Privacy Policy

Fieldbuilt is a one-person web engineering studio operated as a sole proprietorship by Matt Spencer, based in Denver, Colorado, United States ("Fieldbuilt", "we", "us", or "our"). You can reach us at legal@fieldbuilt.dev or by mail at PO Box 203, Larkspur, CO 80118.

This Policy covers the website at fieldbuilt.dev, including its subpages (such as /services and /scan) and the small number of server functions that power its forms, the free website scan, and our internal lead handling (together, the "Site"). Our private lead system also stores inquiries submitted on other websites the operator runs; those submissions are governed by each originating site's own privacy policy. This Policy does not cover third-party websites we link to, the client projects shown in our portfolio (each of which has its own operator and its own policies, even where we built it), or services we perform for clients under a separate engagement agreement.

The Site is directed to a United States audience. Your use of the Site is also governed by our Terms of Service, published under the same operator identity, contact addresses, and Colorado governing law.

• No accounts, no tracking. The public Site has no user accounts or logins, sets no cookies of its own on any public page, and runs no analytics, advertising, or tracking scripts. Every asset the pages load is first-party. The only things stored in your browser are a light/dark theme preference and, if you are the site operator using an admin link, a session-only admin key.
• You control what we receive. We only receive personal information when you submit the inquiry form, submit the free scan form, or email us.
• Both forms feed a private lead database we run ourselves. Submissions are stored in a database we control (Cloudflare D1) and emailed to the operator. They are used to respond to you and for our own business records. They are not sold, rented, or shared for anyone else's marketing.
• The free scan looks outward, not inward. To build your report, our server fetches public information about the website you submit and a small number of competing businesses from public sources and analysis services. Your email address is never sent to any of those services.
• Scan reports live at a private link for 90 days. Your report is stored under a long, unguessable link that anyone you share it with can view. The public report page never contains your email address.
• We do not sell personal data, we run no advertising, and there is no mailing list behind any form on this Site. The Site sends the emails you ask for (your scan report, replies to your inquiry); the operator may follow up personally about something you submitted, and a single reply stops that.
• Email-based rights for everyone. You can request access, correction, or deletion of your information at any time by emailing legal@fieldbuilt.dev, and we honor these requests for all users regardless of what state you live in.

The inquiry form on our services page collects: your name, business name, and email address (required); and your phone number, website URL, the service you are interested in, and a free-text message (each optional). The form also contains a hidden field that is invisible to human visitors and exists solely to catch spam bots (a "honeypot"); it collects nothing from real users, and a submission that fills it is discarded without being stored or sent anywhere.

When you submit the form, three things happen: the submission is written to our private lead database (Cloudflare D1), a notification email containing what you typed is sent to the operator's inbox, and a short push notification alerts the operator's devices (see "Service Providers"). We do not capture your IP address, browser details, or any other technical metadata with an inquiry submission; the record is what you typed, plus the date and time we received it. (Our host, Cloudflare, processes IP addresses at the platform level for every request; see "Service Providers.")

We use inquiry submissions for exactly one purpose: responding to you and discussing the work you asked about. Please do not include sensitive personal information (health information, government ID numbers, financial account numbers) in the message field; we do not ask for any of these and do not want them.

The free scan form at /scan collects four things, all required: your website address, what your business does (your trade), where you work (city and state), and the email address where we send your report. It carries the same anti-bot honeypot as the inquiry form.

When you submit a scan, we store a lead record (your email, the website, trade, and city) in our private lead database, and then our server runs the audit described in the next section. When the audit finishes, we email the full report to the address you gave, and a copy of the report, together with a notification that you requested it, goes to the operator. There is no mailing list behind the scan form, and submitting it subscribes you to nothing. Because the scan exists to start conversations about our services, the operator may send you one personal, one-to-one note about your results; replying "no thanks," or emailing legal@fieldbuilt.dev, ends all contact.

Rate limiting is the one place our own code touches your IP address. To keep the free scan from being abused, our server keeps short-lived counters of how many scans have been requested per IP address, per email address, and per scanned domain each day. These counters expire automatically within 2 days, are used only for rate limiting, and are the only record of your IP address our application code creates. (Our host, Cloudflare, also processes IP addresses at the platform level for every website it serves; see "Service Providers" below.)

The scan is an outward-looking audit. To build your report, our server gathers information about the website you submitted, and about competing businesses in your trade and area, from public sources and third-party analysis services:

• Your website itself. We fetch its public pages (homepage, robots.txt, sitemap, llms.txt) and analyze what any visitor could see: page speed characteristics, on-page SEO elements, visible tracking and analytics tools, structured data, and similar signals.
• Google PageSpeed Insights receives the website address, to measure performance.
• Google Places receives a search query built from the trade and city you entered (for example, "roofing in Denver, CO"), to find review counts and ratings for businesses in your market.
• Ahrefs receives the website address (and competitor addresses), to retrieve a public domain-authority metric.
• Anthropic (Claude, an AI model) receives only the trade and city, to ask which local businesses an AI assistant would recommend. It does not receive your name, your email, or even your website address.

Your email address is never sent to any of these services. What they receive is the website address you asked us to audit and the trade and city you entered, which is the minimum each needs to do its part of the analysis.

Honesty requires a section most privacy policies do not have. A scan report benchmarks the submitted website against competing local businesses, so the scan also collects and stores public information about businesses that did not submit anything: their domain names, public review counts and ratings, public domain-authority metrics, and the visible technology on their public websites. Some of this appears in the report we send you, including, when the AI check runs, the names of up to three businesses an AI model mentioned for your trade and area.

Three things to understand about this data:

• It is public-source information about businesses, not personal information about consumers. Everything in it could be looked up by anyone: it comes from public websites, public review listings, and public metrics.
• We retain it in our private database as part of the scan record, and we may use it ourselves to understand local markets and to identify businesses we might contact about our services. When we do, we may mention that the business appeared in a scan comparison, without naming or identifying whoever requested the scan.
• Any business can ask about or object to its data. If your business has appeared in our scan data and you want to know what we hold or want it removed from our records, email legal@fieldbuilt.dev and we will tell you what we have and honor a reasonable removal request. Removal from our database cannot retract report emails already sent to the people who requested them.

One section of each scan report is produced by asking an AI model (Anthropic's Claude) which businesses it would recommend for the submitted trade and area, so we can tell you whether AI assistants mention your business. Two cautions apply, and they appear in the report as well:

• AI answers vary. The same question asked in a different session, of a different model, or on a different day can produce a different list. A mention (or its absence) is a snapshot, not a fact about any business.
• The output is not our statement about any business. Business names surfaced by the model are reproduced as what the model said, not as our assessment, endorsement, or criticism of anyone.

We use the information described above only to:

• Respond to your inquiry and discuss the work you asked about;
• Build and deliver your scan report;
• Operate our own lead handling: new submissions appear in our private lead dashboard, trigger a push notification to the operator, and are summarized in a daily internal digest email, so nothing you send us gets missed;
• Prevent spam and abuse (honeypots and rate limiting);
• Keep ordinary business records of who contacted us and what reports we produced;
• Understand local markets using the business-level (non-consumer) scan data described above;
• Comply with law and respond to lawful requests where required.

We do not use your information for advertising, do not build advertising or behavioral profiles, and do not combine your information with data purchased from anyone.

We do not sell your personal information, and we do not share it with anyone for their marketing. A small number of companies process data on our behalf so the Site can function:

• Cloudflare hosts the Site and runs our server functions, our lead database (D1), and the short-lived storage that holds scan reports and rate-limit counters (KV). Like any host, Cloudflare processes standard technical request data (IP address, browser type, pages requested) for every visitor at the platform level, to deliver the Site and protect it from abuse, and may set a strictly necessary security cookie at the network layer. We run no analytics on top of any of it.
• Amazon Web Services (SES) and Resend deliver the Site's email. Every email the Site sends (your scan report, inquiry notifications, internal digests) is delivered through one of these providers, so the addresses and message contents involved pass through, and are logged by, the provider that carried the message. Our messages are sent from leads@fieldbuilt.dev, so that is the "from" address you will see; replies reach the operator directly, and if a reply ever goes unanswered you can email legal@fieldbuilt.dev instead.
• ntfy.sh (a push notification service) carries the operator's new-lead alerts. When you submit a form, a short notification is pushed through ntfy.sh to the operator's devices so you get a fast response. That notification deliberately carries no personal information about you. It says which of our sites you used, what kind of form you submitted, the page you submitted it from, and, for a scan, the trade and service area you typed; to see who you are, the operator opens a separate password-protected dashboard. We built the alert that way on purpose, because these notifications travel under a long, private topic name that works like an unguessable link: anyone who learned the name could subscribe to them, so we made sure there is nothing personal in them to find. ntfy.sh briefly stores messages on its servers to deliver them. If a direct push fails, that same alert is delivered instead as an email addressed to ntfy.sh, through the email provider described above.
• Google (PageSpeed Insights and Places), Ahrefs, and Anthropic are the scan's analysis sources, described in the scan sections above. They receive the website address, trade, or city being analyzed. They never receive your email address or any other contact information, and none of them learns who requested the scan.

Legal and business transfers. We may disclose information if required by law, subpoena, or court order; to protect our rights, safety, or property or those of others; or, if the business is ever sold or transferred, to a successor who agrees to honor this Policy.

No other sharing. That is the complete list. We do not give or sell email lists or lead lists to anyone.

No. As defined by state privacy laws such as the Colorado Privacy Act and the California Consumer Privacy Act: we do not sell personal data, we do not share it for cross-context behavioral advertising, we run no advertising on the Site, and no cookie- or tracker-based data leaves the Site because there are no such cookies or trackers.

Global Privacy Control. The Site does not currently detect the GPC browser signal, and we say that plainly rather than claim a capability we do not have. Today there is nothing a GPC signal would switch off: no tracking cookies exist and no personal data is sold or shared. If our practices ever change in a way GPC governs, we will implement detection and update this section first.

The Site sends transactional email: your scan report, and correspondence about your inquiry. Each is a direct response to something you asked for. The scan report email ends with a short note about Fieldbuilt's services; it is still a one-time message sent because you requested the report, and there is no list and no follow-up sequence behind it. There is no newsletter and no drip sequence behind either form; if you make no further requests, you get no automated further email.

If you received a scan report you did not request, someone entered your address in the scan form. Email legal@fieldbuilt.dev and we will add your address to our do-not-contact list and block it from receiving any future scan email.

If we ever introduce marketing email, it will be opt-in, every message will include a working unsubscribe mechanism and our postal address (PO Box 203, Larkspur, CO 80118), as CAN-SPAM requires, and this Policy will be updated first.

If you want no further contact from us of any kind, email legal@fieldbuilt.dev and we will add you to our internal do-not-contact list and stop.

Your scan report is stored under a long, randomly generated link (the kind that cannot realistically be guessed) for 90 days, after which the link expires automatically. Three facts about that page:

• Anyone you give the link to can view it. That is its purpose: so you can forward your report to a partner or colleague. Treat the link accordingly.
• It never contains your email address. The stored public copy of the report has the requester's email address stripped from it.
• It is marked not to be indexed by search engines (noindex headers and meta tags), so it should not appear in search results.

The 90-day expiry applies to the shareable link. Our internal record of the scan (what was scanned, the grades, and the email that requested it) remains in our private database as described under "Data Retention," and you can ask us to delete it at any time.

Fieldbuilt operates an internal research tool ("Fieldbuilt Keyword Tool") that connects to the Google Ads API using the account owner's own Google account. The tool retrieves keyword ideas and aggregate search-volume metrics for our own Google Ads accounts, stores them in a private local research database, and uses them solely for our own content and campaign planning. It does not access other people's Google data, and no Google user data is transferred, sold, or used for advertising purposes. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Access can be revoked at any time at myaccount.google.com/permissions.

This section is short because there is very little to disclose:

• Public pages set no cookies. No analytics cookies, no advertising cookies, no functional cookies. One first-party cookie exists anywhere on the Site: an authentication cookie on our private, password-protected lead dashboard, which only the operator uses.
• Our host may set a security cookie. Cloudflare may set a short-lived, strictly necessary cookie at the network layer to protect the Site from bots and abuse. We receive no analytics from it.
• No third-party anything. The Site loads no third-party scripts, fonts, images, frames, or pixels. System fonts only; every asset is served from fieldbuilt.dev.
• Browser storage: your light/dark theme choice is saved in localStorage under a single key and never leaves your device. If the operator opens the scan page through a special admin link, the admin key is held in sessionStorage for that tab only; this affects no ordinary visitor.

If we ever add analytics or any tracking technology, we will update this Policy first to describe exactly what was added.

Whether or not any particular state statute applies to us or to you, we voluntarily honor the following rights, by policy, for every user in every state:

• Access: ask what personal information we hold about you and receive a copy;
• Correction: ask us to correct inaccurate information;
• Deletion: ask us to delete the personal information we hold about you. For form submissions and scan records, this means deleting your rows from our lead and scan databases and the individual notification emails about your submission. Your details may also appear as one line in a past internal daily summary email; we do not re-use or republish those, but we do not promise to edit them;
• Do-not-contact: ask us to stop contacting you, permanently.

How to exercise these rights: email legal@fieldbuilt.dev. Requests are free. We verify requests by requiring them to come from (or be confirmable from) the email address in our records, and we send any copy of your data only to that address, never to a new address supplied in the request. We aim to respond within 45 days. If we decline a request (for example, because we cannot verify it), we will tell you why.

What deletion reaches. Deletion reaches the records we control: our databases and our inbox. It does not automatically purge copies held by our service providers under their own systems and retention schedules (email delivery logs at SES or Resend, platform logs at Cloudflare). Where a provider offers a deletion control we can invoke on your behalf, we will use it and tell you we did. If you ask us to delete everything and also never contact you again, we keep the minimum record needed to honor the do-not-contact request itself.

We will never discriminate against you for exercising any privacy right.

Our records are a lead database, a scan database, short-lived report and rate-limit storage, and the operator's email inbox. The schedule:

• Inquiry and scan lead records (database and inbox): retained while useful for responding to you and as ordinary business records, and deleted on request, at any time.
• Scan report records (what was scanned, grades, requesting email): same treatment as lead records; deleted on request.
• Competitor benchmark data (public business-level data, no consumer contact information): retained for market research as described above; removal honored on reasonable request from the business concerned.
• Shareable report links: expire automatically after 90 days.
• Rate-limit counters (including the IP-keyed ones): expire automatically within 2 days.
• Provider logs: SES, Resend, and Cloudflare retain delivery and platform logs under their own retention practices.

We take measures proportionate to the modest amount of personal data we handle:

• All connections to the Site are encrypted in transit (HTTPS/TLS);
• The Site takes no payments and never handles payment card data;
• The lead dashboard is password-protected and accessible only to the operator; lead and scan databases are private and not exposed to the public internet except through that dashboard and the functions described here;
• Scan report links use long random identifiers that cannot realistically be guessed and expire in 90 days;
• Forms carry anti-bot honeypots, field length caps, and rate limiting.

No method of transmission or storage is completely secure, and we cannot and do not guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify affected users and authorities as required by applicable law, including Colorado's breach notification statute.

The Site is a business services site directed to adults. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has submitted personal information through the Site, email legal@fieldbuilt.dev and we will delete it promptly.

The Site and our services are directed to and intended for businesses and individuals in the United States. We do not target or market to individuals in the European Economic Area, the United Kingdom, or other non-US jurisdictions. If you access the Site from outside the United States, you do so on your own initiative, and you understand that any information you submit will be processed in the United States under US law and this Policy.

We may update this Policy from time to time, for example when we add a feature or service provider. When we do, we will post the revised Policy at this address with an updated effective date. For material changes affecting information already collected, we will provide more prominent notice, such as a notice on the Site or an email where we have an address on file. Our promise of accuracy runs both ways: we will not add a tracking technology, data recipient, or new use of your information without updating this Policy first.

For privacy questions, rights requests, or anything else in this Policy:

Fieldbuilt, a Colorado sole proprietorship operated by Matt Spencer
Email: legal@fieldbuilt.dev
Mail: PO Box 203, Larkspur, CO 80118

Please also see our Terms of Service, which govern use of the Site under the same operator identity, contact addresses, and Colorado law.

This Policy was written to describe our actual, verified practices as of its effective date. It is a statement of our privacy practices, not legal advice to you.