Privacy Policy

Effective October 15, 2026 · Last updated October 15, 2026

1. Who we are

ViolationNow is operated by Sam Guardians Corp ("ViolationNow", "we", "us" or "our"), 160 E 46th St, Brooklyn, NY 11203, United States.

This policy explains how we collect, use, share and protect personal information when you use the ViolationNow web app at app.violationnow.com, the ViolationNow iOS app, our alert emails, text messages and push notifications, and this help site (together, the "Service"). It is part of our Terms of Service.

ViolationNow is a business tool for people who own, manage or work on buildings in New York City. It is not affiliated with the City of New York or any of its agencies.

2. Information we collect

Information you give us

• Account details: your name, email address and password. We store your password only as a salted one-way hash (argon2id), so we cannot see it.
• Mobile phone number (optional): only if you add one, and we use it only to send the text alerts you turn on.
• Buildings and work content: the addresses you monitor (street, borough and ZIP code), the building identifiers we look up for them (BIN, BBL, block and lot), and the labels, notes, tasks, due dates, assignments and handler names you add. If you record amounts for your own bookkeeping (for example billed, paid or owed), we store those too.
• Team information: when you invite someone, their email address, the role you give them, the addresses you share with them and what they are allowed to see.
• Notification settings: which alerts you want, on which channels (push, email or text), your minimum severity, quiet hours and time zone. If you turn on text alerts, we record when you agreed, the exact consent wording you agreed to, and the IP address and browser or app details used at that moment.
• Messages to us: what you send us by email, and our replies.

Information collected automatically

• Sign-in sessions: for each sign-in, the IP address, browser or app details (user agent), a device type (for example "iPhone"), when the session was created and last used, and when it expires.
• Security records: a log of sign-ins, failed sign-in attempts (including the email address that was entered), password resets, team changes, billing actions and address changes, with the IP address and, for sign-in and password events, browser or app details. We also count failed sign-in attempts so we can pause sign-in to an account after repeated failures.
• Server logs: technical details of each request to our servers, such as IP address, the web address requested, time and result.
• Push notification token: if you allow notifications in the iOS app, Apple gives the app a device token. We store it with the app version, the push environment and the sign-in session it belongs to. When you sign out of the app, we delete that device's token.
• Information stored on your device: see Cookies and device storage.

Information from other sources

• NYC public records: for each building you monitor we retrieve records the City of New York publishes through NYC Open Data, such as Department of Buildings violations and complaints, ECB/OATH summonses and hearings, and FDNY violations. These records can include the names of people and companies, such as owners, respondents, permit applicants and contractors. See NYC public records.
• Address lookup: NYC Planning's GeoSearch service returns the official address and building identifiers for the address you enter.
• Stripe: if you subscribe, Stripe tells us your Stripe customer and subscription identifiers, subscription status, number of addresses, price tier, renewal date, and whether a payment failed or was refunded. We never receive your card number or security code.
• Your team: if someone invites you to their account, we receive your email address and the role they chose for you from them.
• Apple: if you chose to share analytics with app developers in your iPhone's settings, Apple may share crash reports and app usage statistics with us. Apple and your settings control this.

What we do not collect

We do not collect your location, contacts, photos, or camera or microphone input, and the iOS app does not ask for those permissions. Face ID is handled entirely by iOS: we never receive your face data, and the app stores only whether you turned the Face ID lock on. We do not use analytics, advertising or tracking tools, and we do not build advertising profiles. We do not collect your full payment card details.

Until the web app launches, the demo at app.violationnow.com described in section 1 is an exception: it loads analytics software.

3. How we use information

• To provide the Service: match your addresses to City records, track changes, show statuses, stages and next steps, and let your team work together.
• To send messages: the alerts you choose by push notification, email or text message, and account emails such as email confirmations, sign-in links, password resets and team invitations.
• For billing: manage your subscription through Stripe, including the number of addresses billed.
• For security: sign you in, protect accounts (for example by pausing sign-in after repeated failed attempts), prevent abuse and fraud, and investigate incidents.
• For support and reliability: answer your questions, troubleshoot errors and keep the Service running.
• For legal reasons: comply with the law, enforce our Terms and keep tax and accounting records.

We do not sell your personal information, share it for cross-context behavioral advertising, or use it to make automated decisions that have legal or similarly significant effects on you. We do not send marketing email today. If we start, we will do so only as the law allows and every message will include a way to opt out.

4. Legal bases

The Service is intended for the United States. Where a law requires a legal basis for using personal information (for example, the GDPR if you are in the European Economic Area or the UK GDPR if you are in the United Kingdom), we rely on:

• our contract with you, to provide the Service you signed up for;
• legitimate interests, to keep the Service secure, prevent abuse, support your team account and improve reliability;
• consent, for text messages and push notifications, which you can withdraw at any time; and
• legal obligations, such as tax and accounting records.

5. How we share information

We share personal information only as described in this section.

Service providers

These companies process information for us so we can run the Service. We share with them only what they need for that purpose. Through our agreements with them, we require them to give personal information the same or equal protection as this policy describes and to use it only to provide their services to us.

Stripe also processes payment information under its own privacy policy, as an independent provider of payment services.

We do not share mobile phone numbers, or text-message opt-in data and consent, with third parties or affiliates for their marketing or promotional purposes. Twilio receives your number only to deliver the text alerts you turned on.

Fonts in the web app

The ViolationNow web app loads its typeface from Google Fonts. When it does, your browser sends your IP address and browser details to Google, and Google's privacy policy applies. The iOS app and this help site do not use Google Fonts.

Add to calendar

If you choose "Add to Google Calendar" for a hearing in the web app, your browser opens Google Calendar with the hearing details filled in: the agency, ticket number, hearing date, description, building address and penalty. Google receives those details when the page opens, whether or not you save the event, and Google's privacy policy applies.

City data services

To look up and monitor your buildings we send requests to NYC Open Data, operated by the City of New York, and to NYC Planning's GeoSearch service. GeoSearch receives the street and borough you type when you add an address. NYC Open Data receives building identifiers (BIN, borough, block and lot) and ticket numbers. We never send them your name, email address or phone number.

Your team

On a team account, the information members add (such as notes, tasks, assignments and handler names) is visible to other members according to their roles. Viewers see only the addresses shared with them, and see internal notes and billing amounts only if the account owner or an admin turned those on. Team invitation emails include the name of the person who sent the invitation.

Our staff

A small number of authorized ViolationNow staff can access account information when needed to provide support, operate the Service, or investigate security problems or abuse.

Legal and business reasons

We may disclose information if required by law, subpoena or other legal process; to protect the rights, property or safety of our users, the public or us; or as part of a merger, acquisition, financing or sale of assets, in which case this policy will continue to apply to the information transferred.

6. NYC public records

The building records we show come from data the City of New York publishes. They are public whether or not you use ViolationNow, and they may name people and companies connected with a building. We store these records as the City publishes them and link them to your account only because you chose to monitor the address.

We cannot change or correct City records. If a record is wrong, contact the agency that issued it.

7. Cookies and device storage

• Web app: one cookie, __Host-vn_session, which keeps you signed in. It is strictly necessary, cannot be read by scripts, is sent only to ViolationNow, and expires with your session (after at most 30 days). The web app also saves one setting in your browser's local storage, the "Only addresses assigned to me" switch, and, if you open a team invitation before signing in, that invitation's code until you have signed in and joined the team (at most 7 days). While you accept a team invitation, its code is also kept in that browser tab's session storage until you have joined the team or close the tab.
• iOS app: your sign-in token is kept in the iOS Keychain on that device only. The app also stores a few settings on the device, such as your Face ID lock setting and the "Only my addresses" switch.
• This help site: no cookies, scripts or third-party resources.

We do not use advertising or analytics cookies. Because we do not sell or share personal information or track you across websites, there is nothing for a Global Privacy Control or Do Not Track signal to switch off.

Until the web app launches, the demo at app.violationnow.com described in section 1 does not follow this section: its analytics software can store identifiers in your browser.

8. How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy. For each kind of information:

• Account details, buildings, content and settings: while your account is open, so we can provide the Service. When you delete your account, we delete or erase them as described below.
• Links and sessions expire: sign-in links after 15 minutes, password-reset links after 30 minutes, email-confirmation links after 24 hours, and team invitations after 7 days. Sign-in sessions expire 30 days (web) or 90 days (iOS app) after you sign in. An expired link or session can no longer be used, but the record that it existed is kept, as described below.
• Removing a building stops monitoring it, but its history (records, notes and tasks) stays in our database until you delete your account. You can ask us to delete it sooner.
• Security and activity records, such as security logs, records of past sign-in sessions and email links, and alert history: while your account is open and, as described below, after it is deleted, for as long as we need them to keep accounts and the Service secure, investigate abuse and incidents, and meet legal obligations.
• Billing records, such as our record of your subscription and its Stripe identifiers: for as long as we need them for accounting, tax and legal purposes.

When you delete your account

Deleting your account immediately:

• cancels your subscription with Stripe, so you are not charged again;
• deletes every building you own, together with its records, notes, tasks, alerts, invitations and shares;
• deletes your push notification tokens, signs you out everywhere and removes you from other people's team accounts; and
• erases your name, phone number and password from your account record and replaces your email address with a placeholder.

We keep a placeholder account record without those details so that our billing and security records stay consistent. The following information is not deleted when you delete your account:

• security and audit logs and records of past sign-in sessions and of the email links we sent you (sign-in, confirmation and password-reset links), which contain IP addresses, browser or device details and, for some events, email addresses;
• the record of your text-message consent (the time and wording you agreed to);
• your notification settings, invitations you sent (including the invitee's email address) and the name of your team account, which may be your name or email address;
• alerts and tasks that are not linked to one of your buildings;
• invitations that other accounts sent to your email address, and the record that you accepted them;
• records of the alerts we delivered to you as a member of another customer's team account;
• notes you wrote in another customer's account, which belong to that account, and references to your erased account record in that account, for example on buildings or tickets that were assigned to you;
• our record of your subscription, including your Stripe customer and subscription identifiers; and
• the customer record Stripe keeps under its own retention policy, which includes your email address.

We keep this information for security, fraud prevention, accounting and legal purposes. We do not yet delete it automatically on a fixed schedule. You can ask us to delete it, and we will unless we need to keep it for one of those purposes.

Backups and logs

We back up our database every night. Copies on our server are deleted after 7 days, server disk snapshots after 14 days, and encrypted off-server copies after up to 400 days. Information you delete stays in these backups until they expire. We use backups only to recover from failures. Server logs are rotated automatically: older entries on our server are overwritten once the log files reach a fixed size, and logs kept in our log service (Amazon CloudWatch, part of AWS) are deleted after 90 days.

9. Security

We protect information with measures that include:

• encryption in transit (HTTPS) between your device or browser and our servers;
• passwords stored only as argon2id hashes, and sign-in, session and invitation tokens stored only as hashes;
• email confirmation before password sign-in, rate limits, and a temporary pause on sign-in after repeated failed attempts;
• a database on a private network with no internet access, with row-level security so each person can reach only their own data and what their team shares with them, and separate restricted database access for each part of the system;
• secrets kept in a managed secrets store, hardened servers with automatic security updates and key-only administrative access; and
• encryption of backups stored off our server.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a breach of security affecting your personal information, we will notify you and the authorities as required by law.

10. Your choices and rights

See and correct your information

You can view and change your name and mobile number in the iOS app (Account) and in the web app (Settings). To change your email address, or to get a copy of the personal information we hold about you, email us.

Notifications

• Push notifications: turn them off in the iOS app (Account > Notifications) or in your iPhone's Settings > Notifications > ViolationNow.
• Alert emails: turn them off in your notification settings. Every alert email links to them. Account emails (email confirmations, sign-in links, password resets and team invitations) are part of the Service and cannot be turned off.
• Text alerts: turn them off in your notification settings, or reply STOP to any of our texts. When you reply STOP, our text provider stops delivering our texts to that number; reply START to receive them again. Your ViolationNow settings may still show text alerts as on until you turn them off there. You can also email us and ask us to stop texting you, and we will turn text alerts off for you.

Delete your account

In the iOS app, go to Account > Delete account and confirm with your password. You can also email us from the email address on your account and ask us to delete it. Section 8 explains what deletion removes and what we keep.

Withdraw consent

You can withdraw consent to text messages or push notifications at any time as described above. Withdrawing consent does not affect messages sent before you withdrew it.

How we handle requests

Send requests to support@violationnow.com. To protect your account, we verify requests by asking you to write from the email address on your account and, if needed, for information that confirms the account is yours. We respond within 45 days, or sooner if the law requires.

11. US state privacy rights

California

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), gives you additional rights. This section is our notice at collection and describes our practices during the past 12 months.

Sources: you, your devices, your team members, Stripe and public City records. Purposes: those in section 3. Retention: as described in section 8.

We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16. We use sensitive personal information only to provide the Service and keep it secure, so the right to limit its use does not apply.

You have the right to know what personal information we collect, use and disclose and to get a copy of it; to correct inaccurate information; to delete information we collected from you, subject to legal exceptions; and not to be discriminated against for exercising these rights. You can use an authorized agent, who must give us your signed permission; we may still ask you to confirm your identity with us directly. To make a request, email support@violationnow.com.

California's "Shine the Light" law: we do not disclose personal information to third parties for their own direct marketing purposes.

Other states

Residents of other states with consumer privacy laws may have similar rights, such as the right to access, correct, delete or get a copy of personal data and to opt out of targeted advertising, sale or profiling. We do not engage in targeted advertising, sale of personal data or profiling. To make a request, email us. If we decline your request, you can appeal by replying to our decision with "Appeal" in the subject line, and we will respond within the time the law requires.

New York

We maintain administrative, technical and physical safeguards for New York residents' private information as required by the New York SHIELD Act, and we will give breach notifications as New York law requires.

12. Children

The Service is for adults who manage buildings. You must be at least 18 to use it. It is not directed to children, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, email us and we will delete it.

13. Users outside the United States

The Service is about New York City buildings and is intended for users in the United States. We store and process information in the United States. If you use the Service from another country, your information will be transferred to and processed in the United States, where data protection laws may differ from those where you live.

14. Changes to this policy

We may update this policy. We will post the new version on this page with a new effective date. If a change is material, we will tell you by email before it takes effect.

15. Contact us

Questions or requests about privacy:

Sam Guardians Corp
160 E 46th St
Brooklyn, NY 11203
United States
Email: support@violationnow.com