Privacy

Last updated: October 23, 2026

TradeGuild is run by Khaled Messai, a sole proprietor in Illinois, doing business as TradeGuild. "We" means him and the tools he uses to run it. Questions go to info@tradeguild.io.

This page covers three groups of people:

• our customers: businesses that use the TradeGuild app;
• people who visit tradeguild.io or app.tradeguild.io;
• people who appear in the public records we read. (Short answer: we don't name them.)

The short version

• We collect what the app needs to build your list: your email, your business, where you work, the trades you sell, and the customers you add.
• We never sell, rent or share your customer list. It is used only to build your own list.
• We use no advertising or analytics trackers. The public site sets no cookies.
• Card details go to Stripe, never to our server.
• Ask us to delete your account and we will.

What we collect from customers

When you sign up and use the app, we keep:

• Your email address. We use it to sign you in and to send your Monday email. We record when you signed up, when you confirmed your email, and when you last signed in.
• Your business. Its name, what kind of business it is, the trades you sell, where you work (ZIP code, town and a map point) and the distance you cover.
• Your customers. The business names you pick, upload or mark as won. For each one we keep whether it's active or lapsed, and an account number if your spreadsheet has one.
• What happened after each call. The taps you make (called, left a message, won, not a fit, remind me later) and when you made them.
• Your settings. Whether you want the Monday email, and light or dark mode.
• Your billing status, from Stripe. Your Stripe customer and subscription IDs, your plan, its status and dates, and whether a payment needs attention. We never receive or store card numbers.

Before you sign up, the start page lets you see your calls without giving an email. What you type there stays in a cookie in your own browser, not in our database. It is saved to an account only after you confirm your email.

When you upload a customer spreadsheet

• We read only three columns: customer name, status and account number. We don't read any other column, such as contact people, phones or emails.
• Rows that look like a person's name instead of a business are skipped and counted. They are never stored.
• We match the business names to contractors in the permit records and save those names to your account.
• We don't keep the file itself.
• Files can be up to 2 MB and 5,000 rows.

What we collect from visitors

• tradeguild.io, our public site, has no scripts, no cookies and no analytics.
• Our web server logs each request: the IP address, the page asked for, the browser type and the time. Sign-in links are removed from these logs. We keep the logs for 14 days and use them to keep the service running and to stop abuse.
• The app keeps its own error and payment-event logs for up to 3 months.
• To stop abuse of sign-in and the start page, we count requests per email, network and IP address. The counters store scrambled keys, not the addresses themselves. Each counter is deleted a day after its time window ends.

Cookies and storage on your device

The app uses two cookies. Both are needed for it to work.

• stake keeps you signed in and protects forms from forgery. Before you sign up, it also holds what you typed on the start page. It lasts a year and renews whenever you use the app. It is signed so it can't be changed, but it isn't encrypted. It holds nothing beyond what you typed into that browser.
• stake_device remembers that this browser has signed in before, so a flood of sign-in requests from somewhere else can't lock you out. It lasts 400 days.

The app also stores its own files and your latest "This week" page on your device, so it opens without a connection. Signing out clears them.

We use no advertising, analytics or tracking cookies.

Who else handles data

A few companies help us run TradeGuild. Each one gets only what its job needs.

• Stripe takes payments. It receives your email, your business name, your card and your billing address. It keeps its own records under its own privacy policy.
• Resend sends our emails: sign-in links and codes, and the Monday email. It receives your email address and what the email says.
• Microsoft 365 hosts our mailbox, info@tradeguild.io. Emails you send us are stored there.
• Oracle Cloud hosts the server that runs the app, its database and its backups, in Oracle's Chicago region.
• Anthropic. Khaled runs TradeGuild with help from an AI assistant built on Anthropic's Claude. It works on our server and reads our hello@ mailbox. While doing that work, it can see account data and the emails you send us.
• Vercel runs the DNS for our domain. It receives no account data.
• GitHub stores our code and runs our automated tests and an uptime check. It receives no account data.
• OpenStreetMap. The map in the app loads map images from the OpenStreetMap Foundation's servers. Those servers see your IP address and which part of the map you're looking at.
• Google Maps and Apple Maps open only when you tap a directions link. They receive the addresses in that link.

We don't sell personal information. We share it with no one else, except when the law requires it, or to protect someone's safety or TradeGuild's rights. If TradeGuild is ever sold, your data goes to the new owner only under this policy, and we'll email you first.

Your customer list

• We never sell, rent or share it.
• We use it only to build your list. It shows your customers' new permits, tells you who has gone quiet, and keeps your customers apart from your new-contractor calls.
• It is never used for anyone else's list, and we don't combine it with other customers' lists.
• You can remove a customer at any time. Deleting your account deletes the list.

How long we keep things

• Your account: until you ask us to delete it. We don't yet delete closed accounts on a schedule.
• Sign-in records: your email, and when each link or code was sent and used. The links and codes are stored only in scrambled form, and they stop working after 30 and 15 minutes. We don't yet clear old records automatically.
• Payment event records: 90 days. These hold Stripe's event IDs and types, not their contents.
• Backups: a copy of the database is made every night and kept for 14 days. Khaled also copies backups to his own computer by hand from time to time.
• Web server logs: 14 days. App logs: up to 3 months.
• Emails you send us: in our mailbox until we delete them.
• Stripe keeps payment records for as long as the law and its own policy require.

Deleting your data, and other requests

To delete your account, email info@tradeguild.io from the address on the account. We will:

• delete your account, its users, where you work, your customer list and your call history from the live database;
• cancel your subscription if one is running, and ask Stripe to delete your customer record (Stripe keeps the transaction records the law requires it to keep);
• let our backups age out, so the last copies are gone within 14 days.

We'll confirm within 30 days. You can also ask for a copy of what we hold about you, or ask us to correct it.

Some things you can do yourself in the app: remove customers, turn off the Monday email, and sign out everywhere.

People named in public records

TradeGuild is built from the building permits that cities publish. Those records sometimes name homeowners. Here is how we handle that:

• We name businesses, never homeowners or other private individuals. When a record names a person, we drop the name as we read the record. We never store it.
• We show a phone number only for a contractor that is clearly a business. We never show a number that might be a person's own.
• Our public site and emails show the street, not the house number. In the app, subscribers see the street. The full address is used only for the map pin and the directions link.
• Every page and email goes through an automated check before it goes out. The check blocks it if a person's name or a non-business phone number would appear.

To learn more, or to ask us to remove or correct a listing, see Data sources.

If we emailed you about TradeGuild

We may have found your work email on your company's website or in Apollo.io, a database of business contacts. We keep your name, work email, company and job title so we can write to you, plus a record of what we sent. Reply "stop" and we won't write again. We keep your address on a do-not-contact list so it stays that way.

Security

See How we protect your data.

Children

TradeGuild is a service for businesses. It isn't meant for children, and we don't knowingly collect children's information.

Changes

We'll post any change here and update the date at the top. For a change that matters, we'll email customers at least 30 days before it takes effect.

Contact

Khaled Messai, doing business as TradeGuild. Email: info@tradeguild.io. Mail: TradeGuild, 2005 N. Prospect Ave #1235, Champaign, IL 61822.