ScratchProof policies

Privacy Policy

Last updated: August 24, 2026

ScratchProof helps renters organize pickup-time evidence. This policy explains what information the service handles and the choices available to you.

What this policy covers

This policy applies to ScratchProof's website, proof-record flow, account features, Watchlist, Dispute Kit, and contact form. It does not change the privacy practices of services you visit outside ScratchProof, including a rental agency or card issuer.

Information we collect and why

Proof-record information

When you create a record, we collect your email address, uploaded evidence photos, written damage notes, pickup location, rental agency, rental dates, vehicle details, odometer reading if you provide it, pickup timestamp, and browser-provided or manually entered location details. We use this information to create, display, secure, and deliver your private proof record, and to generate a Dispute Kit when you request one.

Account information

If you create an account, we process the account email address, password-authentication information handled through the account system, and any name you add to your profile. We use it to authenticate you, associate eligible proof records with your account, and provide account features.

Contact information

When you use the Contact form, we collect your name, email address, topic, and message so we can respond and manage support requests.

Usage and device information

ScratchProof includes PostHog analytics code that runs only when its site configuration is enabled. In that case, PostHog may process browser or device information, a distinct and session identifier, page and interaction events, and campaign parameters stored in cookies, local storage, or session storage. PostHog may also receive network information such as an IP address as part of its service. We use this information to understand site use and improve the product.

Guest proof submissions

You can create a proof record without an account. For a guest submission, your email address is stored with the private record and is used to send or re-send its private access link. The private link is intended for you; keep it confidential. If you later create or sign in to an account with the same email address, ScratchProof can associate eligible guest records with that account.

Public-record opt-in and Watchlist

Adding a rental to the public record is off by default and requires an account-holder opt-in. Public proof pages show only the pickup location, rental agency, and pickup timestamp. Private evidence, uploaded photos, vehicle and rental details, odometer readings, notes, exact coordinates, email addresses, and other personal identifiers never appear on public pages. The Watchlist uses opt-in renter-submitted records in aggregated agency/location reporting; it is not a finding that an agency was at fault.

We use the following services in operating ScratchProof:

Convex provides the application database, authentication infrastructure, and file storage used for proof records, evidence, and generated Dispute Kits.
Vercel hosts and delivers the ScratchProof website.
MadeThis provides the checkout flow and the signed delivery proxy used for support, password-reset, private-record, and reminder email paths. Contact inquiries are routed through that delivery path to the ScratchProof business inbox.
PostHog processes the analytics described above when analytics is enabled for the site.

Google Places is not currently integrated into ScratchProof and does not receive data from the service today. If we add it as an optional location-search service in the future, we will update this policy before or when that integration goes live.

Retention and deletion

ScratchProof does not currently publish a fixed automatic deletion schedule for proof records, evidence photos, account data, or generated Dispute Kits. We keep information while it is needed to provide the service, maintain your records, meet legal or operational requirements, resolve disputes, and enforce our terms. We may retain limited information where needed after a deletion request, for example to meet an applicable legal obligation or prevent abuse.

There is no self-service erasure control today. To request deletion of a proof record, evidence, account information, or other personal data, use the Contact form. We will review the request, verify it as appropriate, and respond in line with applicable law.

Your privacy choices and rights

Depending on where you live, including the European Economic Area and the United Kingdom, you may have rights to ask for access to personal data, correction of inaccurate data, deletion, restriction of processing, or objection to certain processing. You may also have a right to receive a portable copy of information you provided. You can opt out of the public record by turning off the opt-in for an eligible account-owned proof record. These rights are not absolute and may be limited by applicable law.

To make a request or raise a privacy question, use the Contact form. This policy is general information, not legal advice.

Changes to this policy

We may update this policy as ScratchProof changes. We will post the updated version here and revise the “Last updated” date.