Privacy policy

This policy covers ScopePad, the free estimating and invoicing web app provided by onething.tools in Germany. Contact us at [email protected].

Your work stays on your device

ScopePad stores your business profile, clients, jobs, estimates, invoices, payment records, prices, templates, settings and photos in your browser on your device. PDFs and exported backup files are generated there too. You do not need a ScopePad account. We do not receive or store this business content on a ScopePad server.

Optional cloud backup and sync

Cloud sync is off until you connect your own Google Drive or Microsoft OneDrive account and approve access. ScopePad then sends your business content directly between your browser and that provider to back it up, restore it and merge changes across your devices. The copy includes your client details and photos, so connect only an account you are authorized to use for that information. The copy uses your own cloud storage allowance.

Google Drive access

ScopePad requests only https://www.googleapis.com/auth/drive.appdata. This lets it read, create, update and delete its own files in Google Drive's hidden application-data folder. It does not grant access to your other Drive documents. ScopePad also reads the account name, email address and storage quota returned by Drive to identify the connected account and show available storage.

ScopePad uses Google user data only to provide backup, restore, sync, account identification and storage information. It does not sell this data, use it for advertising, use it to train AI models, or send it to our own servers or to other recipients. ScopePad's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Microsoft OneDrive access

ScopePad requests Files.ReadWrite.AppFolder to manage files in its own OneDrive app folder, User.Read to identify the connected account, and offline_access to renew access without asking you to sign in each time. It does not request access to your other OneDrive files. It also requests storage-quota information when the provider permits it.

Sign-in and security

You sign in on Google's or Microsoft's pages. ScopePad does not receive your password. It stores access tokens, Microsoft refresh tokens when issued, and connected-account information in this browser's local storage. These are used to make authorized requests directly to your selected provider over HTTPS. ScopePad does not add its own end-to-end encryption to the cloud copy; your provider's storage protections and account settings apply. Protect your device and provider account.

Retention, disconnecting and deleting

Local work remains until you delete it or your browser clears its storage. The cloud copy remains in your provider account until you delete it. Disconnecting stops sync and clears ScopePad's stored sign-in information; it keeps your local work and the cloud copy. Use Delete cloud copy in Backup and sync to remove ScopePad's remote files. Deleting all local data disconnects sync first and does not delete the remote copy. Exported files and PDFs remain wherever you saved or shared them.

You can revoke Google access in Google Account connections and manage hidden app data in Google Drive's settings. For personal Microsoft accounts, use Microsoft app permissions; work and school accounts may require your administrator. Revoking permission stops future access but does not by itself delete a stored backup.

Third parties and website visits

Google and Microsoft process sign-in and storage requests under their own policies: Google Privacy Policy and Microsoft Privacy Statement. ScopePad itself has no analytics or advertising. Visiting the onething.tools marketing website is covered separately by our website privacy policy. Hosting providers process ordinary web requests to deliver the app and its files.

Your choices and contact

You can use ScopePad locally without cloud sync, export your work, correct records in the app, disconnect a provider, or delete local and cloud copies separately. We cannot retrieve or delete business content held only on your device or in your personal cloud account. For privacy questions or requests concerning information you send us for support, email [email protected]. Do not send access tokens or passwords.

We will update this page when ScopePad's data practices change.