Privacy

Dinged isn’t released yet. This is a plain-language draft of how the app is designed to handle your data. We’ll publish a final policy before anyone outside our team can use it.

The short version

• Scanning, comparison, damage tagging and text reading happen on your iPhone.
• No third-party analytics. No ads. No tracking.
• Your scan files stay on your phone unless you turn on backup or share a report.
• You can delete your data and your account from Settings.

What stays on your phone

The scans themselves (images, depth, 3D model) are processed on the device. Comparing two scans, measuring changes, tagging damage types, and reading a VIN, plate or deduction letter all happen locally.

What reaches our server

• Seal data, always. For each scan: a manifest listing each file’s fingerprint (a SHA-256 hash, not the file), the app version, the device time, a signature, and coarse location if you allow it. This is what lets anyone verify a record later.
• Images in a shared report. When you share a Condition Record, the images it shows are uploaded so the verify page can display and check them.
• Full scans, only if you choose. “Back up full scans” is off by default.
• Account and purchases. You sign in with Apple. We store an identifier for your account and what you’ve bought, so purchases survive a reinstall.

Independent timestamps

To prove when a scan was made, we send a single fingerprint of the scan (its Merkle root) to an independent time-stamping service. It receives that hash only, never your images or details.

Privacy blur

Faces and documents or screens are blurred automatically in reports and on the verify page. The blur is applied to copies; originals stay sealed, and the verify page says when an image is shown with privacy blur.

Location

In Car mode, the return-lot reminder uses a geofence that runs on your phone. A coarse location can be included in a scan’s seal if you allow it.

Usage counts

The app sends simple event counts (for example, “a room was sealed” or “a report was exported”) to our own server, so we can tell whether the app works. These aggregates contain no user IDs. There are no third-party analytics or advertising SDKs, and no tracking, so the app never asks for tracking permission.

Who sees a shared record

Anyone with a record’s link or QR code can open its verify page. You decide who gets it. Share links can be set to expire.

Deleting your data

Settings has “Delete all my data” and “Delete account.” Timestamp tokens already issued by an independent service contain only a hash and can’t be used to recover your content.

Contact

Questions about privacy: support@dinged.app.