Privacy Policy

TOW AND TROWEL Privacy Policy - Pilot Release Effective Date: 9/18/2026 1. Overview and Roles This Privacy Policy explains how Tow and Trowel (the "App"), operated by Matthew Mocko, an individual operating Tow and Trowel ("Developer," "we," "us"), handles information used in the App. The participating Lodge owns or controls its Lodge Data and determines the purposes for which Lodge records are maintained, who may access them, and how Lodge-controlled records should be corrected or retained. Tow and Trowel processes Lodge Data as reasonably necessary to operate, secure, support, back up, troubleshoot, and improve the service as described below. 2. Information the App May Store Depending on how a Lodge uses the App, information may include: • Names, login email addresses, phone numbers, and mailing addresses. • Home Lodge name/state for members associated with another Lodge; dues card identifiers; Masonic degree/rank; officer or administrator roles; and member-directory privacy preferences. • Membership request and approval history, including request dates, approval or denial, approver/denier, and denial reason. • Running dues balances; donation records such as amount, fund, date, anonymous flag, payment method, and payment transaction identifier; and event-payment metadata such as amount, method, status, and transaction identifier. • Officer contact information, including lightweight officer/contact records where no full member account exists. • Events, descriptions, dates/times, locations, costs, RSVP deadlines, rank restrictions, RSVP status, guest counts/names, exemptions, and related payment metadata. • Documents and files uploaded to Lodge repositories, including degree-, officer-, committee-, history-, ritual-, or other access-restricted material, together with titles, descriptions, categories, uploader, and upload date. • Committee information, rosters, documents, events, fundraising funds/goals/totals, Lodge News, attachments, and member feedback or support requests. • Lodge branding and configuration, including logo, Lodge name/number/address, custom labels, theme information, and displayed legal text. • Login timestamps and audit/activity records showing certain creation, editing, deletion, or other actions and the associated user/time. Tow and Trowel is not designed or intended to store Social Security numbers, payment-card numbers, bank credentials, passwords, medical records, or similar high-risk information. Users and Lodges must not intentionally upload or store such information in the App unless the Developer has expressly authorized that category of information in writing. 3. Payment Information Tow and Trowel does not receive or store full payment-card numbers, bank credentials, or payment-account credentials. Payment entry is handled through the Lodge's third-party payment provider. Tow and Trowel may receive and store transaction metadata returned by the provider, such as transaction identifier, amount, method, and payment status. Funds are paid through the Lodge's provider relationship and do not pass through the Developer. 4. How Information Is Used Information is used to provide Lodge administration and member functions, authenticate and authorize users, maintain Lodge records, support events and communications, record payment metadata, operate document repositories, troubleshoot and support the service, maintain backups, investigate security or abuse, comply with legal obligations, and protect the service and its users. Tow and Trowel may use aggregated or de-identified information for usage statistics, analytics, performance measurement, security, and future product development, provided the information cannot reasonably identify a member or reveal identifiable Lodge Data. 5. No Sale, Advertising Use, or AI Training Tow and Trowel does not sell, rent, or trade Lodge Data or members' personal information. We do not use identifiable Lodge/member information for third-party advertising or unrelated commercial purposes. We do not use Lodge Data, member personal information, uploaded documents, or other identifiable Lodge content to train artificial-intelligence or machine-learning models. 6. Service Providers and Third Parties Tow and Trowel relies on third-party providers to host, operate, secure, communicate, diagnose, back up, and process payments for the App. Current categories include database/authentication/storage providers, application hosting, payment processing, email delivery, error monitoring, source-code and backup infrastructure, and domain/DNS services. Current providers may include Supabase, Vercel, Square, Resend (and its underlying email infrastructure), Sentry, GitHub, and Namecheap. Providers may change as the App evolves without Lodge approval unless the change materially affects how Lodge Data is collected, used, disclosed, stored, or otherwise materially affects the privacy protections described here. Tow and Trowel makes no promise that data will be stored or processed in a particular state, country, region, or data center. 7. Privileged Developer Access The App includes a Global Administrator capability with broad technical access. The Developer may access Lodge Data when reasonably necessary for support requested by the Lodge, troubleshooting, development/testing, security investigations, system maintenance, backup/recovery, legal obligations, protection of the service or users, or unforeseen circumstances reasonably necessary to operate, protect, restore, or support Tow and Trowel or a Lodge. This capability is not intended for general browsing of Lodge Data. 8. Sharing and Disclosure Lodge Data may be disclosed to authorized Lodge users according to Lodge-controlled permissions; to service providers as reasonably necessary to operate the App; at the Lodge's direction; or when legally required. Tow and Trowel will not intentionally disclose non-public Lodge Data to unrelated third parties except for these purposes. When a legal request seeks Lodge Data, the Lodge is ordinarily the preferred source. If a legal demand specifically compels the Developer or Tow and Trowel, the Developer may comply to the extent legally required and, when legally permitted and reasonably practicable, notify an Authorized Lodge Contact before disclosure. 9. Security Tow and Trowel uses reasonable technical and administrative safeguards appropriate to the service and its pilot stage. No system, authentication method, access control, backup, transmission method, or security measure is flawless, and absolute security is not guaranteed. If a correctly configured access control fails because of a software defect, the Developer will make reasonable efforts to investigate, correct, and provide appropriate notice, subject to the pilot's warranty and liability limitations. Users and the Lodge are responsible for credentials, email-account security, devices, shared sessions, account permissions, and prompt reporting of suspected compromise. Tow and Trowel may take immediate protective action when reasonably necessary to protect accounts, data, users, or the platform. 10. Security Incidents If the Developer discovers and assesses a suspected or confirmed security incident involving Lodge Data, the Developer will notify the Lodge's Authorized Lodge Contacts as soon as reasonably practicable and provide follow-up information as it becomes reasonably available. This policy does not promise a fixed contractual notification period where applicable law requires a different process or timing. 11. Cookies and Browser Storage The App may use cookies, local storage, or similar browser technologies necessary for authentication, security, preferences, session management, and operation of the service. Tow and Trowel does not currently use these technologies for third-party advertising or behavioral advertising. 12. Retention and Backups Lodge Data may be retained while the Lodge participates in the service and as otherwise described in the Pilot Use Agreement. Tow and Trowel currently maintains recurring backup copies of database and uploaded storage data, including a rolling backup cycle. Deleting active data does not necessarily cause immediate deletion from every backup. Routine backup copies may remain until they expire naturally under the backup cycle, and information may be retained longer when reasonably necessary for legal, security, dispute, or enforcement purposes. After termination, the Lodge ordinarily has sixty (60) days to retrieve available Lodge Data before active data may be deleted. An Authorized Lodge Contact may request earlier deletion through a verified written request. Extended retention beyond the normal period is not guaranteed unless the Developer expressly agrees in writing. 13. Member Access, Correction, and Deletion Requests Because the Lodge controls its Lodge records, members should direct requests to review, correct, or delete Lodge-controlled information to the Lodge or its authorized administrator. Tow and Trowel does not independently decide whether a Lodge record is accurate or should be changed or deleted, unless action is legally required. Loss of account access does not automatically delete historical Lodge records associated with that person. 14. Downloads and Copies Outside the App Once an authorized user downloads, exports, prints, photographs, screen-records, copies, or otherwise reproduces Lodge Data outside the App, Tow and Trowel no longer controls that copy. The Lodge and user are responsible for its subsequent security, storage, use, disclosure, transmission, and disposal. 15. Communications Lodge-generated communications are controlled by the Lodge. Essential Tow and Trowel operational communications, including account verification or recovery, security messages, and required legal/privacy notices, may be sent while an account remains active. These operational messages are not marketing communications and may be necessary to maintain an account. 16. Age Eligibility Tow and Trowel accounts are intended for adults age eighteen (18) and older. The App is not intended to provide accounts to minors. 17. Business Transfer A transfer of Tow and Trowel to an entity created or controlled by the Developer may include continuation of service under the applicable agreements if the successor assumes the relevant obligations. If Tow and Trowel is sold to an unrelated third party, Lodge Data will not be transferred to the purchaser without the Lodge's express approval. Where reasonably practicable, the Lodge will receive at least three (3) months' advance notice and an opportunity to choose whether to enter an agreement with the new owner or terminate and retrieve its data under the normal termination process. 18. Changes to this Policy Material changes affecting how Lodge Data or personal information is collected, used, disclosed, stored, or protected will be communicated with reasonable advance notice to active Lodges or users as appropriate. Administrative clarifications, security-related changes, routine updates, and changes required by law may take effect without re-signing. A future use of identifiable Lodge Data for materially different purposes would require an appropriate policy and notice process. 19. Contact Tow and Trowel is operated by Matthew Mocko, an individual operating Tow and Trowel. Privacy questions may be directed to: matthewmocko23@gmail.com.