Privacy policy

1. Who we are

TIC Resources LLC operates FacilityXR Field and its connected web and API services. This policy describes information processed through those services. Contact us at facilityxr@ticresources.com.

FacilityXR is used by organizations to manage buildings and maintenance. Your employer or customer organization controls its workspace, assigns permissions and determines how its operational records are used. TIC Resources provides the service and manages account, support and security information. Your organization may have its own workplace privacy notice.

2. Accounts and registered devices

We process names, email addresses, user identifiers, organization memberships, assigned roles and property permissions to authenticate users, control access and attribute work. Authentication records include password hashes, sessions, email verification and recovery information, and multifactor authentication information where enrolled. Passwords are hashed rather than stored as readable passwords.

Device enrollment uses an app installation identifier, public signing key and key fingerprint, device name, manufacturer, model, Android version, organization assignment, approval status and connection times. These records enforce device allowances, administrator approval and secure access. The device's private signing key remains in Android Keystore. Our enrollment flow does not use IMEI, SIM serial numbers or MAC addresses.

3. Maintenance and support information

We store information you or your organization provide or create: property and equipment records, equipment identifiers and data-plate details, work orders, preventive maintenance schedules and checklists, readings, technician notes, photographs, attachments, labor start/stop times, corrections and work history. These records support assignments, maintenance, reporting, synchronization and accountability.

Support and privacy requests include your contact details, request text and handling history. Organization administration can include company contacts, contracts, plan details and device entitlements. Live Stripe billing, retail purchasing and public reward funding are currently disabled; this version does not collect payment-card details through the Android app.

4. Photographs, scanning and optional voice input

• Camera and photos: camera access supports work photographs, equipment data-plate capture and QR scanning. You can also select images through Android's picker. Photos attached to records are uploaded when synchronized. Original images can retain embedded metadata.
• QR scanning and text recognition: bundled Google ML Kit processes camera/image input on the device. Scanned identifiers and reviewed equipment text may then be saved or sent to FacilityXR for the action you choose, such as looking up equipment or enrolling a device. ML Kit diagnostics are described below.
• Microphone: optional dictation uses Android's speech-recognition service. The app prefers on-device recognition when available, but the device's selected speech provider may process audio remotely under its own privacy settings. FacilityXR saves the reviewed text you submit, not a raw microphone recording.

You control camera, microphone and notification permissions in Android settings. Denying optional permissions prevents the related feature; typed entry remains available. The app does not request broad access to your contacts, messages or phone call history.

5. Offline storage and synchronization

The app stores account-specific maintenance records, queued changes and selected photographs on your device so work can continue offline. Authorized changes synchronize with the server when connectivity and access permit. Synchronization records identify the account, organization and operation to prevent duplicate updates and preserve attribution.

Credentials and local record payloads use Android Keystore-backed encryption. Some database metadata remains outside those encrypted payloads. Photographs are kept in app-private storage; they are not all separately encrypted by the app. Android app backup and device transfer are disabled for this app's data.

Signing out locks local drafts rather than erasing them. Settings provides a local cache-erasure option, with safeguards for pending work. Clearing local data or uninstalling does not delete records already synchronized to the organization.

6. Usage, security and diagnostics

FacilityXR processes request identifiers, requested API paths, response status, timing, session and device events, synchronization results and audit history to operate the service, investigate failures and protect accounts. Network information, including IP addresses, is used for security controls such as request rate limits. Authentication headers and cookies are redacted from application request logs.

Google ML Kit collects SDK diagnostics and usage information, including app and device information, installation identifiers, feature events, errors and performance measurements. Its on-device image and text processing does not mean all SDK telemetry stays on the device. See Google's ML Kit data disclosure and Google's privacy policy. The inspected app does not include an advertising SDK or a separate custom crash-reporting SDK.

7. Location information

FacilityXR Field does not request Android location permission or actively track GPS location. Location information can nevertheless be present in property addresses, notes, equipment context or metadata embedded in photographs you choose to upload. Review images and their metadata before sharing sensitive location information.

8. Service providers and other recipients

• Your organization: administrators and other authorized members can access records allowed by their roles and property assignments, including work and labor history.
• Infrastructure and support: hosting, database, object-storage, backup and email services process information needed to operate FacilityXR. The production application is hosted on a Hostinger VPS and uses Hostinger SMTP for configured email delivery. Authorized TIC Resources personnel may access information for support, security and service administration.
• Device services: Google receives ML Kit telemetry. The speech-recognition provider selected on your device may receive audio when you use dictation. These providers' privacy terms apply to their processing.
• Requests and legal obligations: information may be disclosed at your or your organization's direction, or when necessary to respond to a lawful request, protect rights or investigate abuse.

The inspected application has no advertising data-transfer integration. This does not mean information is never shared: the recipients and purposes above are part of operating the service. Providers may process information outside your country; this policy does not promise storage in a particular country.

9. Protecting information

Production API and file transfers use HTTPS. Access controls scope records to organizations and authorized roles; file downloads require authorization and use time-limited signed URLs. The service uses password hashing, protected session credentials and multifactor authentication for platform administration. Device keys and encrypted local payloads provide additional protections.

These protections do not make every stored field end-to-end encrypted. Authorized server processes and permitted users can read information needed to provide the service. Protect your device and account, and do not send passwords, verification codes or device private keys in support messages.

10. Retention and account deletion

Retention depends on the information's purpose, your organization's instructions and applicable obligations. Account and device records support access and security; maintenance, equipment and labor history support the organization's continuing operations, safety and accountability; support and audit records support request handling, incident investigation and disputes.

You can request account deletion or a data export in the app under Settings → Privacy and account requests, or follow the public account-deletion instructions without signing in. A request creates a review case; it does not immediately erase the account or an organization's records. We verify identity and authority before action and coordinate workplace requests with the responsible organization.

Deletion can be limited where records must be retained for legal obligations, security, fraud prevention, disputes or legitimate organizational recordkeeping. We review whether identifying information can be removed or reduced while preserving required history. Backup copies may remain until their retention cycle ends. There is no single automatic deletion period for all FacilityXR data; contact us for the retention treatment of a particular record or request.

11. Your choices and privacy rights

Depending on your location and applicable law, you may have rights to access, correct, export or delete personal information, restrict or object to processing, withdraw consent where processing relies on it, or complain to a privacy regulator. Contact us to exercise a right or ask how it applies. We may need information sufficient to verify the request, and applicable exceptions may limit what can be provided or removed.

You can manage optional Android permissions, choose whether to use dictation or upload a photograph, and ask your organization to correct work records or permissions. Removing a permission does not automatically delete information already submitted.