Legal
Privacy Policy
The short version
- ProofLet stores your properties, certificates and evidence photos on your device. You do not need an account to use it.
- If you subscribe to Pro and turn on cloud backup, a copy of that data is stored on our servers so you can restore it on another phone or open it on a laptop at portal.prooflet.co.uk. The copy is encrypted in transit and at rest by Cloudflare. We can access it to run the service. You sign in with a one-time code sent to your email address.
- For tenants’, contractors’ and other third parties’ personal data in that backup (and in your ProofLet inbox), you are the controller and ProofLet is your processor. See the Data Processing Addendum.
- Certificate scanning (OCR) runs on your device. Photos are not uploaded for text recognition.
- We do not run advertising or third-party analytics SDKs in the app.
- Subscriptions are processed by Apple or Google. We never see your card details.
- Uninstalling the app removes the copy on that phone. To delete a cloud backup, use Settings → Delete account, or email support@prooflet.co.uk from the address you signed in with. A Pro subscription is cancelled separately in the App Store or Play Store.
Who we are
ProofLet is built and run by one person: Joshua Mason, an independent developer based in the United Kingdom, trading as ProofLet (“I”, “we”, “us”).
ICO registration: ZC243782.
Contact address: Unit 82701, PO Box 92, Cardiff, CF11 1NB, United Kingdom.
Contact: support@prooflet.co.uk.
Controllers and processors
| Data | Who decides why it is processed | ProofLet’s role |
|---|---|---|
| Your sign-in email, sessions, Pro entitlement, App Check tokens, support mail you send us | ProofLet | Controller |
| Tenant names/emails you enter, property addresses, certificate records, evidence photos, inbound contractor email and attachments | You (the landlord) | Processor when cloud backup is on — see the DPA |
| Purchase receipts and store billing | Apple / Google (and RevenueCat for entitlement checks) | We receive entitlement status only |
If you put someone else’s personal data into ProofLet, you need a lawful basis to do so. We do not contact your tenants.
What data the app handles
| Data | Where it lives | Purpose |
|---|---|---|
| Property details (address or nickname, tracked certificate types, optional tenant name or email) | Your device; our servers if cloud backup is on | Building your compliance checklist and proof packs |
| Certificate records (type, issuer, reference, issue and expiry dates, tenant-served flag) | Your device; our servers if cloud backup is on | Status, reminders and proof packs |
| Evidence photos and documents | Your device; our servers if cloud backup is on | Keeping proof alongside each certificate |
| Unique email-in address | Our servers, only if you turn on Pro cloud backup | Receiving certificate files sent to your inbox |
| Inbound email attachments (PDF or images) sent to that address | Our servers (EU R2) until you file or discard them | Letting contractors email certificates into ProofLet |
| Email address | Our servers, only if you sign in for cloud backup | Sending one-time sign-in code emails, identifying your backup, sending expiry reminder emails if you leave that on, and notifying you when a document arrives in your inbox |
| Reminder settings and notification schedule | Your device; email opt-out on our servers if cloud backup is on | Local expiry reminders (Pro) and optional email reminders |
| Subscription status | RevenueCat and the app store you use | Unlocking Pro features |
| App integrity tokens | Generated on your device by Apple or Google; verified by our servers | Stopping modified copies of the app from calling our API |
Tenant name and email are optional. They are stored only if you enter them, and they sync with cloud backup when that is on.
Cloud backup (Pro)
Cloud backup is optional and off by default. When you switch it on:
- We send a one-time sign-in code to the email address you enter. The code expires after 10 minutes and can only be used once. We store a keyed hash of the code, not the code itself, and a session token so the app stays signed in.
- Your properties, certificates and evidence files are uploaded to our servers so they can be restored on any device where you sign in with the same email, including the Pro web portal at portal.prooflet.co.uk.
- Data is encrypted in transit (TLS) and at rest by Cloudflare. This is platform encryption, not a lock only you can open: we can access backed-up records to operate the service. Sign-in and tenant emails are encrypted at application level. Property and certificate fields in the backup are stored so the service can sync and render them — they are not end-to-end encrypted.
- Our infrastructure is provided by Cloudflare, Inc. (Workers, D1 database and R2 object storage). Cloudflare processes data on our behalf under its data processing terms. Backed-up data is stored in the European Union.
- Sign-in emails are sent via Cloudflare’s email sending service from
login@prooflet.co.uk. - If you keep Pro and cloud backup on, we give you a unique inbox address (
{token}@inbox.prooflet.co.uk). Anyone who knows that address can email PDF or image attachments to it. We store the sender address, subject, and accepted files so you can file them onto a property in the app. We do not run OCR or otherwise read the contents of those files on our servers. You can rotate the address in Settings; the old one then stops accepting mail. Pending inbox files are deleted when you discard them or delete your account; filed items may keep metadata until account deletion. - Processor terms for tenant and contractor data are in the Data Processing Addendum.
You can turn cloud backup off at any time in Settings. Delete account in Settings wipes this phone and, if you are signed in, the cloud copy — but only after the cloud wipe succeeds. If the cloud request fails, nothing is removed so you can retry. You can also email support@prooflet.co.uk from the address you signed in with.
On-device storage
The copy on your phone (JSON library and evidence files) is protected by your device lock and OS storage, not by an extra app-level database password. If the phone is lost and unlocked, that copy can be read. Use a device passcode or biometrics, and use Delete account before handing a phone on.
Your phone’s own backup (Google backup on Android, iCloud or device backup on iOS) may include this on-device copy, as it does for most apps. That backup is controlled by your Google or Apple account settings, and is separate from ProofLet’s cloud backup. Delete account removes the copy on your phone and in ProofLet’s cloud, but not copies already held in your own phone backup, which you can remove in your device or account settings.
Scanning certificates
The camera and OCR features use on-device text recognition (Google ML Kit, running locally). Images are processed on your phone and are only stored where you choose, on device or in your cloud backup. Nothing is sent to Google for recognition.
Purchases
Pro subscriptions are sold through the Apple App Store and Google Play. Apple or Google handle payment and hold your billing details. We use RevenueCat to check whether your subscription is active. RevenueCat receives an anonymous app user ID and purchase receipt data from the store; it does not receive your name, email or certificate data from us. See RevenueCat’s privacy policy for details.
App integrity
To stop modified copies of the app calling our API, the iOS and Android apps use Firebase App Check. On Android that uses Google Play Integrity; on iOS it uses Apple App Attest, with DeviceCheck as a fallback. Those services issue a short-lived token on the device. Our servers (and Firebase) verify it. The tokens are not used for advertising, analytics, or identifying you.
Firebase App Check runs in Google Firebase project app-notification-service-b8685, which we also use for other apps we operate. App Check configuration (debug tokens, attested app IDs) is shared at that project level. The ProofLet API still only accepts tokens for this app’s iOS, Android, and web app IDs.
The web portal at portal.prooflet.co.uk uses Firebase App Check with Google reCAPTCHA Enterprise. The site key is public (it has to live in the browser). Google scores the page load; our servers check the resulting App Check token on each API call, the same way the phone apps are checked.
Notifications
Expiry reminders are scheduled locally on your device. We do not use a push notification server for those, so we cannot see when or whether a local reminder was delivered.
If you are on Pro and turn on cloud backup, we also send email reminders at 90, 60, 30, 14, 7 and 0 days before each expiry, from our servers (currently login@prooflet.co.uk). You can turn email reminders off in Settings. We send them because you asked for the Pro reminder service (contract), not for marketing.
Analytics and tracking
The app does not include third-party analytics, advertising or crash-reporting SDKs. Our servers keep short-lived technical logs (request paths, timestamps, status codes) to operate the service and investigate faults.
This website does not use cookies or analytics.
Legal bases
Where UK GDPR applies and ProofLet is the controller (your account email, security, support):
- Contract — providing cloud backup and Pro features you have asked for.
- Legitimate interests — keeping the service secure, preventing abuse, and responding to support requests.
Where ProofLet is the processor of tenant and contractor data, you determine the lawful basis for collecting and using that data. Our processing is on your instructions under the DPA.
Retention
- Data on your device stays until you delete a property, use Settings → Delete account, or uninstall the app.
- Deleting a property removes its live details from the device and, when synced, from the cloud backup. A short id-only tombstone may remain so another device does not resurrect it.
- Backed-up live data is kept while your account exists. Cloudflare D1 may keep a restore point of the database for up to 30 days. Delete account removes the live copy when the cloud request succeeds.
- Sign-in codes expire after 10 minutes; sessions expire after a period of inactivity.
- Server logs are held in Cloudflare’s Workers Logs for a short rolling window (currently no more than 7 days) and are not exported elsewhere.
- Email support@prooflet.co.uk and we will action a deletion request within 30 days.
Your rights
You can access, correct, export or delete your data. On-device data can be edited or deleted directly in the app.
To delete the cloud copy and the email account we use for sign-in, use Settings → Delete account, or email support@prooflet.co.uk from the address you signed in with. We will action a deletion request within 30 days.
If someone whose details you stored contacts us about their data, we will direct them to you as controller where that is appropriate, and help you remove cloud copies we hold as processor.
A Pro subscription is billed by Apple or Google. Deleting your ProofLet data does not cancel that subscription; manage or cancel it in your store account.
You also have the right to object to processing, to restrict processing, and to complain to the Information Commissioner’s Office (ico.org.uk) about processing where ProofLet is the controller.
Children
ProofLet is a tool for landlords and letting professionals and is not intended for anyone under 18.
International transfers
Backed-up records and evidence files are stored in the European Union. Cloudflare may still process requests from other regions to serve the API. Where data is processed outside the UK, transfers are protected by UK-approved safeguards such as the International Data Transfer Agreement or Addendum.
Changes
We will update this page when our practices change and update the date at the top. Material changes will be flagged in the app.