What shipped, when, and where to check

Yesterday we published caps that shipped the day before: Field Pro at 2,000 scans a month and Team at 10,000. Both are reversed. Field Pro returns to 500 a month, and Team goes back to unlimited.

The reason is worth stating rather than quietly editing. Team was capped because it was the tier a stranger could claim in one tap — and in the same release, Team was put behind a single-use code we issue by hand, which made that sentence false before either change reached anyone. The bound on Team is the code. The cap was a second lock on a door that was already locked, and it was the lock that cost a customer something.

What replaces it is a written fair-use policy instead of a silent ceiling. Unlimited means we do not meter your work, not that no limit exists: we watch for sustained bursts and scripted volume far beyond a human pace, we will get in touch first where we can, and we may throttle a workspace that is clearly abusing it. If you are scanning, you are fine. That statement now sits under the Team plan on the pricing page, and the asterisk beside “Unlimited scans” resolves to it. The one automatic stop left is a daily backstop set far above anything fieldwork reaches — it exists so a runaway script cannot take the service down for everyone else.

Nobody was cut off by any of this: total usage across the product for the month, when the measurement was taken, was one scan.

What happens when early access ends is now written into the database rather than left as a promise: an expired trial reverts to an ordinary free account — 100 scans a month, data intact — and nothing further happens to it. Not paying never deletes an account. The only thing that ever does is long inactivity, it applies to free accounts only, the clock starts when an account actually becomes free, and a warning email goes out before anything is removed. Leaving or being removed from a Team workspace lands you on the free tier the same way, not at zero.

Plan limits now live in one database table the product reads directly rather than being compiled into the app, so changing one is a single row rather than a release. Claiming changed shape at the same time: Field Pro stays one tap, while a Team claim now takes a single-use founding code from us, which is how we keep founding workspaces countable.

Corrected on 5 August. This entry originally published the caps that shipped with the change — Field Pro 2,000 and Team 10,000 scans a month. Both were reversed the next day once we noticed the reasoning behind them had expired before they shipped. See Team is unlimited again, and fair use is written down for where the numbers actually stand. The part that lasted is the table itself.

Selecting a group and then typing a search term used to quietly widen the search back to the whole workspace. The two filters now compose: the term narrows within the active group, which is what every tester expected it to do all along. Clearing the term returns you to the group, not to everything.

An export used to write out whatever the screen happened to have loaded. Now it fetches its own rows: the full set the scope promises, scoped to your workspace with an explicit column list rather than the whole record. The export sheet also names what you are about to get — which group, which filters, how many rows — before you commit, so the file that lands is the file you expected.

Webhook emission moved into the database itself, so every path that writes a scan fires the event — a phone flushing its offline queue, a bulk import, an API write. Deliveries are queued and retried with backoff until they land, and after the attempt cap the record stays readable instead of vanishing. In the same pass, endpoint signing secrets moved out of the database catalog into Supabase Vault: encrypted at rest and excluded from dumps. At least once means occasionally twice, so build receivers idempotent — the signature-verification guide shows the dedupe headers.

This site. Nine guides that document the exact contracts — offline scanning, export formats, webhook signatures — four playbooks that walk real workflows end to end, a pricing page that says what the free plan does and does not include, and this changelog, where every entry cites the commit-level truth it describes. You can start free in the browser today; iPhone is in public beta on TestFlight.

Webhook wiring is now proven from the live database, not assumed from the code: signed deliveries verified end to end, and backfills made safe so a bulk import does not flood your endpoint with push noise. Alongside it, the REST API gained rate limiting and a batch upsert for scans. The signature-verification walkthrough is in the guides.

The export modal now lets you pick fields in the order you tap them and writes either CSV or tab-delimited TXT with no header row — the format a legacy importer expects. This shipped because a real user needed a Clarion 4 system to accept the file; the general capability is column-order control for anything that predates the cloud. Identical from the phone and the web dashboard.

The Team seat limit is 25 for every tenant, enforced server-side. An earlier founding-tenant branch that capped some workspaces at 10 was deleted at the database level, so the number you see is the number the database enforces.