1 Who We Are

AfterProof L.L.C. ("AfterProof," "we," "our," or "us") operates the AfterProof mobile application and the website at useafterproof.com (together, the "Service"). We are a home inventory documentation service that helps you document personal property for insurance and record-keeping purposes.

We are registered in Louisiana, USA. Privacy inquiries: privacy@useafterproof.com.

2 Information We Collect

2.1 Information You Provide

2.2 Collected Automatically

2.3 What We Do NOT Collect

• Your precise GPS location or home address;
• Social Security Number, government ID, or financial account numbers;
• Your insurance policy details or insurer information;
• Contacts, calendar, or other device app data;
• Biometric data of any kind.

3 How We Use Your Information

• Provide the Service — store and manage your inventory across devices;
• Power AI features — identify items in your photos and look up estimated replacement values (see Section 4);
• Generate PDF reports of your inventory;
• Manage your subscription (billing is handled by Apple; subscription status is managed via RevenueCat);
• Provide customer support when you contact us;
• Improve the app through aggregated, anonymized usage analysis;
• Send transactional emails (receipts, password resets, important notices);
• Detect and prevent fraud, abuse, and unauthorized access;
• Comply with legal obligations.

We do not use your inventory data or photos to train AI models. We do not sell your data to advertisers, data brokers, insurance companies, or anyone else.

4 AI Disclosure

AfterProof uses artificial intelligence to help you document your belongings faster. When you use AI features, here is exactly what happens:

4.1 What Happens When You Use AI

• Your photo is sent to OpenAI for item identification. OpenAI analyzes the image and returns the likely brand, model, category, and a suggested search query.
• The search query is sent to SerpAPI (Google Shopping and Google Product data) to look up estimated replacement prices and a product reference image. Only the text query is sent — never your photo or personal information.
• Results are returned to you in the app so you can approve, edit, or reject them before they are saved to your inventory.

4.2 Estimated Values Are Estimates

All values suggested by AI are estimates, not appraisals. They are based on retail pricing data at the time of the search. Actual insurance settlement values depend on your policy, condition, depreciation, and your insurer's determination. AfterProof is not an insurance company, appraiser, or valuation service. You are responsible for verifying values and correcting any inaccuracies before relying on them.

4.3 Training Data

Under our commercial API agreements with OpenAI and SerpAPI, your photos and queries are not used to train their AI models. Data sent to these providers is transmitted securely over encrypted connections and processed only to return your results.

4.4 Your Control

AI features are optional. You can add, edit, and manage items entirely by hand without using AI at any point. You can always review AI suggestions before saving them.

5 How We Share Your Information

We do not sell your personal data.

5.1 Service Providers

We share limited data with trusted service providers who help us operate the Service. Each is contractually required to protect your data and use it only for the purposes described.

5.2 Legal Requirements

We may disclose information if required by law, court order, subpoena, or valid legal process, or where we believe in good faith that disclosure is necessary to protect the safety of AfterProof, our users, or the public.

5.3 Business Transfers

If AfterProof is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

5.4 What We Never Do

• We never sell your data to advertisers or data brokers;
• We never display ads in AfterProof;
• We never share your photos or inventory with insurance companies — only you can generate and share PDFs of your inventory;
• We never share user data with insurance agents in our referral program — agents only see their own referral statistics (counts, commissions), not your identity, data, or photos.

6 How We Access Your Data

Transparency matters. Here is exactly who at AfterProof can see your data and why.

6.1 Data Ownership

You own your inventory data and photos. We act as a custodian — storing and processing your data on your behalf to provide the Service.

6.2 Data Isolation

Your account data is isolated from other users' data through Firebase Security Rules. Only you, signed in to your account, can read or write your inventory. Other users cannot access your items, rooms, or photos.

6.3 Limited Admin Access

A small number of AfterProof personnel have administrative access to backend systems. Access is strictly limited to these specific purposes:

• Customer support — accessing your account only when you contact us and specifically request help;
• Security and fraud prevention — investigating suspected abuse, unauthorized access, or security incidents;
• Legal compliance — responding to valid legal requests or court orders;
• Service operation — viewing aggregated, anonymized metrics to diagnose outages and improve performance.

Admin access is logged and audited. We do not browse, read, view, or analyze individual user photos or inventory data outside of these specific purposes.

6.4 Encryption

All data is encrypted in transit (HTTPS/TLS) and at rest (Firebase's server-side encryption). Your password is never stored in plain text — it is hashed using industry-standard methods.

7 Data Storage and Security

Your data is stored on Google Firebase infrastructure, hosted primarily in the United States. Firebase complies with GDPR, SOC 2, and ISO 27001 standards.

Our security measures include:

• Firebase Security Rules restricting data access to the authenticated account owner;
• Per-user isolation of photos and receipts in cloud storage;
• HTTPS/TLS encryption for all data in transit;
• Server-side encryption of all data at rest;
• Firebase Authentication with hashed passwords;
• Monitoring for unusual access patterns and suspected abuse;
• Regular review of access controls and security rules.

No system is 100% secure. If we become aware of a data breach affecting your personal information, we will notify you as required by applicable law.

8 Data Retention and Deletion

8.1 While Your Account Is Active

We retain your account data, inventory, and photos for as long as your account is active and you continue to use the Service.

8.2 When You Delete Your Account

You can delete your account directly in the app at any time. When you do:

• Your inventory items, rooms, properties, photos, and receipts are permanently deleted immediately from our database and cloud storage;
• Your account authentication record is deleted, and you will no longer be able to sign in;
• Residual backups are purged within 90 days as part of routine backup rotation.

8.3 Agreement Records

For legal compliance, dispute resolution, and audit purposes, we retain records of your acceptance of our Terms of Service, Privacy Policy, age certification, and export acknowledgments after account deletion. These records include the email address, display name, user ID, IP address, and device/browser information associated with each acceptance, the date and time of acceptance, and the version of the document accepted. They are not anonymized, because their purpose is to evidence who agreed to what and when. They are kept separate from your deleted inventory data, are not used for any other purpose, and are retained for up to 7 years after account deletion, after which they are deleted.

8.4 Other Retention Periods

• Payment and subscription records: Billing is handled by Apple under Apple's policies; we retain subscription transaction records (via RevenueCat) for up to 7 years for tax and accounting purposes;
• Support communications: Retained for up to 2 years after your last interaction;
• Anonymized analytics: May be retained indefinitely — cannot identify you.

9 Your Privacy Rights

To exercise these rights, email privacy@useafterproof.com. We respond within 30 days. You can also delete your account directly in the app. Note that agreement records described in Section 8.3 are retained after deletion to the extent permitted by law, as they are necessary for legal compliance and the establishment, exercise, or defense of legal claims. We will not discriminate against you for exercising your privacy rights.

10 European Users (GDPR / UK GDPR)

10.1 Legal Basis for Processing

• Contract performance — processing necessary to provide the Service you requested;
• Legitimate interests — improving the Service, preventing fraud, and retaining agreement records for the establishment, exercise, or defense of legal claims;
• Consent — marketing communications and optional data uses;
• Legal obligation — compliance with applicable laws.

10.2 Additional Rights

Users in the European Economic Area, United Kingdom, and Switzerland may also restrict processing, object to processing based on legitimate interests, and lodge complaints with their national data protection authority (such as the ICO in the UK or the relevant Data Protection Authority in your country).

10.3 International Transfers

Data is transferred to and stored in the United States. We rely on Google's Standard Contractual Clauses for these transfers. See Firebase's privacy documentation for further details on safeguards.

10.4 Data Protection Officer

We have not appointed a formal Data Protection Officer as we do not meet the GDPR thresholds requiring one. Privacy inquiries can be directed to privacy@useafterproof.com.

11 California Residents (CCPA / CPRA)

California residents have the right to:

• Know what personal information we collect, use, and disclose;
• Request deletion of personal information;
• Request correction of inaccurate personal information;
• Opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information as defined by the CCPA/CPRA);
• Limit the use of sensitive personal information;
• Receive non-discriminatory treatment for exercising these rights.

To exercise these rights, email privacy@useafterproof.com with "California Privacy Request" in the subject line. We may need to verify your identity before responding.

California residents also have the right to designate an authorized agent to make requests on their behalf.

12 Other Regional Rights

Canada (PIPEDA): Canadian users have rights to access and correction of personal information, and to file complaints with the Office of the Privacy Commissioner of Canada. Contact our Privacy Officer at privacy@useafterproof.com.

Australia (Privacy Act 1988): Australian users have rights consistent with the Australian Privacy Principles. You may lodge complaints with the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your personal information.

New Zealand (Privacy Act 2020): New Zealand users have rights consistent with the Privacy Principles in the Privacy Act 2020 and may lodge complaints with the Office of the Privacy Commissioner.

Brazil (LGPD): Brazilian users have rights to access, correction, deletion, and portability of personal information. Contact privacy@useafterproof.com.

13 Children's Privacy

AfterProof is not directed at children under 13 (or under 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact privacy@useafterproof.com and we will delete it promptly.

14 Cookies and Tracking

The AfterProof mobile app does not use cookies. Our website may use essential cookies for session management and aggregated analytics tools for anonymized usage data. You can control cookies through your browser settings at any time.

15 Third-Party Links

The Service may contain links to third-party websites (such as search result links for items). We are not responsible for their privacy practices and encourage you to review their policies before providing personal information.

16 Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you via email or in-app notification at least 30 days before material changes take effect. Non-material changes (such as clarifications or typographical corrections) may take effect immediately and will be reflected by an updated "Effective Date" at the top of this policy.

Continued use of the Service after the effective date of a change constitutes acceptance of the updated policy. If you do not agree to the changes, you may delete your account before the effective date.

17 Governing Law

This Privacy Policy and any disputes arising from it are governed by the laws of the State of Louisiana, United States, without regard to its conflict of laws provisions. Nothing in this section limits statutory rights you may have under your local law.

18 Contact Us

We respond to all privacy requests within 30 days. Last updated June 7, 2026.