Privacy policy

About this policy

TagReport+ is an online system for recording electrical test-and-tag sessions and producing test reports, available at tagreportplus.com. It is created and operated by Lachlan Jacob (“we”, “us”). You can contact us at tagreportplus@gmail.com. This policy explains what personal information TagReport+ collects, why, where it is stored, who it is shared with and the choices you have.

TagReport+ is a small operation and may not be legally required to follow the Privacy Act 1988 (Cth). We choose to follow the Australian Privacy Principles (APPs) anyway, and this policy describes how we do that. By creating an account or using TagReport+ you acknowledge this policy.

Information we collect

We only collect information needed to run the system:

• Account details — your name, email address, role (tester or administrator), electrical licence number (testers), and your password, which is stored only as a one-way bcrypt hash.
• Two-factor authentication — the secret that links your authenticator app to your account (encrypted with AES-256-GCM) and your backup codes (stored only as one-way hashes; we cannot read them back).
• Test records — session titles and dates, tested item names, tag numbers, locations, pass/fail results, failure reasons and next test dates, plus your test instrument's name, serial number and calibration due date.
• Sign-off details — when a session is finished: the signer's name, licence number, phone number and a drawn signature image, which appear on the PDF test report.
• Noticeboard — posts and comments you write, with your name and the time posted.
• Account requests and password resets — when you sign up, your name, email, hashed password, chosen role and licence number are held as a request until an administrator approves or denies it. Denied requests are kept as a record of the decision. We also record the time a password reset was requested.
• Login declarations — each time you log in, whether you agreed to or denied the declaration, which statements you ticked and when. Administrators can view this record.
• Imported spreadsheets — Excel files an administrator uploads are read to create test records. The file itself is not kept after import.
• Technical information — your IP address and browser details are processed by our hosting providers and by Google reCAPTCHA when you log in. Render keeps request logs for a limited time.
• Attempt counters — to slow down password guessing, we store a count of recent attempts linked to the email address used (for log-in and password resets), your account (for two-factor codes) or your IP address (for sign-ups). Each counter expires after 15 to 60 minutes and expired counters are cleared out periodically.

How we use it

• To sign you in securely and keep your account protected (passwords, two-factor codes, reCAPTCHA).
• To record test-and-tag sessions and generate PDF reports as evidence of compliance testing.
• To show reminders in TagReport+ about upcoming retests and test instrument calibration.
• To send account emails, such as password reset links.
• To let administrators manage users, review sessions and approve access requests.

Who can see your information

• Testers can see their own sessions and items.
• Administrators can see all users, sessions, items and reports in the system.
• Administrators can see account requests and decide whether to approve them.
• All signed-in users can see noticeboard posts and comments, with the author's name.
• All signed-in users can see the names and licence numbers of testers and administrators, so they can be chosen as the signer when a session is finished.
• PDF reports include tester and signer details and may be shared by you or your organisation with clients, auditors or regulators.

We do not sell personal information and we do not use it for advertising or marketing.

Third-party services we use

TagReport+ relies on these providers, which process data on our behalf:

• Render (Render Services, Inc.) — hosts and runs the TagReport+ application. Your requests pass through Render's servers and its content delivery network (Cloudflare) to reach the application.
• Neon — hosts the PostgreSQL database where all of the information above is stored.
• Porkbun (Porkbun LLC) — registers the tagreportplus.com domain name and runs its DNS, which tells your browser where to find TagReport+. Porkbun does not receive any information you enter into TagReport+.
• Google reCAPTCHA (Google LLC) — checks that log-ins come from a person, not a bot. Google collects hardware and software information and may set its own cookies; its use is governed by the Google Privacy Policy and Terms of Service.
• Gmail API (Google LLC) — sends system emails such as password reset links. Google processes your email address and the message content to deliver it.
• Authenticator apps — you choose your own app (for example Google Authenticator or Authy). The QR code is generated on our server; TagReport+ shares no information with the app's provider.

Fonts are served from our own server, and there are no analytics, tracking or advertising tools in TagReport+.

Overseas storage

Render runs the application in the United States, and Neon and Google may store and process data in the United States and other countries where they operate. Your information will therefore be held or processed outside Australia. We chose these providers because they publish strong security and privacy commitments, but we do not control how they run their systems.

Cookies

TagReport+ uses only essential cookies to keep you signed in. They are marked HttpOnly (not readable by scripts), sent only over HTTPS and are not used for tracking:

• pending_session, declaration_pending, totp_update_pending — hold your place during log-in or 2FA changes; expire after 10 minutes.
• session — keeps you signed in; expires after 7 days or when you log out.

Google reCAPTCHA may set its own cookies on the log-in page.

How we protect it

• All traffic is encrypted with HTTPS.
• Passwords are hashed with bcrypt; two-factor secrets are encrypted; backup codes are hashed.
• Two-factor authentication is required for every account, and each login requires accepting a declaration.
• New accounts cannot be used until an administrator approves them.
• Repeated login, sign-up and code attempts are limited to slow down guessing, and log-in is protected by reCAPTCHA.
• Access to records is restricted by role.

No system is completely secure, and we cannot guarantee that information will never be accessed without permission. If a data breach is likely to cause serious harm to anyone, we will tell the people affected as soon as we reasonably can, and the Office of the Australian Information Commissioner where required.

How long we keep it

Account information is kept while your account is active. Test records, reports and signatures are kept as evidence that testing was done, because businesses often need to show test history to clients, auditors or regulators. TagReport+ does not currently delete test records automatically.

When a user account is deleted, their noticeboard posts and comments are deleted with it. Their login declaration history is kept, with their name and email, as a record of what was agreed. An account that has recorded test sessions cannot be deleted, because those sessions are records of testing that must stay linked to the person who did them.

Access, correction and complaints

You can view and update your email address and test instrument details on your account page, and change your two-factor settings at any time. To request a copy of your personal information, a correction or deletion, or to make a privacy complaint, email Lachlan Jacob at tagreportplus@gmail.com or contact your organisation's TagReport+ administrator. We aim to respond within 30 days. We will delete information when asked unless we need to keep it as a record of testing, and if so we will tell you why.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

We may update this policy as TagReport+ changes. The latest version is always on this page, with the date it was last updated.