Privacy Policy

The Landings service requests
For The Landings Association, Skidaway Island, Georgia

This policy explains what the service-request app collects, who can see it, where it is kept, how long for, and how to ask for a copy or for it to be deleted. It describes how the app actually works today. When the app changes in a way that affects your information, this policy changes with it.

Who is responsible

The Landings Association decides what the app is used for and what happens to the reports in it. For your information, the Association is responsible.

Nexus Property Management Software Solutions builds and runs the app for the Association, and handles your information only on the Association's instructions, under a written agreement that limits what Nexus may do with it. Nexus is the business name of James Perkins, a sole proprietor in Savannah, Georgia. Nexus does not use your information for its own purposes, and does not sell it or share it with advertisers.

What the app collects

Your account

• Your name and email address
• Your password, stored only as a one-way hash, so nobody, including Nexus, can read it
• Your role (Member, Crew, Coordinator or Administrator) and your community
• For staff, the department you work in
• A profile picture, if you choose to add one

Your reports

• The type of problem, where it is (in your words), and your description
• A photo, if you add one
• When you filed it, and its progress: status changes, the staff member assigned, and notes staff add
• The crew's note on what they did, and your answer to whether the problem is fixed, with your reason if you say it is not
• For staff: priority, due dates, time spent and work notes

Photos, and the location inside them

A phone photo normally carries hidden details: the exact GPS position it was taken from, the time, and the model of phone. The app removes these before a photo is stored. Your phone redraws the photo before sending it, which leaves the hidden details behind, and the server removes them again from any JPEG photo that arrives with them. In the rare case a phone cannot redraw a photo in a format other than JPEG, that photo may keep its details.

Where a report is

You can say where a problem is in three ways: type it, drop a pin on a map, or tap Use my location.

• The app reads your phone's location only when you tap Use my location, and only once. It never follows where you go, and it does not read your location in the background.
• What is kept is the one point you chose for that report, rounded to about a metre. If it is not on The Landings, the app refuses it and keeps nothing.
• Your phone asks your permission the first time. You can refuse, or withdraw it later in your phone's settings, and still report by typing or by dropping a pin.

When a map is shown, your browser fetches the map pictures directly from the map provider: Google Maps, or OpenFreeMap where Google Maps is not set up. The provider therefore sees your IP address and which part of the map you are looking at, as any website that shows a map does. The app sends it nothing else about you.

Technical information

• A sign-in cookie. It keeps you signed in, cannot be read by scripts on the page, and is removed when you sign out.
• One marker on your device recording that it has signed in before, so the app can open with no signal. It holds no password or key.
• Reports you make with no signal, and pages you have opened, saved on your device until they can be sent or refreshed. Signing out deletes all of it.
• Server logs kept by the hosting provider, which include your IP address, the time, and the page requested. They are used to keep the service running and to investigate misuse.
• When someone tries a community code, a counter keyed by a scrambled (hashed) form of their IP address, so nobody can guess codes by trying thousands of them. The address itself is not stored, and the counter expires after 15 minutes.

Page statistics

The app counts page views and measures how fast pages load, using Vercel Web Analytics and Vercel Speed Insights. Neither uses cookies, neither builds a profile of you, and neither follows you to other websites. Because the app does no cross-site tracking, browser settings such as Do Not Track and Global Privacy Control have nothing to switch off here.

What the app does not collect

• Payment or bank details. The app takes no payments.
• Your phone's location, except the single point you choose to add to a report
• Text messages. Reporting by text is not offered.
• Anything for advertising

How your information is used

• To route your report to the right department, and to fix the problem
• To show you your report's progress
• To keep the Association's records of work on common property, and to plan maintenance using totals and trends
• To run, secure and support the app
• To meet a legal obligation, such as a valid court order

Your information is never sold, rented, or used for advertising.

Who can see it

• You see your own reports.
• Association staff see reports according to their role: Coordinators and Administrators see all of them, and Crew see the jobs assigned to them. Staff see your name on your reports.
• You see the name of the staff member assigned to your report.
• Other residents cannot see your reports or your account.
• Nexus can see information only when it needs to: to keep the app running, to fix a fault, to investigate misuse or a security problem, or when the Association asks for help.
• The service providers listed below hold information so the app can work.
• Anyone else only where the law requires it. Where the law allows, the Association will be told first.

Service providers (processors)

These companies store or process information so the app can work. Each is bound by its own terms and security commitments, and none is permitted to use the information for its own purposes.

• Vercel: hosts the app and its server logs, and provides the page statistics above
• Google Cloud (Firestore): stores accounts, reports and their photos, in the United States
• Resend: sends email, when the app sends any. It does not at present.
• Google Maps, or OpenFreeMap where Google Maps is not set up: draws the maps. Your browser fetches the map pictures from it directly, as described above.

The app does not use Stripe, Twilio, or any advertising or data broker. If a provider is added that changes what you should expect, this list will be updated before it is used.

Your account, your reports and their photos are stored and processed in the United States. A map provider's servers may be elsewhere; they see only what is described under Where a report is.

Photos are stored with the report they belong to, and shown only to the people who can see that report. A photo has no public web address of its own.

How long it is kept

• Your account: while you have one. When you close it, or ask for it to be closed, the account is deleted within 30 days.
• Reports and their photos: kept as the Association's maintenance records for three years after the report is closed, then deleted or stripped of anything that identifies you. The Association may keep a report longer where it is needed for a claim, an insurance matter, or a legal obligation.
• If you close your account, the reports you filed stay in the Association's records for that period, but your name can be removed from them on request.
• Server logs: a short period set by the hosting provider, then discarded.
• Backups, where they exist, age out on their own schedule. Deleted information can remain in a backup until then, and is not restored from it except to recover from a failure.

These periods are the proposal for the Association to confirm.

Your choices and rights

Whoever and wherever you are, you can ask:

• For a copy of the information the app holds about you
• For anything wrong to be corrected
• For your account to be closed and your information deleted, subject to the records the Association keeps as described above
• How your information has been used

Ask the Association, or contact Nexus below. Nexus will pass a request to the Association and help it answer. You will get a reply within 30 days. To protect you, you may be asked to confirm it is really you before anything is disclosed or deleted.

Security

• Passwords are stored as one-way hashes.
• All traffic to and from the app is encrypted.
• The database cannot be reached from browsers at all; only the app's server can read it.
• What each person can see is checked on the server, by role, on every request.
• Signing out clears the app's saved data from the device.

No system is perfectly secure. If a security incident affects your information, the Association will be told promptly, and you will be told as the law requires.

Children

The app is for adults. It is not directed at children under 13, and it does not knowingly collect their information. Please do not photograph children in a report.

Changes to this policy

When this policy changes, the new version will be posted here with its effective date. For any change that matters to you, members will be told in the app or by email before it takes effect.

Contact

About your reports, or the Association's records:
The Landings Association, Skidaway Island, Georgia
[Association privacy contact: to be confirmed on adoption]

About the app, or to ask for a copy or deletion of your information:
Nexus Property Management Software Solutions
nexus.property.mgmt.sftwr.sol@gmail.com
843-593-0908