is the platform’s core function.

Device tokens. If you enable push notifications, we store a device push token so we can deliver notifications to your device.

Web usage and diagnostics. Our web applications use Sentry for error monitoring and session replay. This may capture your IP address, account identifier, browser information, and a reconstruction of your interactions with the page. Session replay is used to diagnose faults.

Our mobile apps do not include any analytics, advertising, or crash-reporting SDK. The Sentry integration described above applies to the web applications only.

What we do not collect

We want to be specific here, because these are common assumptions:

• We do not collect your device’s location. Neither mobile app requests GPS or location permission, and no location library is installed. Where the apps display a “location,” it refers to where a piece of equipment is in the supply chain, or the city recorded on an installation — not your device’s position.
• We do not store photographs. The camera permission is used solely to read QR codes. Images are processed on your device to decode the code and are never saved, uploaded, or transmitted.
• We do not sell your personal information, and we do not share it with advertisers or data brokers.
• We do not use your data to serve advertising. The apps contain no advertising.

How we use your information

• To operate the platform: identifying equipment, maintaining warranty and service records, routing parts orders, and delivering messages between users.
• To authenticate you and keep your account secure.
• To send notifications you have asked for, such as maintenance reminders and service updates.
• To maintain the audit trail that makes equipment history verifiable.
• To diagnose and fix faults in the software.
• To comply with legal obligations.

Who can see your information

The platform deliberately limits what each party can see:

• Manufacturers see equipment they made, its supply-chain status, installation records, and warranty claims. Manufacturers are isolated from one another — no manufacturer can see another manufacturer’s equipment or dealers.
• Distributors and contractors see equipment they handle and the parts catalogs they are authorized for.
• Homeowners see the equipment they own and its full history.
• Contractors cannot see homeowner contact details, and homeowners cannot see supply-chain pricing or dealer relationships.

Shareable links. Homeowners can generate a temporary link that lets someone without an account — typically a home inspector or prospective buyer — view a unit’s record. These links expire by date or view count and can be revoked at any time by the person who created them.

Ownership transfer. When a home is sold, a homeowner can transfer a unit’s record to the new owner. The new owner receives the equipment’s service and warranty history.

Service providers

We share data with the following providers only as needed to run the service:

AI-assisted diagnostics

Our web portals offer an AI diagnostic assistant for contractors and manufacturer technical staff. When used, equipment information is sent to a third-party language model provider to generate troubleshooting guidance.

What is sent: the equipment serial number, model and specifications, warranty dates, commissioning readings, recent service history, open support ticket text, and the city and state of the installation.

What is not sent: the homeowner’s name, street address, email address, or phone number. These are deliberately excluded from the data supplied to the model.

Note that free-text fields written by users — installation notes, service descriptions, support ticket text — are included, so users should avoid entering personal information into those fields.

This feature is not available in either mobile app.

Data retention

Equipment records — including installation, service, and warranty history — are retained for the life of the equipment and its ownership chain. This is intentional: the platform’s purpose is a durable record that survives changes of owner and contractor.

Account information is retained while your account is active. If you delete your account, we de-identify your personal information, but equipment records and audit entries are retained in de-identified form, because they document the history of physical equipment that may still be in service and under warranty.

Deleting your account

You can delete your account at any time from within either mobile app, under Settings → Delete account. Contractors and other organization members can also do this from the web portal under Settings.

When you delete your account, immediately and permanently:

• Your name, email address, phone number, and any professional license details are removed from our records.
• Your password is destroyed and you can no longer sign in.
• Your device push tokens are deleted, so notifications stop reaching you.
• Any active share links you created are revoked, and any pending ownership transfers involving you are cancelled.

What remains, in de-identified form: the equipment records themselves — installation, commissioning, service, warranty, and audit entries — and messages you sent to other users, which remain visible to the person you sent them to. These records document physical equipment that may still be installed, under warranty, and serviced by others, and they are not solely yours to erase. They no longer identify you.

One exception: if you are the only remaining administrator of a company account, you will be asked to appoint another administrator first, so the company’s records are not left unmanaged.

Security

• All traffic is encrypted in transit using TLS.
• Passwords are stored only as cryptographic hashes.
• Authentication uses short-lived access tokens with rotation and revocation.
• Access is enforced by role, with strict isolation between manufacturers.
• All changes to equipment records are audit logged.

No system is perfectly secure, and we cannot guarantee absolute security.

Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your personal information, subject to the retention limits above
• Export your data in a portable format
• Opt out of the sale or sharing of personal information — note that we do not sell or share personal information for advertising, so there is nothing to opt out of
• Withdraw consent for push notifications, at any time, in your device settings

To exercise any of these, contact [email protected]. We will respond within the period required by applicable law. We will not discriminate against you for exercising these rights.

Children

The platform is intended for homeowners and trade professionals and is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We may update this policy. If we make a material change, we will update the “Last updated” date and, where required, notify you in the app or by email. Continued use after a change means you accept the updated policy.

Contact

Chad Reeves, sole proprietor, trading as HVACR Passport
[email protected]