Legal
Privacy Policy
Effective 7 October 2026
Checkt is built so that your evidence stays on your phone. This policy explains what stays on the device, what reaches our servers when you choose cloud features, who helps us run the service, and the choices you have.
1. Who we are
Checkt is published by Scinops FZE, Sharjah Publishing City (SPC) Free Zone, Sharjah, United Arab Emirates. We are the controller of the personal data described here. Contact us at checkt@scinops.com for any privacy question or request.
2. The short version
- You can use Checkt without an account. Your rentals, photos and notes are then stored only on your device.
- If you create an account and back up a rental (Pro), that rental and its photos are stored in your private cloud vault so you can restore, sync and share it.
- We do not sell your data, show ads or track you across other apps and websites.
- Usage statistics are off unless you switch them on, and they never contain photos, notes, names or locations.
- You can export or delete your data at any time, in the app or by emailing us.
- We share a rental with other people only when you choose to: a share link, a co-traveller you invite, or a partner company you agree to send the report to.
3. Data on your device
When you document a rental, Checkt stores on your device: the rental details you enter (company or host, vehicle or property, dates, address), your photos, the time each photo was taken, the location of each photo if you allow location access, a SHA-256 fingerprint of each photo file, readings you enter (such as odometer, fuel, engine hours or meters), notes and the damage marks you add, an optional photo of your rental agreement, an optional booking reference, and optional walkaround videos. Videos are recorded without sound. This data does not leave your device unless you back it up, share a report, export it, or use agreement scanning or difference descriptions.
If you tap “Fill in from my calendar”, the app reads the titles, times and places of your calendar events from the last 2 days to the next 90 days, on your device only, so you can pick a booking. Nothing from your calendar is sent to us. Event notes and attendees are never read. Calendar access is asked for only when you use this.
Lining up before and after photos and highlighting differences happens on your device. These are automatic hints, not an assessment of damage.
Location is requested only while you take photos, never in the background. If you decline, the record says “location unavailable”. Photos you import from your library keep the date and location stored in the file, if any.
On Android, your device may include app data in its own backups to your Google account according to your device settings. Those backups are handled by Google, not by us.
4. Data we process on our servers
| What | When | Why and legal basis |
|---|---|---|
| Email address and account identifier | When you sign in with an email code or with Apple | To provide your account, cloud backup and purchases across devices (performance of a contract). |
| Backed-up rentals: details, photos (including an attached agreement photo), timestamps, locations, hashes, readings, notes and marks | Only for rentals you back up with a Rental Pass or Pro Annual | To store, verify, sync and restore your evidence and serve share links you create (performance of a contract). |
| Server-side fingerprints and verification times | When a backed-up photo is uploaded | To show that the file we hold matches the file on your phone (performance of a contract; our legitimate interest in evidence integrity). |
| Share links: a fingerprint of each link token, expiry date and view count | When you create a share link | To let people you choose view a report and to let you revoke it. We store only a hash of the token, never the link itself. |
| Rental agreement photo | When you tap “Scan agreement” | To read the details printed on it and fill in the form for you to check (performance of a contract). The photo is processed and not kept by us after the scan; a count of scans is kept to apply the monthly limit. |
| Two photos of the same view (pickup and return), downscaled | When you tap “Describe the differences” (Pro) | To have an AI model list visible differences for you (performance of a contract). The photos are processed for that request and not kept by us; a count is kept to apply the monthly limit. |
| Trusted timestamps: the list of a completed inspection’s file fingerprints and the signed timestamp token | Automatically, for completed inspections of backed-up rentals | To prove the files existed no later than a given time (performance of a contract; legitimate interest in evidence integrity). Only the fingerprint of the list is sent to an independent timestamp authority (FreeTSA, or DigiCert as a fallback); no photos, names or locations. |
| Co-travellers: who joined a rental, the display name they chose, invite links (stored as a fingerprint) and who took each photo | When the owner of a backed-up rental invites people and they join | To let everyone on the trip see the rental and add evidence (performance of a contract). Members see the rental’s photos and details; the owner can remove members and members can leave. |
| Partner requests: which partner asked, your answer, the rental it relates to and, if you agreed, a report link | When you open a link from a rental company, host or insurer and answer its request | To send the finished report to that partner only if you agree (consent, which you can refuse without any other effect). Once sent, the partner is a separate controller of the report under its own privacy policy. A partner may pay for your backup of that rental; we tell you when it does. |
| Purchase and subscription status | When you buy a Rental Pass or Pro Annual | To unlock what you paid for (performance of a contract). Payment details are handled by Apple, Google or, for web purchases, Stripe; we never see your card. For web purchases we keep a Stripe customer reference with your account so you can manage the subscription. When you pay on the web from the Android app in the US, Google requires us to report the transaction to it (amount, tax, country and a Google-issued transaction reference; no card details or rental data). |
| Crash reports: device model, OS version, app version and the technical details of the error | When the app crashes and crash reports are on (default; switch off in Settings) | To find and fix bugs (legitimate interest). Reports exclude photos, notes, email addresses and request content. |
| Usage statistics: which steps are started, completed or skipped, with a random install identifier | Only if you switch on “Share anonymous usage statistics” | To improve the guided flow (consent, which you can withdraw in Settings at any time). Never linked to your account. |
5. Share links, co-travellers, partners and offers
A share link lets anyone who has it view the report for that rental in a web browser, including photos, videos, timestamps, locations and notes, until the link expires or you revoke it. Only share links with people you trust to see this information.
Co-travellers you invite can see the whole rental, including photos taken by others on it, and their name appears on photos they take. Partner companies receive a report link only after you agree in the app.
On upcoming rentals the app may show one offer from a partner, such as rental excess insurance, labelled as a partner offer. Offers are loaded without sending anything about you or the rental. If you tap one, the partner’s website opens and its own privacy policy applies; we may earn a commission. You can turn offers off in Settings.
6. Who helps us run Checkt
We use these service providers, who process data on our behalf under contract and only for the purposes above:
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Account sign-in, cloud database and file storage for backed-up rentals, share links | India (Mumbai) |
| Stripe Payments Europe Ltd. / Stripe, Inc. | Card payments, receipts and subscription management for purchases made on the web | Ireland and United States |
| RevenueCat Inc. | Managing in-app purchases and subscriptions bought through Apple or Google | United States |
| Anthropic PBC | Reading photos of rental agreements ("Scan agreement") and describing differences between two photos ("Describe the differences"), only when you choose them | United States |
| FreeTSA and DigiCert Inc. | Independent trusted timestamps: they receive only a fingerprint of a completed inspection's file list | Germany (FreeTSA), United States (DigiCert) |
| Functional Software Inc. (Sentry) | Crash reports, when crash reporting is on | United States or EU, depending on configuration |
| Sendinblue SAS (Brevo) | Sending sign-in codes by email (your email address and the code) | France (EU) |
| Apple Inc. and Google LLC | App distribution, payments and push of local notifications | United States |
Our providers may process data outside the United Arab Emirates and outside your country. For transfers from the UAE we rely on the safeguards permitted by the UAE Personal Data Protection Law; for data of users in the European Economic Area or the UK we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses (and the UK addendum) offered by these providers.
We disclose data to authorities only when the law requires it, and we will tell you unless we are legally prevented from doing so.
7. How long we keep data
- Data on your device stays until you delete it in the app or uninstall the app.
- Cloud copies of a rental are kept for the period you choose in Settings, counted from the end of the rental: 1, 6 or 12 months, or until you delete them with Pro Annual. With a Rental Pass the maximum is 12 months. If a Pro Annual subscription ends, cloud copies are kept for 90 days and then deleted. Expired copies are deleted automatically every day.
- Your account is kept until you delete it. Deleting your account removes your cloud backups, share links and account data immediately.
- Crash reports are kept for up to 90 days by our crash reporting provider. Anonymous usage statistics are kept for up to 24 months.
- Records of purchases are kept by Apple, Google and RevenueCat as required for tax and accounting.
8. Security
Data is sent to our servers over encrypted connections (TLS) and stored encrypted at rest by our hosting provider. Access is restricted per account by database rules, and evidence files cannot be overwritten once uploaded. Cloud data is not end-to-end encrypted: this lets us serve share links and lets you recover your data on a new phone. You can add a Face ID, fingerprint or passcode lock to the app in Settings.
9. Your rights
Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, depending on where you live, laws such as the EU or UK GDPR or California law, you have the right to:
- access the personal data we hold about you and receive a copy (Settings → Export all data, or email us);
- correct inaccurate data (edit details in the app);
- delete your data (Settings → Delete account, or see Delete your account);
- object to or restrict processing based on legitimate interests, and withdraw consent at any time;
- data portability; and
- complain to a data protection authority, such as the UAE Data Office, or the authority in your EU country or the UK Information Commissioner’s Office if you live there.
We respond to requests within one month. We do not sell or share personal information for cross-context behavioural advertising.
10. Children
Checkt is not directed at children. You must be at least 16 years old to create an account. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes
If we make material changes we will update the date at the top and tell you in the app before they take effect. The current version always lives at checkt.scinops.com/privacy.
12. Contact
Scinops FZE, checkt@scinops.com.