Privacy Policy

1. Introduction

Scratch ("we," "our," or "us") is a mutual aid platform operated by Scratch: Give & Get Help. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service").

2. Information We Collect

Account Information

• Name and display name
• Email address
• Phone number
• Profile photo (optional)

Authentication Data

• Sign-in credentials via email OTP, SMS OTP, or social login (Google, Apple, Facebook)
• We do not store passwords — authentication is token-based

Financial Information

• Payment card details are processed directly by Stripe and never stored on our servers
• Bank account information for payouts is collected via Stripe Financial Connections and stored by Stripe
• Identity verification data (name, date of birth, last 4 of SSN) is transmitted directly to Stripe for Connect account verification
• Transaction history (donation amounts, dates, recipients)

Usage Data

• Reciprocity Score data (donation history, request history, skip counts)
• Community connections (your circle of contacts)
• Push notification tokens
• Invite and referral codes

3. How We Use Your Information

• To create and manage your account
• To process donations and payouts
• To calculate your Reciprocity Score and determine request limits
• To display requests in your community feed
• To send notifications about donations, request updates, and refunds
• To verify your identity for payouts (via Stripe)
• To prevent fraud and abuse
• To comply with legal and tax reporting obligations

4. Third-Party Services

We use the following third-party services:

• Stripe — Payment processing, identity verification, and payouts. Stripe's privacy policy applies to data they collect.
• Supabase — Database hosting, authentication, and serverless functions. Data is stored in secure, encrypted databases.
• Twilio — SMS verification for phone number confirmation.
• Resend — Email delivery for OTP codes and notifications.
• Expo — Push notification delivery to your mobile device.

5. Data Sharing

We do not sell your personal information. We share data only as follows:

• With other Scratch users: your display name, profile photo, and request details are visible to other users
• With Stripe: payment and identity data necessary to process transactions
• With law enforcement: when required by law or to protect the safety of our users
• For tax reporting: Stripe handles 1099 reporting for payouts as required by the IRS

6. Data Security

We implement industry-standard security measures including encrypted data transmission (TLS), encrypted database storage, row-level security policies, and secure authentication tokens. No method of electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your account data for as long as your account is active. Transaction records are retained as required for tax and legal compliance. You may request deletion of your account and associated data at any time through the app settings.

8. Your Rights

You have the right to:

• Access and download your personal data
• Request correction of inaccurate information
• Delete your account and personal data
• Opt out of non-essential notifications

To exercise these rights, use the account settings in the app or contact us at info@scratchapp.us.

9. Children's Privacy

Scratch is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via in-app notification or email. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy, contact us at:

Scratch: Give & Get Help
info@scratchapp.us