Privacy Policy
The short version: we collect what WashTown needs to run your washes, plus your staff's names, emails and PINs because you enter them. If you use damage claims, it also holds the details, photos and camera footage of your customers' claims. We use five outside services to send email, draw part icons and answer questions in the help assistant, fetch weather, take payments and keep an encrypted off-site backup, listed below with what each one gets. We don't sell anything, we run no advertising and no analytics trackers, and we delete everything from the service 90 days after you close your account.
This policy covers washthetown.com and the WashTown application, run by Dresnet Technology LLC (“we”, “us”).
Most of what is in WashTown is information about a business — equipment, parts, schedules. Some of it is about people: your staff. For that part, you are the one who decides what goes in and why, and we handle it on your behalf under our Terms of Service.
What we collect
When you sign up
- Your business name, which also becomes your web address
- Your name, email address, username, and a one-way hash of your password (we never store the password itself)
- The time zone your browser reports, so “today” means your today
The staff records you enter
You add your own people. For each, WashTown stores their name, trade, an icon, their home washes, optionally an email address, and a 4-digit PIN for signing in at a wall kiosk. It records when each person last signed in and last used the app.
PINs are stored in a readable form, not scrambled. We are telling you plainly because it affects how you should use them. There are two reasons. First, WashTown checks that no two people at your company share a PIN, and that check is only possible if the stored values can be compared directly. Second, a 4-digit PIN is one of only ten thousand possibilities, so scrambling it would not meaningfully protect it from anyone who obtained our database — it would mainly make us sound safer than we are.
What actually protects a PIN is that it is not a credential on its own. A PIN only works on a tablet that has already been enrolled as a kiosk using a username and password that you control. Entering a PIN anywhere else is refused outright, so a PIN by itself will not sign anybody in to your account. If a tablet is lost or a member of staff leaves, changing that kiosk password immediately revokes every tablet enrolled with it.
So treat a PIN as what it is: a way of saying which member of staff is standing at a device you have already trusted, not a password. Do not reuse a PIN from anything else, and do not rely on it to protect anything you would not let a person standing at that kiosk see.
What your team records day to day
- Washes, bays, site layouts and the geographic coordinates you give each wash
- Tasks, inspections and their results, including who raised, was assigned and completed each one, and any notes they wrote
- Parts, stock counts, soap levels, vending contents and readings
- Photographs your team takes of parts and of procedure steps
- Car counts — typed in, or read from machine reports your equipment emails to WashTown
Damage claims about your customers
If you use damage claims, WashTown also holds information about your customers: the drivers who report that their car was damaged at your wash. Your staff enter it, and as with your staff records, you decide what goes in and why.
- The customer's name, phone number and email address, and whether they are a member
- When and where it happened: the date and time, the wash and bay, and the equipment involved
- Their vehicle: year, make, model, colour and licence plate, and their receipt or transaction number
- Their account of what happened, your staff's internal notes, a record of each callback, and the estimate, payout or reason for denial
- Photographs of the damage, and security camera footage of the incident. Footage can show other people and other vehicles that happened to be at the wash.
- A history of every change to the claim: who changed what, and when
Only the staff you give claim access to can see claims, their photos or their footage. When a claim is entered, those staff are emailed its written details. The photos and footage are not emailed; they stay behind sign-in. Staff with access can download a claim, with its photos and footage, as a file to keep, and once downloaded that copy is yours to look after.
Because this is information about your customers rather than about you, telling them how you use it is your job, including any notice your security cameras need. WashTown does not contact your customers.
The help assistant
The ❓ button opens Bubbles, an assistant that answers questions about using WashTown. It is optional; nothing is sent unless someone types a question. When they do, WashTown sends Anthropic the question and the conversation so far, the person's first name and role, which wash and screen they were on, and anything the assistant looks up to answer it, such as a part's name and stock or the steps of one of your guides. The assistant can only read; it cannot change anything in your account.
WashTown does not keep a copy of these conversations. A conversation lives only on the device it was typed on, and is cleared when that person signs out.
Technical information
- Your IP address, used to rate-limit sign-ins, password resets and sign-ups against guessing and abuse
- Server logs of requests and errors
- Two cookies, described below
Cookies
WashTown sets only what it needs to work. There are no advertising cookies, no analytics, and no third-party trackers on any page.
| Cookie | What it does | How long |
|---|---|---|
| Session | Keeps you signed in. Cryptographically signed, so it cannot be edited to become someone else. | 30 days, or until you sign out |
| Device enrolment | Marks a tablet as a kiosk for one wash, so staff can use a PIN instead of a password. | Until the device is un-enrolled |
Why we use it
- To run the service you have asked for: showing your data, scheduling work, sending the alerts you configure
- To keep accounts secure — signing in, rate limiting, confirming email addresses, resetting passwords
- To take payment for additional locations
- To answer you when you contact support
- To keep backups so an accident does not lose your work
We do not use your information to train AI models, we do not sell or rent it, and we do not profile anyone.
Who else receives it
These are the only outside services that receive any of your information, and each gets only what its job needs.
| Service | What it receives | Why |
|---|---|---|
| Postmark (ActiveCampaign, LLC) | Recipient email addresses and the content of the emails WashTown sends you; and the machine reports your equipment forwards in, including whatever those emails contain | Sending alerts, digests, confirmation and password-reset emails; receiving car-count reports |
| Anthropic, PBC | The photographs your team takes of parts, with no names, emails or other account data. And when someone asks the help assistant a question: that question and the conversation, their first name and role, the wash and screen they were on, and the parts or guides the assistant looks up to answer. Damage claim photos and footage are never sent. | Drawing the small icon that represents a part, and answering questions in the help assistant. Under Anthropic's terms for business use, none of it is used to train their models |
| Open-Meteo | The latitude and longitude of your washes — nothing else, and nothing identifying | Weather forecasts, which drive weather-based scheduling and car-count predictions |
| Stripe, Inc. | Your billing name, email and payment details, entered on Stripe's own pages | Taking payment for additional locations. We never see or store your card number. |
| Backblaze, Inc. | A copy of our nightly backup: the database, and damage claim photos and footage. It is encrypted on our server before it is uploaded, with a key Backblaze does not have, so they cannot read it | Recovering WashTown if our server is ever lost |
| Our hosting provider, Hetzner Online GmbH | Everything, as the operator of the server WashTown runs on | Running the service. Servers are located in Ashburn, Virginia, USA |
We may also disclose information if the law requires it, or to protect someone's safety or our legal rights. If a law-enforcement request arrives for a customer's data, we will tell that customer unless we are forbidden to.
If our business is ever sold or merged, your information may transfer with it. You would be told beforehand.
How long we keep it
- While your account is open: operational history is kept indefinitely, because a maintenance record is only useful over years. Nothing is quietly pruned.
- Damage claims: the written claim and its history are kept while your account is open, like the rest of your records. Photographs and camera footage are deleted from the service two years after the claim is closed, and your staff are warned 30 days and 7 days beforehand so they can download a copy. Your staff can stop that deletion for a claim that is in dispute, and reopening a claim stops it too.
- After you close your account: 90 days, then permanent deletion from the service. We remind you before it happens.
- Backups: a nightly backup is kept on our server for 30 days. A second, encrypted copy is kept off-site with Backblaze. Nothing is deleted from that off-site copy yet. It keeps everything it has backed up, including information later deleted from WashTown, such as claim photos and footage after their two years. We plan to clear old copies automatically, and will update this policy when that starts. Backups are used only to recover from losing the server, and nobody browses them. The off-site copy cannot be deleted from our server, so someone who broke in could not erase it.
- Reset and confirmation links: deleted 30 days after they expire.
How it is protected
- Everything travels over HTTPS.
- Passwords are stored as salted scrypt hashes — they cannot be read back, including by us.
- Each company's data is isolated at the database level, so one customer's account cannot read another's.
- Changing a password signs out every other session it had.
- Damage claim photos and footage are only ever served to signed-in staff with claim access. They have no public links.
- Access to the server is restricted to the people who operate it.
No system is perfectly secure, and we don't claim otherwise. If a breach affects your information we will tell you and any regulator we must, without undue delay.
Your choices and rights
Depending on where you live you may have rights to see, correct, export or delete personal information, and to object to some processing. In practice:
- See and correct: most of it is on screen in the app, and an administrator can edit it directly.
- Export: email us and we will send a machine-readable copy within 30 days, free.
- Delete: an administrator can remove a person; closing the account deletes everything after 90 days. A damage claim cannot be deleted from inside the app, so that the record of a claim cannot be quietly erased. If the person a claim is about asks for it to be deleted, contact us and we will remove it.
- Emails: every kind of notification can be switched off per person in the Admin portal, and anyone with an email address can switch their own off in Settings. Security emails (confirming an address, resetting a password) cannot be switched off, because they are how an account stays reachable.
If you are one of our customer's staff rather than the account holder, ask your employer first: it is their account, and they control what is in it. You are welcome to contact us and we will help.
To exercise any of this, email derek@dresnettech.com. We answer during business days, 10am to 6pm Eastern. We honour access, export and deletion requests from anyone whose information is in WashTown, wherever they live, and we do not charge for them.
Where WashTown is offered
WashTown is offered only to businesses located in the United States. We do not market, price or support it for customers elsewhere. Where the servers themselves are is in the table above; if either of those changes, this policy changes with it.
Children
WashTown is a tool for businesses and is not directed at children. Don't create accounts for anyone under 16.
Changes to this policy
If we change it in a way that matters, we will email the address on your account and update the date at the top.
Contact
Dresnet Technology LLC · derek@dresnettech.com · 2205 Plymouth Ridge Road, Ashtabula, OH 44004