Privacy Policy

This Privacy Policy explains what information NoKnock LLC (“NoKnock,” “we,” “us,” or “our”) collects through noknock.co and the NoKnock mobile app (together, the “Service”), how we use and share it, and the choices and rights you have. The Service is intended for use within the United States. This Policy should be read together with our Terms of Service.

1. Information we collect

Account information. If you sign up as a homeowner, we collect your email address and, if you use email/password sign-in, a password (stored securely by our authentication provider using industry-standard hashing, never in plain text). If you sign in with Google, we receive the basic profile information Google shares for authentication.

Address and registration data. When you register an address, we collect the address itself, the recipient name used for decal shipping, and the solicitation preferences you set (blocked categories and your acceptable contact hours).

Violation reports and photos.If you submit a violation report, we collect the category, description, and any photo you choose to upload. A photo you submit may incidentally include the image of a canvasser or other third party present at your property — see Section 9 below for how we handle that. Photos are stored in a private file store and are only viewable by our internal admin team via short-lived, server-generated links, never a public URL. We also use an AI service to help identify whether your description mentions a canvassing company by name, to suggest — never automatically apply — a possible match to that company's account in our system; a human team member always reviews and manually confirms any such match before it's recorded.

Organization and canvasser data.Organization accounts include a contact email and organization details we set up manually. Canvasser accounts use anonymous authentication tied to a device — we don't collect a canvasser's email or phone number, but we do collect the first and last name they enter when joining an organization. We log scan events (which address was checked, by which canvasser and organization when applicable, and the result shown), together with the IP address and browser/device user-agent string of the device that performed the scan, to support the compliance-check feature, detect abuse, and show an organization aggregated activity summaries for its own canvassers (for example, total scans and a breakdown of outcomes). This includes scans performed through the noknock.co public scan page, which doesn't require signing in — those scans have no canvasser or organization to attach, but the address checked, IP address, user-agent, timestamp, and result are still recorded in the same way.

Payment and shipping information.If you order a physical decal, payment is handled directly by Stripe — we don't receive or store your full card number. We share the shipping name and address on file with our print fulfillment vendor, Printful, solely to produce and ship your decal.

Usage data.Like most websites, we automatically collect standard technical data (such as IP address, approximate location derived from IP, browser type, and pages visited) through our hosting provider's server logs, for security and reliability purposes. We don't currently use third-party analytics or advertising trackers; if that changes, we'll update this Policy first.

What we don't collect.We don't collect precise GPS or device location from the mobile app, and we don't collect biometric information or run facial recognition on any photo submitted to the Service.

2. How we use information

• To create and maintain your account and registered addresses;
• To generate your QR code and, if ordered, produce and ship a physical decal;
• To show canvassing organizations and canvassers whether an address is registered and what its preferences are, so they can decide whether to approach it;
• To show an organization aggregated scan activity and compliance-outcome summaries for its own canvassers (for example, total scans and clear-rate), to support their team management;
• To process payments for optional paid features;
• To review violation reports and, where legally required, report illegal content to the appropriate authority;
• To use AI-assisted analysis of violation report descriptions to suggest a possible canvassing-company match for our team to review and confirm — this suggestion is never applied automatically;
• To detect and prevent duplicate registrations, fraud, and abuse of the Service;
• To notify our internal team (via a private Slack channel) when a new address is registered, so we can monitor signups — this notification does not go to any canvassing organization;
• To communicate with you about your account and the Service — for example confirming your account, prompting you to finish registering an address, and sending you reports about activity on your own registered addresses. These are service-related messages that come with having an account;
• To send you promotional updates such as new features, tips, and occasional offers. This is separate from the account and activity messages above. New accounts are subscribed to these updates by default — the signup page says so, and the email signup form includes a checkbox you can untick. Accounts created before July 25, 2026 are only subscribed if they opted in. Every such email includes a one-click unsubscribe, and you can turn these on or off anytime from your account settings; and
• To comply with legal obligations and enforce our Terms of Service.

We don't sell your personal information, and we don't use it for advertising. We don't use automated decision-making or profiling that produces a legal or similarly significant effect on you — the AI-assisted suggestions described in Sections 1 and 2 are always reviewed and confirmed by a person before any attribution is recorded, and are not automated decisions within the meaning of this policy.

3. What canvassing organizations see

When a canvasser or organization checks an address, the Service returns only a compliance result — for example, whether the address is registered, whether it's blocked for their industry, or whether it's outside acceptable contact hours. It does not return your name, email, phone number, or any other identifying information. This lookup runs through a restricted server-side function specifically so that only the minimum necessary information is ever exposed.

4. Who we share information with

We share information with service providers (“processors”) who help us run the Service, including:

• Supabase — database hosting and authentication;
• Vercel — website hosting;
• Stripe — payment processing for decal orders;
• Printful — printing and shipping physical decals;
• Google — optional Google sign-in and address autocomplete;
• Anthropic — the AI service used for the features described in Sections 1 and 2 (violation-description analysis) and for drafting our own marketing content and answering support questions — never given your account, address, or contact information;
• Slack — internal notifications to our own team, not shared externally.

These providers only receive the information needed to perform their function for us and aren't authorized to use it for their own purposes. We may also disclose information: if required by law, subpoena, or court order; where we believe in good faith disclosure is necessary to prevent harm, fraud, or abuse of the Service, or to protect the rights, safety, or property of NoKnock, our users, or others; to law enforcement regarding apparent illegal content as described in Section 9; or in connection with a merger, acquisition, financing, or sale of some or all of our assets, in which case we'll require the successor to honor the commitments in this Policy. We are not a data broker and do not otherwise sell, rent, or trade your personal information to third parties.

5. Data security

We use database-level access controls to restrict which data can be read by whom, and violation report photos are only accessible through short-lived, server-generated links rather than public URLs. Our internal admin tools are restricted to a small list of authorized team email addresses. If we experience a security breach that compromises your personal information in a way that requires notification under applicable law, we'll notify affected users and any required regulator as and when the law requires. No system is perfectly secure, and we can't guarantee absolute security of information you submit.

6. Your choices and rights

You can update your address preferences or deactivate a registered address at any time from your dashboard. You can opt in or out of promotional email anytime from your account settings, or by clicking unsubscribe in any promotional message — this doesn't affect account and activity messages, which are part of having an account. To request a copy of your data, correct it, or delete your account entirely, email us at hello@noknock.co from the email address on your account (so we can verify it's you), and we'll respond within 45 days. If you live in Colorado, California, or another state with a comprehensive privacy law, Section 7 below describes additional rights that apply to you specifically.

7. State privacy law rights (Colorado, California, and others)

Colorado.As a Colorado company, we extend the core rights of the Colorado Privacy Act to all Colorado residents: the right to confirm whether we process your personal data, access it, correct inaccuracies, delete it, obtain a portable copy, and opt out of the sale of personal data, targeted advertising, or profiling that produces legal or similarly significant effects (as noted above, we don't sell data or use targeted advertising or this kind of profiling today). If we deny a request, you may appeal by replying to our decision email within a reasonable time; if the appeal is denied, we'll provide a way to submit a complaint to the Colorado Attorney General.

California.If you're a California resident, the California Consumer Privacy Act (as amended) gives you the right to know what personal information we've collected about you, request deletion, request correction, and opt out of the “sale” or “sharing” of personal information — we do not sell or share personal information as those terms are defined by the CCPA, and we don't use or disclose sensitive personal information for purposes requiring an opt-out right. You won't receive discriminatory treatment for exercising any of these rights. You may designate an authorized agent to make a request on your behalf; we may require verification of the agent's authority.

Other states.If you live in another state with a comprehensive privacy law (for example, Virginia, Connecticut, Utah, or others as they take effect), we'll honor the equivalent access, correction, deletion, portability, and opt-out rights those laws provide, on request to hello@noknock.co.

8. Data retention

We keep account and address data for as long as your account is active. We keep violation reports and scan logs for as long as reasonably needed for the purposes described in Section 2, and generally no more than three years, unless a longer period is needed to resolve a dispute, investigate a report, or comply with law. If you delete your account, we'll remove or de-identify your personal information within a reasonable time, except where we're required to keep it (for example, payment records needed for tax or accounting purposes, or content preserved in connection with a legal obligation such as Section 9 below).

9. Illegal content and mandatory reporting

We do not tolerate child sexual abuse material or other illegal content submitted through the Service. If we become aware of apparent child sexual abuse material, we are legally required under U.S. federal law to report it to the National Center for Missing & Exploited Children's CyberTipline and preserve the relevant content and associated account information, and we'll cooperate with law enforcement accordingly. If a violation report photo you submit incidentally includes another person's image (for example, a canvasser at your door), we treat and retain that photo the same as the rest of your report; if that individual contacts us directly about their image, we'll evaluate the request on a case-by-case basis consistent with our legal obligations, including any duty to preserve records related to a report.

10. Cookies and Do Not Track

We use cookies set by our authentication provider to keep you signed in — these are essential to the Service and can't be disabled without breaking sign-in. We don't use third-party advertising or tracking cookies. Because there's no common industry standard for responding to browser “Do Not Track” signals, we don't currently respond to them differently.

11. Children's privacy

The Service is intended for people 18 and older and isn't directed to children. We don't knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us at hello@noknock.co and we'll delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the effective date above and, where practical, notify you (for example, by email or an in-app notice) before the change takes effect.

13. Contact

Questions about this Privacy Policy, or want to exercise any of the rights described above? Email us at hello@noknock.co.