Privacy

Pylon is a dispatch and timekeeping tool used by traffic control companies to run their own crews. It is not a consumer product, it carries no advertising, and it does not track anybody across the web.

Cookies, and why there is no consent banner

Pylon sets one kind of cookie: the session cookie that keeps you signed in. Nothing is set before you log in — visit the sign-in page and close it again and Pylon has stored nothing on your device.

There is no advertising, analytics, or measurement cookie, because there is no advertising, analytics or measurement. The app carries no third-party scripts or pixels of any kind, and its Content-Security-Policy restricts the browser to this site’s own origin, so the page cannot contact a third party even if something tried to.

A sign-in cookie is strictly necessary — the service cannot work without it — and that class of cookie does not require consent under Canadian or European rules. So Pylon does not show a consent banner. A banner asking permission for a cookie that would be set regardless is not consent; it is decoration, and it teaches people to click through the ones that matter.

What Pylon holds about you

Because your employer uses Pylon to run its crews, it holds:

• Who you are — name and preferred name, employee number, work email and phone, home municipality, hire and seniority dates, and an emergency contact name and number if your employer recorded one.
• What you are qualified for — your classification (TCP, LCT and so on), your tickets and site orientations, their certificate numbers and issue and expiry dates, and whether the office has checked them against the card.
• What you worked — shifts you were offered, accepted or declined and any reason you gave, the sites and jobs, your hours, breaks, notes, and the signature you draw on a daily time sheet.
• What you sent — messages and any photos or documents you attach in the app.

What it is used for

Crewing jobs, telling you where to be, recording hours for payroll and for invoicing the contractor, and keeping the certification records a traffic control company is required to keep. It is not used for anything else, and it is not sold or shared for marketing.

Who else can see it

Your employer’s owners and admins can see the records for their own company. Other crew see only what a shift requires — who else is on the job, and the job’s own chat. Pylon separates companies at the database level, so one company’s records are not visible to another.

Pylon relies on three service providers to run:

• Supabase — the database, sign-in and file storage.
• Vercel — hosting and delivery.
• Resend — sending invitation and notification email.

They process this information to provide those services and for nothing of their own. There is no advertising network, data broker or analytics provider in that list, because there is none in the product.

How long it is kept

Employment and payroll records are kept for as long as your employer is required to keep them, which in British Columbia is generally at least four years for payroll records under the Employment Standards Act. When you leave, your record is marked inactive rather than deleted, because the hours you worked and the tickets you held are part of a record your employer must be able to produce.

Your rights

Under the federal Personal Information Protection and Electronic Documents Act and British Columbia’s Personal Information Protection Act — which, unlike most Canadian privacy law, also covers employee personal information — you may ask what is held about you, ask for a correction, and ask how it is used. Write to privacy@scaletechnics.com and we will route it to your employer, who is the organization responsible for your records.

You can see and correct much of it yourself in the app: your tickets and their dates are on your own Tickets screen.

Security

Access is by password, over HTTPS only. Every record is restricted at the database level to the company it belongs to, and enforced there rather than only in the app. Files you attach are served through short-lived signed links rather than public URLs.

Changes

If this changes, the date at the top changes with it. If a change is significant, the office will be told rather than left to notice.