ScopeLockPrivacy Policy
Last updated: October 22, 2026
ScopeLock helps freelancers record agreed work and get clients’ decisions on changes. We collect only what that needs, we don’t sell or share personal information for advertising, and the app has no analytics or tracking tools.
Who we are
ScopeLock (“ScopeLock”, “we”, “us”) is based in Ontario, Canada. Our privacy officer is responsible for this policy and can be reached at privacy@scopelock.ca.
This policy covers the ScopeLock iPhone app, the client approval pages we host, and this website.
Information we collect
If you use the app
- Account: your email address and a password (stored only as a secure hash), or your Sign in with Apple identifier. If you use Sign in with Apple, you can choose to hide your email address.
- Profile: your name, business name, default currency and, if you add one, your hourly rate.
- Your work: the clients, projects, scopes, change orders, revision logs, billing records (amounts you record as invoiced or paid) and documents you add.
- Subscriptions: if you buy a plan, the App Store transaction details Apple sends us to confirm it. We never receive your card details.
- Notifications: if you allow them, a device token so we can tell you when a client responds.
About your clients
You may add your clients’ names, company names, email addresses and notes. You decide what to add and are responsible for having the right to share it with us. We use it only to provide ScopeLock to you.
If you’re a client opening an approval link
When you respond to a change order, we record your decision, the name you type, any message you write, and the time. We do not store your IP address or browser details with your decision. Our hosting provider may briefly process your IP address to protect the page from abuse (rate limiting).
On this website
This website uses no cookies, analytics or third-party scripts.
How we use it
- To run the service: sign you in, store and sync your data, show change orders to your clients, and record their decisions.
- To keep it secure: prevent abuse, investigate problems and protect accounts.
- To provide plans you buy and answer you when you contact us.
We don’t use your data for advertising, sell it, or use it to train AI models.
Who processes it
We use a small number of service providers, bound by contract to protect your information and use it only for us:
- Supabase: database, sign-in and file storage.
- Cloudflare: hosting for the client approval pages and this website.
- Apple: Sign in with Apple, App Store purchases and push notifications.
Your information may be stored and processed in Canada or the United States. When it is outside Canada, it may be accessible to authorities there under local law.
Your client sees your business name and the change order you sent, nothing else about you. We disclose information to others only if required by law.
How long we keep it
| Information | Kept for |
|---|---|
| Your account and everything in it | Until you delete your account, then deleted immediately |
| Locked scopes, change orders and client decisions | The life of your account: they are your record of what was agreed |
| Documents you delete | File removed within 24 hours; a note that it existed stays in the project history |
| Data export files | 24 hours |
| Sync records | 30 days |
| App Store notifications | 1 year |
Encrypted backups are kept for a limited period and then deleted automatically, so deleted data disappears from backups once that period ends.
Your choices and rights
- Access and export: Settings → Export my data gives you a copy of everything in your account, on every plan.
- Correction: edit your profile and records in the app, or ask us.
- Deletion: Settings → Delete account removes your account and its data immediately.
- Notifications: turn them off at any time in iOS Settings.
You can also ask us about the information we hold about you, or withdraw consent, by emailing privacy@scopelock.ca. We’ll reply within 30 days. If you’re a client of a ScopeLock user, you may also contact the freelancer who sent you the link.
If you’re not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
Security
Data is encrypted in transit and at rest. Approval links are long random codes; we store only a fingerprint of each one, and they expire and can be cancelled. Documents are private and shown only to you. No method is perfectly secure, so we also keep what we hold to a minimum.
Children
ScopeLock is a tool for businesses and isn’t intended for anyone under 16.
Changes
If we change this policy, we’ll update the date above and, for significant changes, tell you in the app before they apply.