Privacy PolicyEffective date: August 28, 2026 · Last updated: October 4, 2026This Privacy Policy describes how Curbshot (“Curbshot,” “we,” “us,” or “our”) collects, uses, stores, and deletes information when you use curbshot.app, the Curbshot iOS and Android apps, homeowner share links, and related services (together, the “Service”).Curbshot is a United States product operated from the United States. Questions: [email protected].By creating a shop account or using the Service, you acknowledge this policy. If you do not agree, do not use Curbshot.Who we areCurbshot is photo proof for trades. A shop shoots before and after photos on a job, then shares an unlisted link and a PDF report with a homeowner. Homeowners can view shared proof without creating an account or paying to view it. They may separately pay a contractor’s invoice through a payment link.We operate the website and API on Laravel Forge. We do not claim to be a limited liability company on this page. We have not published a street address or EIN here. Mail for privacy requests: [email protected].Information we collectShop accountsWhen you create a shop we store:Jobs and photosJob names or addresses, recipient details and notes, optional customer signatures, invoice line items and amounts, customer contact details supplied by the shop, photo metadata (kind, filename, timestamps), and the photo files themselves. Job-site photos may include house exteriors, streets, vehicles, license plates, and bystanders. That is the nature of driveway photo proof. The shop is responsible for what it shoots and who it shares those photos with.Job and photo metadata lives on our Laravel Forge servers. Photo bytes and shop logos live in private Cloudflare R2 object storage. The shop phone also keeps an offline-first SQLite copy of jobs and photos until it syncs, and may keep JPEG files on the device.Homeowner share linksEach job gets an unlisted /s/{token} URL. Anyone with the link can view the job’s photos and PDF. Viewing proof does not require an account or payment. Invoice payment pages may separately collect payment and contact information through Stripe. We do not put a login wall on share pages. The shop is responsible for who receives the link.BillingCurbshot is free to use and does not require a subscription. Homeowner payments for contractors’ real-world services go through Stripe Connect. We do not store full card numbers, CVC codes, or bank account numbers. We store connected-account identifiers, invoices, payment-session identifiers, amounts, fee settings, and payment status to provide invoicing and payment tracking. Stripe processes payment details and retains payment and tax-related records under its policies. Records from former subscription purchases may remain with Apple, Google, or Stripe under their retention requirements.Transactional emailPassword-reset and similar account email is sent through Resend. We use your email for those messages and for service notices about the account. We do not run a marketing newsletter from this stack unless we say so later and give you a way off it.Payment alerts and biometric unlockIf you enable payment alerts, we associate a push-notification token with your account. Firebase Cloud Messaging and Apple’s push-notification service deliver alerts containing payment amounts and job or payment identifiers. You can disable payment alerts in Shop settings. Optional biometric unlock uses the device’s operating-system authentication; Curbshot does not receive or store your face or fingerprint data.Technical logsOur hosts (Laravel Forge and the infrastructure behind it, including Cloudflare in front of R2) may record IP address, user agent, request time, and error traces so we can keep the Service up and debug failures. We do not use those logs to build advertising profiles.How we use this informationWe use it to run Curbshot:We do not sell personal information. We do not share customer photos with advertisers. We do not run social pixels on these pages. The iOS and Android apps do not show advertising. The app is free; on $50+ invoices a $4.95 processing fee may apply via Stripe Connect.Processors we actually useWe use a short list of companies to operate the Service. They process information only to provide their service to us:Apple and Google distribute the iOS and Android apps. Curbshot does not require an in-app subscription purchase. They may process device identifiers and crash information according to their own policies when you download the app from the App Store or Google Play.We do not sell personal informationCurbshot does not sell personal information as that term is used under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA). We do not share personal information for cross-context behavioral advertising. We do not use your job-site photos to train public AI models.If you are a California resident (or a resident of another U.S. state with similar privacy rights), you may request access to, correction of, or deletion of personal information we hold about you, and you may appeal a refusal, by emailing [email protected]. You will not be discriminated against for exercising those rights. The in-app Delete account control described below is the same deletion right, available without writing to us.Account deletionYou can delete your shop from Settings in the Curbshot app. That control is not buried: it sits with Sign out. Confirming deletion permanently deletes the shop, its users, jobs, photos, device tokens, and share links. Deleting Curbshot does not erase payment records held by payment providers or automatically close your connected Stripe account. Share pages at /s/{token} return 404 after deletion.You can also request deletion by emailing [email protected] from the account email. We will match that to the shop and run the same deletion.After deletion we keep only records the law requires. That means Stripe invoices, payment history, and tax-related records Stripe already holds. We do not keep your photos, shop name, logo, job notes, or login in our application database for a “just in case” archive. Local copies on a phone are wiped by the app when deletion succeeds; a photo that was already forwarded to a homeowner is outside our control.Access and correctionSigned-in shops can see and edit their shop name and preferences in Settings, and can create, edit, and delete jobs and photos in the app. For a copy of account data, or if something is wrong and the app cannot fix it, email [email protected].RetentionWe keep account, job, and photo data while the account is active. Individual jobs and photos can be deleted by the shop without deleting the account. When the account is deleted, application data is removed as described above. Server logs are kept only as long as we need them for security and operations, then rotated. Stripe retains billing records under its own retention schedule and applicable tax law.SecurityPasswords are hashed. API access from the app uses Sanctum bearer tokens stored in the device keychain / keystore. Photo objects in R2 are private; the app and share pages fetch them through our servers, not as a public bucket. No method of transmission or storage is perfectly secure. If we learn of a breach that affects your shop, we will email the account address.ChildrenCurbshot is a business tool for trades, not a consumer toy. It is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have, email [email protected] and we will delete it.Where we operateCurbshot is v1 and United States–first. Servers and object storage are operated for a US product. We do not run a separate EU GDPR representative, DPO, or Standard Contractual Clauses program at this time. If you are in the EEA, UK, or Switzerland and still want to use Curbshot, understand that your information is processed in the United States. To access or delete your data, use the in-app Delete account control or email [email protected].South Carolina lawThis policy is governed by the laws of the State of South Carolina, United States, without regard to conflict-of-law rules, except where a privacy statute in your state gives you non-waivable rights — those rights still apply.ChangesWe may update this policy. The effective date at the top will change. Material changes will be posted on this page. Continued use of the Service after an update means you accept the revised policy. If a change is significant we will also email the shop account when we can.ContactCurbshot · United States[email protected]
•Email address
•A hashed password — we do not store your password in plain text
•Shop name and payment preferences; previously uploaded logos and PDF footer text may remain with existing accounts
•Sanctum device tokens so a signed-in phone can stay signed in
•Account timestamps (created, updated)
•Sign you in and keep a device signed in
•Store, stamp, and sync job-site photos
•Build the PDF report and serve the share links you create
•Process Stripe Connect invoice payments and send optional payment alerts
•Respond to support email and security issues
•Comply with law, including tax recordkeeping
•Stripe — contractor onboarding, invoice payments, payouts, the Express Dashboard, and payment records
•Laravel Forge — application hosting for curbshot.app and the API
•Cloudflare R2 — private object storage for photos and shop logos
•Resend — transactional email such as password resets
•Google Firebase and Apple — delivery of optional push notifications
Curbsh
t
Proof you did the work. Before and after photos, shareable reports, and invoices for independent trades.© 2026 CURBSHOT. ALL RIGHTS RESERVED.t