Privacy Policy

Operator: Credit Smack · Site: creditsmack.app

Last updated: August 28, 2026 (supersedes the May 31, 2026 version — see "What changed")

Who this covers

Credit Smack is software for credit-repair business owners ("Operators"), not for consumers directly. Three data flows exist:

The website + enrollment (creditsmack.app, /enroll): we collect information from Operators who are interested in the education product, and from Operators who create an account.
The dispute tool (/app, /deposit-disputes, /occ-complaints, /offline): the Operator inputs their own clients' personal information to generate dispute letters and, optionally, to track the dispute over its rounds and mail the letters. For that data, the Operator is the data controller; Credit Smack provides the processing tool and, where the Operator chooses to keep a file, the storage.
Client intake links: an Operator may send their client a one-time link through which the client submits their own identity details, documents and (optionally) third-party portal logins directly to the Operator's file. The client sees and signs an authorization before submitting; the Operator controls that file.

The /offline generator runs entirely in the browser and sends nothing to our servers.

What we collect

From Operators (website, enrollment, accounts):

Email address, and optionally name and business name (via /enroll), the pricing tier you asked about, the IP address and time of the request.
For an account: your email, a one-way hash of your password (never the password), your business name, your membership entitlement, and — if you connect one — your MyFreeScoreNow affiliate credential (encrypted).
Standard server logs (IP address, timestamps, route) for security and rate-limiting. Logs never contain client data.

Client data processed by the tool (controlled by the Operator):

Consumer name, address, SSN, date of birth, email/phone where given, and credit-report / deposit-account data (accounts, balances, statuses, inquiries).
Uploaded identification documents (e.g. SSN card, driver's license, proof of address) and, where supplied, an FTC identity-theft report or police report.
Through a client intake link, additionally: the client's parsed credit report (pulled from MyFreeScoreNow with the client's own login, if they provide it), that MyFreeScoreNow login itself, and — only if the client chooses to give them — CFPB portal login details.

Identification images are attached only to consumer-reporting-agency letters, never to creditor/furnisher letters. A MyFreeScoreNow login a client provides is kept encrypted, under the authorization the client signs, so the Operator can refresh the client's report while the file is open; it is removed when the client asks, when the Operator deletes it, or with the file.

How we use it

Operator data: to respond to enrollment, run your account and membership, send the requested information, and (if you opt in) add you to our email list.
Client data: solely to generate the dispute documents the Operator requested, to keep the Operator's case file if they choose to track a dispute, and to mail letters if the Operator chooses mailing. We do not sell it, do not use it for advertising, and do not use it to train models.

What we store, and for how long

Letter generation itself is stateless. The data sent with a generation request lives in a private per-request temporary directory that is deleted after the response, and the letters come back to the Operator as PDFs.

Beyond that request, the following records are kept on our infrastructure. Every record holding consumer data is encrypted at rest (AES-256-GCM, with keys held in a managed secrets store and bound to the Operator's configuration, so one Operator's records cannot be read under another's).

Tracked dispute case — kept by default when a signed-in Operator generates a package (tracking can be turned off per package). Holds the consumer's identity including SSN as one sealed record, the furnisher names and bureaus disputed, and the round schedule and outcomes. Ends when the Operator deletes it from /cases, or under the retention schedule below.
Case documents — kept with a tracked case. Holds the identification documents uploaded for that package. Deleted with the case, or under the retention schedule.
Client intake file — kept when an Operator uses an intake link. Holds everything the client submitted: identity, SSN/DOB, ID images, parsed credit report, MyFreeScoreNow login if given, CFPB portal login if given, and the signed authorization. Ends when the Operator deletes it from /admin, or under the retention schedule.
Operator account — kept when you create one. Holds your email, password hash, business name, entitlement, and encrypted affiliate credential. Deleted on request, or by the Operator's administrator.
Enrollment leads — kept when you submit /enroll. Holds email, name, business, tier, IP address, and timestamp. Deleted on request, or under the retention schedule.
Mailing records — kept when the Operator mails a letter. Holds the letter type, the bureau or recipient, the carrier tracking number, cost, status, and the Operator's email — no consumer data. Kept for the Operator's mailing history.
Usage counters, sessions, rate-limit state — always. Counts, session identifiers, hashed keys — no consumer data. Expire automatically.

Retention schedule. Tracked cases, case documents, intake files and enrollment leads are scheduled for automatic disposal 730 days (two years) after they are created — the storage platform's expiry process removes them on its next pass after that date — unless the Operator deletes them sooner. Operators are responsible for deleting a client's file when they no longer need it for the purpose it was collected.

Generated packages the Operator downloads live on the Operator's own device under the Operator's control.

Third parties / sub-processors

Google Cloud (Cloud Run, Firestore, Secret Manager; United States) — hosts the application and stores the records above, encrypted at rest as described.
Anthropic (Claude API) — AI letter drafting, only if the Operator enables it. Receives the letter prompts, which include the consumer data above including SSN/DOB. If AI is not enabled, a template engine drafts the letters and no client data goes to any AI provider.
OpenAI / Google (Gemini) — AI letter drafting when the Operator supplies their own API key (bring-your-own-key). Receives the same letter prompts; the Operator's key is used for the request and never stored.
Lob — printing and posting letters, only if the Operator uses mailing. Receives the letter PDF and its addresses, i.e. the consumer's name and address and whatever the letter contains (bureau letters include the SSN).
MyFreeScoreNow — credit-report import, only if the Operator or client uses it. Receives the client's MyFreeScoreNow login each time a report is pulled or refreshed, or the Operator's affiliate credential. A client's login is stored encrypted in their intake file under their signed authorization (an arrangement MyFreeScoreNow agreed to on August 28, 2026); clients who enrolled through the Operator's link provide no password at all.
Preferred Payments (eCrypt) — card payments for mailing credits. The Operator's card details are entered in the processor's own hosted form; we receive only a payment token and the result.
Resend — transactional email and the enrollment list. Receives Operator email addresses and names only — no client data.
Sentry — error reporting. Receives technical error details with personal data removed before sending; no request bodies.
Public regulator data (CFPB, FDIC, OCC, NCUA) — used to look up furnisher and institution details. Receives the furnisher's name only — never consumer data.

No other third parties receive client data. Letters are addressed to the credit bureaus / CRAs / creditors the Operator chooses, and are mailed only when the Operator asks us to.

Your choices

Operators may delete a tracked case (/cases) or an intake file (/admin) at any time, and may request access to or deletion of their account and enrollment data at privacy@creditsmack.app.
A consumer whose data was entered by an Operator should direct access or deletion requests to that Operator, who controls the file; we will assist the Operator in honoring them.
Operators are responsible for honoring their own clients' privacy rights and for having a lawful basis (and, for intake links, the client's authorization) to process their clients' data through the tool.

Security

Data in transit is encrypted (HTTPS). Records holding consumer data are encrypted at rest as described above; identification documents are served only as downloads that are never cached, and are never shown in a listing. Per-request temp files holding PII are written to private directories and deleted after use. Access to a record is limited to the Operator who created it. Third-party portal logins that a client chooses to provide are encrypted and are usable only with the second factor that goes to the client. No security is perfect; do not transmit data you are not authorized to process.

What changed

The May 31, 2026 version described the tool as stateless with no client data retained. That was accurate for letter generation, and still is, but it did not describe the case tracking, case documents and client intake features that keep an Operator's file between rounds, nor the mailing, report-import and payment providers those features use. This version does. It also records a change of practice on the same date: a MyFreeScoreNow login a client provides through an intake link is now kept, encrypted, under the client's signed authorization, where previously it was discarded after a single report pull.

Children

Not directed to anyone under 18.

Contact

privacy@creditsmack.app