Jerk AlertPrivacy Policy
Jerk Alert is run by Jerk Alert LLC, a New Mexico limited liability company ("Jerk Alert", "we", "us"). This policy covers the Jerk Alert mobile app and the website at jerkalert.org. Questions: support@jerkalert.org.
The short version
- The app is free and carries no ads. There are no advertising SDKs and no third-party trackers in it.
- We never sell or rent your data, and we don't share it for advertising.
- We ask for a phone number to keep one person from posting a hundred fake Alerts. It is never shown to other users.
- Location works two ways. The place you pick for an Alert is part of that Alert: it is attached to it and it is public. Your device's own position is separate — it is approximate, optional, and if you turn on nearby-Alert notifications we store the latest fix so we know what counts as near you. We keep no history of where you've been, and your device's position is never used as an Alert's location.
- You can delete your account from inside the app, or from this page, without emailing anyone.
Read the Terms of Service too
This policy covers your data. What you may and may not do on Jerk Alert lives in the Terms of Service, which every account accepts at sign-up. The Terms prohibit using Jerk Alert to stalk, harass, threaten, intimidate, or dox anyone, prohibit identifying a person by name, address, phone number, workplace, or social account, and prohibit knowingly false reports. Accounts that break those rules are removed. If you only read one other page, read that one: jerkalert.org/legal/terms.
What we collect
Information you give us
- Phone number — required to create an account. Used for one-time verification codes and account recovery only. We do not keep the number itself: it is converted to a keyed one-way hash (HMAC-SHA256) the moment you sign in, and only that hash is stored. It is never displayed publicly and never used for marketing.
- Alerts and Tips of the Hat you post — the license plate and state you enter, the location you choose from our list, the category you tap, the Jerk Level you set, and the timestamp. Reports contain no free-text field and no photo attachment.
- Votes and flags — whether you found an Alert helpful, and any content you report to us.
Information collected automatically
- Server logs — IP address and request time, kept briefly to enforce rate limits and block abuse.
- A fingerprint of your network connection — when you post an Alert or an award we store a scrambled, one-way fingerprint of your internet connection alongside it. It is not an IP address and cannot be turned back into one. We use it for one thing: enforcing the posting limits, so that one person cannot report the same plate over and over by signing out or opening a private window. It is kept for as long as the Alert exists.
- Push token and notification area — a device identifier issued by Google or Apple, together with your device's latest approximate position and the radius you chose, so we can tell which new Alerts are near you. Stored only if you turn notifications on, and deleted when you turn them off or delete your account.
Location
Two different things get called location here, and they are not the same thing.
The location on an Alert is a street, corner, or place you choose from our list. It is part of the report: it is attached to the Alert and shown publicly — on the map, on the Alert card, and on that plate's page. It is not your device's position. If you post without choosing a place, the Alert is placed at the middle of the plate's state, never at you.
Your device's position is read only if you grant permission, and only while the app is open. The app asks your operating system for an approximate fix, not a precise one, and uses it to center the map and sort Alerts by distance. If you turn on nearby-Alert notifications, that approximate fix is stored on our servers next to your push token and your chosen radius, so we can work out which new Alerts are near you; each new fix replaces the previous one, so no history is kept, and turning notifications off or deleting your account deletes it. We never read your position in the background, and it is never published or attached to an Alert. You can revoke the permission at any time in your device settings and keep using the app by choosing a city manually.
What we do with it
- Run the service: show Alerts near you, let you post, endorse, and flag.
- Verify accounts and prevent abuse, spam, and ballot-stuffing.
- Send notifications you asked for (new Alerts near you, activity on your Alerts).
- Enforce our Terms — reviewing flagged content, hiding or removing content, and banning accounts.
We do not use your information to build advertising profiles, and we do not run behavioral analytics across other apps or websites. The app contains no analytics or crash-reporting software: we do not collect your device model, your operating system version, or crash diagnostics, and we cannot see how you use the app.
Who we share it with
Only the service providers needed to make the app work, and only for that purpose:
- Firebase Authentication — sends your one-time verification code (receives your phone number).
- Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS) — deliver push notifications (receive your push token and the notification text).
- Resend — delivers our email: Track This Plate confirmations, watch digests, and unsubscribe links (receives your email address and the contents of the message).
- Our hosting provider — stores the database on our behalf.
- Google Forms (pre-launch only) — collects the email address you type into the launch countdown page on jerkalert.org, so we can send you one email when the app goes live (receives your email address). Nothing else on the website and nothing in the app uses it.
- OpenStreetMap — serves the map imagery, and answers place lookups when you search for a street, city or corner (receives your IP address, the map area being viewed, and the place text you type).
- Public Overpass mirrors (kumi.systems, overpass-api.de, private.coffee) — find the exact corner where two named streets meet, and freeway exits, in OpenStreetMap data (receive your IP address, the street or highway names you type, and the area being searched).
- Mapbox (website only) — suggests street names as you type in the location picker (receives your IP address and the text you type). The mobile app does not use it; its lookups go through our own server instead.
We may also disclose information if we are legally required to, or where it is necessary to protect someone's safety or investigate a violation of our Terms. If Jerk Alert LLC is ever sold, account data may transfer with it; you'll be told before that happens.
We do not sell personal information and we do not share it for cross-context behavioral advertising.
Public content
Alerts, Tips of the Hat, plate/state, category, Jerk Level, chosen location, your display name, and vote counts are public — visible in the app, on jerkalert.org, and to search engines. Treat anything you post as permanently public: copies may persist in caches or screenshots after removal.
License plates
A plate is a vehicle identifier, not a person. We do not link plates to owner records, we do not run lookups against DMV or commercial databases, and we never display a poster's phone number. If you believe content about your vehicle is false, harassing, or violates our Terms, email support@jerkalert.org. We aim to review removal requests within 5 business days, with priority given to claims of harassment or safety risks — say so in your message and we move it to the front of the queue.
Email addresses (Track This Plate)
If you ask us to track a plate, we store the email address you typed, the plate you asked about, and how often you want to hear from us. Nothing else. We send one confirmation email first and send nothing further until you click the link in it. Every email carries a one-click unsubscribe link that deletes the address on the spot. We never sell, rent, or share these addresses, and we never use them for anything except the plate you asked about.
Separately, before the app launches, the countdown page on jerkalert.org collects email addresses through a Google Form for the early list. Those addresses receive one email, on launch day, and are not used for anything else.
How long we keep things
- Account data — until you delete your account.
- Alerts — until you delete them, or until we remove them for a Terms violation. A deleted Alert leaves the app straight away; we keep a copy for 30 days so a moderator can undo an accidental deletion and review abuse, and then it is erased.
- Server logs — about 30 days.
- Alerts posted without a verified phone number — 120 days, then erased for good, along with the network fingerprint stored with them. A plate's Erk Meter drops accordingly as they age out.
- Network fingerprints — for as long as the Alert they were stored with. They are one-way and are never turned back into an IP address.
- Verification codes — minutes; they expire on use.
- Ban records — a minimal record is kept after deletion so banned users can't immediately re-register.
Deleting your account
In the app: You → Settings → Delete account. On the web: jerkalert.org/legal/delete-account. Deletion removes your account record, phone number, display name, push tokens, and votes. Alerts you posted are anonymized — the community safety record stays, your identity does not. If you'd rather have your Alerts deleted outright, say so in the request and we'll do that too. Deletion is permanent and completes within 30 days (usually immediately).
Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to be free of discrimination for asking. Use the in-app controls, or email support@jerkalert.org and we'll respond within 45 days. We may need to verify your request through your account's phone number. If you are in California or the EU/UK, see State-Specific Rights at the bottom of this page.
Security
Traffic is encrypted in transit (HTTPS). Phone numbers are stored only as a keyed one-way hash (HMAC-SHA256) — there is no column anywhere in our database that holds a phone number in readable form, and the key is held outside the database, so a stolen copy of the database does not reveal anyone's number. Access to the database is limited to what's needed to operate the service, and we take nightly backups. No system is perfect; if a breach affects you, we'll notify you as required by law.
Age
Jerk Alert is for adults — 18 and over. It is not directed at children, and we don't knowingly collect information from anyone under 18. If we learn that an account belongs to a minor, we delete it. Contact support@jerkalert.org if you believe a minor has created an account. If you are a parent or guardian and believe your minor child has provided us with personal information, please contact us at support@jerkalert.org to request deletion.
Where your data lives
Our servers are in the United States. If you use Jerk Alert from elsewhere, you're sending your information to the U.S., where privacy law differs from your own.
State-Specific Rights
The rights above apply to everyone. Some places give you extra ones. Nothing in this section changes what we collect or what we do with it — it spells out the rights the law gives you in your jurisdiction and how to use them. In every case the route is the same: the in-app controls, or support@jerkalert.org.
California (CCPA/CPRA)
In the past 12 months we collected these categories of personal information: identifiers (a one-way hash of your phone number, a push token, an email address if you asked us to track a plate), internet activity (IP address in server logs, a one-way fingerprint of your connection), approximate geolocation (only if you turned on nearby-Alert notifications), and the content you posted. Sources: you, and your device. Purposes: running the service, verifying accounts, preventing abuse, and sending notifications you asked for. We disclose it only to the service providers listed under Who we share it with, for those purposes.
- We do not sell personal information and we do not share it for cross-context behavioral advertising — including for anyone we know to be under 16. There is no "Do Not Sell or Share My Personal Information" link because there is nothing to opt out of.
- You may request to know what we hold, delete it, correct it, and receive a portable copy. We do not use or disclose sensitive personal information beyond what is needed to provide the service, so no limitation right applies.
- We will not discriminate against you for exercising these rights: no loss of access, no different pricing (the app is free).
- An authorized agent may act for you with written permission; we will still verify your identity through your account's phone number.
- We confirm receipt within 10 business days and respond within 45 days (extendable once by 45 days, with notice).
Residents of other U.S. states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Montana — have substantially the same rights of access, correction, deletion, portability and opt-out, and may use the same contact route. Where your state provides an appeal, you may appeal a refused request by replying to our response; we will answer within the period your state's law allows.
European Union, EEA, United Kingdom and Switzerland (GDPR/UK GDPR)
Controller: Jerk Alert LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, USA — support@jerkalert.org.
Legal bases. Providing your account and the service, and enforcing our Terms, rests on contract (Art. 6(1)(b)). Phone verification, rate limiting, the connection fingerprint and abuse prevention rest on our legitimate interests in keeping the record honest and the service usable (Art. 6(1)(f)). Push notifications, device position and Track This Plate emails rest on your consent (Art. 6(1)(a)), which you can withdraw at any time in your device settings, in the app, or via the unsubscribe link. Disclosures required by law rest on legal obligation (Art. 6(1)(c)).
- You have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests.
- You may withdraw consent at any time; withdrawal does not affect processing already carried out.
- There is no automated decision-making with legal or similarly significant effects, and no profiling for advertising. A plate's Erk Meter is a published arithmetic score of public Alerts, not a decision about a person.
- International transfers. Our servers are in the United States. Where we transfer personal data out of the EEA, UK or Switzerland we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) together with the safeguards described under Security.
- You may lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office. We'd rather you told us first: support@jerkalert.org.
We answer GDPR requests within one month, extendable by two further months for complex requests, with notice.
Changes
If we change this policy in a way that matters, we'll update the date at the top and tell you in the app before the change takes effect. Continuing to use Jerk Alert after that means you accept the new policy.
Contact
Jerk Alert LLC · New Mexico, USA · support@jerkalert.org · 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, USA