Privacy

Nothing about you is shown to anyone until you switch it on. We hold as little as we can. We do not sell anything to anybody, and there is nobody we would sell it to.

Your email address. The name, number plate and vehicle details you entered. The contact numbers you chose to record, and any emergency contact you added. Your blood group, if you gave one.

We do not ask for and do not store a national identity number. Your password is stored only as a one-way hash — we cannot read it, and neither could anyone who took a copy of our database.

Only what you switched on — and, since the scan page no longer asks why somebody is scanning, all of it on every scan. That includes your emergency contact and your blood group, which used to appear only where the person scanning said there had been an accident.

Those two are shown under a heading of their own asking that they be used only in an emergency. That is a request to whoever is reading it, and we cannot make anyone honour it. Each of them is a separate setting and each is off until you turn it on.

If you have switched nothing on, they see a page telling them you have been notified — and nothing about you at all.

Every change you make to these settings is recorded, with the exact wording that was on screen when you made it. That record is why we can answer, years later, why a particular person saw a particular number.

Whoever scans your sticker is never asked who they are. If they choose to leave a name or number so you can reply, we pass that on to you and keep it with the scan.

We keep an unreadable fingerprint of where the scan came from — not the address itself, and not anything that can be turned back into it. It exists so that if somebody uses your sticker to harass you, we can tell that the scans came from one place and act on it.

That fingerprint is never shown to you, and is removed entirely after a year.

Scans are kept, but what identifies the scanner is removed after a year. Notifications are kept for a year. Reports are kept for two. Payment records are kept permanently, because they are financial records — with the payment screenshot deleted a year after we have checked it.

Anything with a shorter life than that is listed in full in our retention policy, which is enforced by a job that runs every day rather than by anyone remembering.

Our hosting, database and email providers process this data because they have to in order to deliver it. Nobody else does.

There is no bulk export of contact numbers anywhere in this system, and every individual look at a payment screenshot is logged with who looked.

We use our hosting provider's own measurements to count page views and to record how quickly pages load. Both are counts and timings. They set no cookies, they do not identify you, they do not follow you to any other site, and they are the only such measurement anywhere in this product.

We do this because the page a scanner sees has to load quickly on a poor mobile connection, sometimes at the scene of an accident, and the only honest measure of that is real phones rather than our own.

There is no advertising network here, no tracking pixel in any email, and nothing that tells us whether you opened one. We know a message was accepted for delivery. We do not know whether you read it.

You can download everything we hold about you, in a machine-readable form, from your account screen.

You can delete everything from the same place. It happens immediately and cannot be undone by us or anyone else.

One thing outlives it, and we would rather name it than let you find out. While your account exists we keep a note that this inbox has had its free month, with the address beside it so we can answer you if you ever ask about it. When you delete the account the address is erased and only a scrambled, one-way version of it remains — it cannot be read, cannot be turned back into your address, and cannot be matched to you by anybody, including us. All it can do is answer yes or no when the same inbox asks for a second free month.