Privacy Policy

This Privacy Policy explains what information NoKnock LLC (“NoKnock,” “we,” “us,” or “our”) collects through noknock.co (the “Service”), how we use and share it, and the choices and rights you have. The Service is intended for use within the United States. This Policy should be read together with our Terms of Service.

1. Information we collect

Account information. If you sign up as a homeowner, we collect your email address and, if you use email/password sign-in, a password (stored securely by our authentication provider using industry-standard hashing, never in plain text). If you sign in with Google, we receive the basic profile information Google shares for authentication.

Address and registration data. When you register an address, we collect the address itself and the recipient name used for decal shipping. A registered address carries a single setting - that solicitation is not welcome - so there are no per-category or time-of-day preferences to collect. If you enter a community code or use a community link, we also record which community's decal program your address is part of.

Scan data. When someone scans the QR code on your decal, we record which address was checked, the result shown, the IP address and browser/device user-agent string of the device that performed the scan, and the timestamp. Scanning does not require an account or an app - the public scan page is open to any phone camera - so these records are not attached to a person, and we use them to show you activity on your own address, to detect abuse, and to throttle repeated scans of the same address.

Payment and shipping information. If you order a physical decal, payment is handled directly by Stripe - we don't receive or store your full card number. We share the shipping name and address on file with our print fulfillment vendor, Printful, solely to produce and ship your decal.

Usage data. Like most websites, we automatically collect standard technical data (such as IP address, approximate location derived from IP, browser type, and pages visited) through our hosting provider's server logs, for security and reliability purposes. We don't currently use third-party analytics or advertising trackers; if that changes, we'll update this Policy first.

What we don't collect. We don't collect precise GPS or device location, we don't collect biometric information, and we don't run facial recognition. NoKnock is a website only - there is no NoKnock mobile app, so nothing is collected from a phone beyond what any website receives from a browser.

2. How we use information

• To create and maintain your account and registered addresses;
• To generate your QR code and, if ordered, produce and ship a physical decal;
• To show anyone who scans the QR code at a registered address that the address is marked “Do Not Knock”, along with the publicly available door-to-door soliciting rules for that state;
• To show you scan activity on your own registered addresses;
• To process payments for optional paid features;
• To detect and prevent duplicate registrations, fraud, and abuse of the Service;
• To notify our internal team (via a private Slack channel) when a new address is registered, so we can monitor signups;
• To communicate with you about your account and the Service - for example confirming your account, prompting you to finish registering an address, and sending you reports about activity on your own registered addresses. These are service-related messages that come with having an account;
• To send you promotional updates such as new features, tips, and occasional offers. This is separate from the account and activity messages above. New accounts are subscribed to these updates by default - the signup page says so, and the email signup form includes a checkbox you can untick. Accounts created before July 25, 2026 are only subscribed if they opted in. Every such email includes a one-click unsubscribe, and you can turn these on or off anytime from your account settings; and
• To comply with legal obligations and enforce our Terms of Service.

We don't sell your personal information, and we don't use it for advertising. We don't use automated decision-making or profiling that produces a legal or similarly significant effect on you.

3. What someone scanning your code sees

The public scan page returns only that the address is registered as “Do Not Knock”, the street and city with most of the house number masked, and the door-to-door soliciting rules for that state. It does not return your name, email, phone number, or any other identifying information. This lookup runs through a restricted server-side function specifically so that only the minimum necessary information is ever exposed, and the masking is applied on our servers rather than in the page.

4. Who we share information with

We share information with service providers (“processors”) who help us run the Service, including:

• Supabase - database hosting and authentication;
• Vercel - website hosting;
• Stripe - payment processing for decal orders;
• Printful - printing and shipping physical decals;
• Google - optional Google sign-in and address autocomplete;
• Anthropic - the AI service used for drafting our own marketing content and answering support questions - never given your account, address, or contact information;
• Slack - internal notifications to our own team, not shared externally.

These providers only receive the information needed to perform their function for us and aren't authorized to use it for their own purposes. We may also disclose information: if required by law, subpoena, or court order; where we believe in good faith disclosure is necessary to prevent harm, fraud, or abuse of the Service, or to protect the rights, safety, or property of NoKnock, our users, or others; to law enforcement regarding apparent illegal content as described in Section 9; or in connection with a merger, acquisition, financing, or sale of some or all of our assets, in which case we'll require the successor to honor the commitments in this Policy. We are not a data broker and do not otherwise sell, rent, or trade your personal information to third parties.

Community decal programs. If a community association or HOA sponsors decals for its residents through our Community Decal Program, the association receives only approximate, aggregate counts - how many of the decals it paid for have been claimed, and roughly how many homes in the community are registered. It does not receive your name, address, email, registration status, or anything else identifying you or your household, and we suppress or round any count small enough to point to a particular home. This commitment, and its single exception for a legally binding demand such as a court order, is set out in our Community Decal Program Terms.

5. Data security

We use database-level access controls to restrict which data can be read by whom, and the public scan lookup runs through a restricted server-side function that returns only a masked address rather than the underlying record. Our internal admin tools are restricted to a small list of authorized team email addresses. If we experience a security breach that compromises your personal information in a way that requires notification under applicable law, we'll notify affected users and any required regulator as and when the law requires. No system is perfectly secure, and we can't guarantee absolute security of information you submit.

6. Your choices and rights

You can edit or deactivate a registered address at any time from your dashboard. You can opt in or out of promotional email anytime from your account settings, or by clicking unsubscribe in any promotional message - this doesn't affect account and activity messages, which are part of having an account. To request a copy of your data, correct it, or delete your account entirely, email us at hello@noknock.co from the email address on your account (so we can verify it's you), and we'll respond within 45 days. If you live in Colorado, California, or another state with a comprehensive privacy law, Section 7 below describes additional rights that apply to you specifically.

7. State privacy law rights (Colorado, California, and others)

Colorado. As a Colorado company, we extend the core rights of the Colorado Privacy Act to all Colorado residents: the right to confirm whether we process your personal data, access it, correct inaccuracies, delete it, obtain a portable copy, and opt out of the sale of personal data, targeted advertising, or profiling that produces legal or similarly significant effects (as noted above, we don't sell data or use targeted advertising or this kind of profiling today). If we deny a request, you may appeal by replying to our decision email within a reasonable time; if the appeal is denied, we'll provide a way to submit a complaint to the Colorado Attorney General.

California. If you're a California resident, the California Consumer Privacy Act (as amended) gives you the right to know what personal information we've collected about you, request deletion, request correction, and opt out of the “sale” or “sharing” of personal information - we do not sell or share personal information as those terms are defined by the CCPA, and we don't use or disclose sensitive personal information for purposes requiring an opt-out right. You won't receive discriminatory treatment for exercising any of these rights. You may designate an authorized agent to make a request on your behalf; we may require verification of the agent's authority.

Other states. If you live in another state with a comprehensive privacy law (for example, Virginia, Connecticut, Utah, or others as they take effect), we'll honor the equivalent access, correction, deletion, portability, and opt-out rights those laws provide, on request to hello@noknock.co.

8. Data retention

We keep account and address data for as long as your account is active. We keep scan logs for as long as reasonably needed for the purposes described in Section 2, and generally no more than three years, unless a longer period is needed to resolve a dispute or comply with law. If you delete your account, we'll remove or de-identify your personal information within a reasonable time, except where we're required to keep it (for example, payment records needed for tax or accounting purposes, or content preserved in connection with a legal obligation such as Section 9 below).

9. Illegal content and mandatory reporting

The Service has no facility for uploading photos, files, or free-text content - the only information you provide is your account details and the addresses you register - so there is no user-submitted content for us to host or moderate. We do not tolerate illegal content of any kind. If we nonetheless became aware of apparent child sexual abuse material in connection with the Service, we are legally required under U.S. federal law to report it to the National Center for Missing & Exploited Children's CyberTipline, to preserve the relevant content and associated account information, and we'll cooperate with law enforcement accordingly.

10. Cookies and Do Not Track

We use cookies set by our authentication provider to keep you signed in - these are essential to the Service and can't be disabled without breaking sign-in. We don't use third-party advertising or tracking cookies. Because there's no common industry standard for responding to browser “Do Not Track” signals, we don't currently respond to them differently.

11. Children's privacy

The Service is intended for people 18 and older and isn't directed to children. We don't knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us at hello@noknock.co and we'll delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the effective date above and, where practical, notify you (for example, by email or an in-app notice) before the change takes effect.

13. Contact

Questions about this Privacy Policy, or want to exercise any of the rights described above? Email us at hello@noknock.co.