Privacy Policy

Last updated: October 29, 2026

Who we are

Fourth Bucket ("we", "us") provides software at fourthbucket.com that helps auto detailing businesses turn vehicle photos into estimates and invoices. This policy explains what we collect, why, and the choices you have. Questions any time: support@fourthbucket.com.

What we collect

Account information — your email, password (stored as a secure hash), business name, and optional profile details like phone number and logo. If you add them, we also keep your business location (street address, city, state or province, and ZIP or postal code) and the payment app details you want customers to pay you with: your Venmo, Cash App and PayPal usernames and the email or phone number your Zelle uses. Your business location is printed on the quotes and invoices you share, and your payment app details on your invoices, so anyone with one of those links can see them. We also use your state or province to suggest starting prices for your service menu.
Job content you upload — vehicle photos and videos, estimates, invoices, service menus, and notes. If you add customer details (like a customer's name or phone number), you're responsible for having their permission.
Payment information — payments for a plan bought on our website, and the card payments your customers make on your invoices, are processed by Stripe. A plan bought in the iPhone or Android app is paid to Apple or Google; from that we receive only the plan, its status and when it renews or ends. We never see or store full card numbers.
Usage events — when you use the app, it records short events tied to your account, such as an estimate being generated, saved, or failing to save, with counts and error codes. We use them to find where quotes go wrong. They never contain a customer's name, phone number or address, a price, a photo, or anything you typed. We also keep a record of each AI estimate your account runs, so usage limits work, and of the account emails we send you, so each goes out once. On our website (never in the app), your browser keeps a note, which we use for up to 90 days, of which site or campaign link first brought you to us (with the page you first landed on and the date), and if you then create an account we keep that note with it, to learn which channels help detailers find us; we never sell it or share it with advertisers, and we use no third-party trackers. Clearing this site's data in your browser deletes the note.
Your country — we work out which country you're in from your IP address (our hosting provider supplies it with each request), or from your Stripe account's country once you've connected one. We use it to decide whether paid plans are offered where you are. If you open the plans screen from a country where they aren't offered yet, the usage event records that country.
On your phone — a sign-in cookie keeps you logged in; in the app, another cookie only remembers that someone has signed in on this phone before, so it opens on Sign in (it holds no account details and is cleared when you delete your account); and the app keeps an unfinished estimate, or a quote that couldn't reach our servers, stored on the phone itself so a dropped signal doesn't lose it. We don't use advertising or tracking cookies.

How photos and notes are used (AI)

When you request an estimate, the photos you upload, any notes you add, and your service menu (service names, descriptions and prices) are sent to our AI provider to generate the condition report and price range, then the results are returned to you. Nothing is sent until you have agreed to it in the app, on a screen that says who the AI provider is. You can withdraw that agreement any time: tap Turn off AI photo analysis under Settings → Your account, and nothing more is sent from then on. Photos are stored privately so your estimates and invoices can display them to you and the customers you share links with. We don't sell your photos or use them for advertising.

Who we share data with

Only the service providers that run Fourth Bucket: our database provider (your account, sign-in, and file storage), our hosting provider (it serves every page and tells us which country a request comes from), Stripe (payments on the website), our AI provider (estimate generation), our email provider (sending account emails, such as the note when your free estimates are used up — it receives your email address and business name), and our subscription provider (keeping track of subscriptions bought in the iPhone and Android apps — it receives your account ID and the purchase record: which plan, when it renews or ends). Each receives only what it needs to do its job. We do not sell personal information, and we don't share it with advertisers. Email us if you'd like the names of these providers.

If you subscribe in the iPhone or Android app, Apple or Google takes the payment, under its own privacy policy. We never see your card or your store account details, only that the subscription is active and when it renews or ends.

Every one of these providers gives your data the same or equal protection as this policy describes. We only use providers whose own terms commit them to protecting it, and before we use a new kind of provider we'll add it to this list.

Estimate and invoice links you share are private, unlisted URLs — anyone you send a link to can view that estimate or invoice, so share them only with the customer they belong to.

Retention & deletion

We keep your data while your account is active so your job history works. Usage events and the records of AI estimates and emails are kept for as long as the account is, and deleted with it. Removing the app from your phone doesn't delete your account. You can delete it yourself, in the app or in a browser at fourthbucket.com: sign in, then go to Settings → Your account. It first stops any plan billed by us through Stripe and deletes your customer record at Stripe (a plan bought in the App Store or Google Play is billed by Apple or Google and has to be cancelled there — deleting your account doesn't stop it), then removes every photo you uploaded and your logo, then your sign-in, profile, service menu, customers, estimates, invoices and usage events. It can't be undone. It does not close your own Stripe account (the one your customers pay into) — that is yours, and you can close it at stripe.com. Stripe keeps its own records of payments that actually happened, as the law requires. Our other providers may keep copies in backups and logs, and our AI provider may keep what was sent to it, for a limited time under their own retention terms, after which they are deleted. If something you shared was reported to us, we may keep a copy of what was reported and our record of the report, for as long as we need them to deal with the report or the law requires, even after your account is deleted. We keep nothing else. Prefer us to do it? Email support@fourthbucket.com from your account email.

Security

Data is encrypted in transit, stored with per-account access controls, and payment card data never touches our servers. No system is perfectly secure, but we design for least access and will notify you if a breach affects your data.

Your choices

See or correct your data in the app, download your estimates, invoices, customers and service menu under Settings → Your account, or ask us by email.
Withdraw consent to AI photo analysis, or delete your account and everything in it, under Settings → Your account.
Cancel a plan bought on our website any time from Billing on the website; deleting your account cancels it too. A plan bought in the App Store or Google Play is cancelled only in that store's subscription settings, and deleting your account doesn't cancel it.
Depending on where you live (e.g., California or the EU), you may have additional rights — email us and we'll honor them.

Children

Fourth Bucket is a business tool for adults and isn't directed at children under 13. We don't knowingly collect their data.

Changes

If we make material changes to this policy, we'll update this page and the date above, and for significant changes we'll notify account holders by email.