Privacy Policy

1. Who we are

This Privacy Policy describes how DisputeGoat (“DisputeGoat,” “we,” “us,” or “our”) collects, stores, uses, and discloses information when you visit disputegoat.com and use our software workspace. DisputeGoat is a self-service software workspace that helps consumers review their own credit report data and prepare their own written consumer letters under their rights in Section 611 of the Fair Credit Reporting Act. DisputeGoat is not a credit repair organization, a law firm, a credit counselor, or a financial advisor. We do not promise any change to your credit score or the removal of any item from your report.

DisputeGoat’s software is built and operated by Goat Monitoring LLC, Attn: Business & Legal Affairs, 3741 Merced Drive, Suite G2, Riverside, CA 92503. Credit monitoring, enrollment, and billing are handled under the separate Goat Monitoring membership program at goatmonitoring.com. This policy covers only the DisputeGoat software workspace; the privacy policy presented to you during Goat Monitoring enrollment governs the enrollment, billing, and credit-monitoring side of the relationship.

2. Information we collect

(a) Account information

• The email address and password (or sign-in method) you use to create your DisputeGoat account.
• Your name and mailing address, if you enter them into the “Your info” form for letter headers.

(b) Your Goat Monitoring connection

When you link your Goat Monitoring account inside DisputeGoat, we collect:

• The email address of your Goat Monitoring account.
• A derived access credential, not your password. Our server computes a one-way cryptographic hash of your Goat Monitoring password combined with a secret value we control, and stores only that hash. Your actual password is never written to our database, our logs, or any file, and it is not recoverable from the stored hash. We use the stored hash the same way a password would be used, to retrieve your report data through Goat Monitoring's pull interface on your behalf, until you unlink the connection (Section 4).
• The connection status Goat Monitoring reports back (for example, active, pending verification, or a payment or account problem) and the date it was last checked.

(c) Your credit report data

Once your connection is active, our pull worker retrieves your credit report data from Goat Monitoring's data source on a schedule and stores it so the app can display it to you. This includes:

• The report as returned by the data source (tradelines, inquiries, public records, and related detail), including the identifying information it contains: your name and any name variations, current and past addresses, employers, and your birth year. Before we store the report, we mask any Social Security Number in it and cut your date of birth down to the year.
• A summarized version of the same report (scores, counts of accounts and negative items) used to render lists and timelines quickly.

We keep a history of these pulls rather than only the latest one. Our retention default is the newest three report pulls per member; older pulls are deleted automatically. See Section 8.

(d) Disputes and letters

• The items you choose to dispute, the bureaus and strategy you select, and the status updates you record (mailed, resolved, rejected, notes).
• The content of each letter you generate, including your edits, saved as a permanent record once created. Letters are not editable after creation so your dispute history stays accurate.

(e) Support requests

Anything you send to us for help at support@disputegoat.com, including the content of your message and the email address you send it from.

(f) Information collected automatically

• Browser and device data: your IP address, browser type, operating system, and the pages you visit.
• Error reports: when something breaks, our error-tracking tool records what happened. This tool is configured to exclude your identity, cookies, and headers before the report reaches us.
• Product usage events: anonymous counts of actions like “letter generated” or “dispute closed,” not tied to your name or account.

(g) What stays only in your browser

Before a letter or dispute update is saved, a working draft may sit in your browser’s local storage on your own device. This is temporary working state, not a second permanent copy. Once you save, it syncs to our servers as described in Section 3, and normal use does not require you to rely on the local copy surviving. Clearing your browser’s site data for disputegoat.com removes any draft that has not yet synced.

3. Where your data lives

We do not keep your data in one place. Here is the complete list of systems that touch it.

• Supabase (our database and sign-in provider, hosted in the United States, US East region): stores your account info, Goat Monitoring connection status and derived credential hash, report data, disputes, letters, and support-ticket references.
• Vercel: hosts the DisputeGoat web application. It runs the app and does not persist your data on its own.
• A pull worker we operate on a Hostinger virtual private server: periodically retrieves your report data from Goat Monitoring's data source using your stored derived credential and writes it to Supabase. It passes through report data on each pull; the durable copy lives in Supabase.
• Sentry: our error-tracking provider. It receives de-identified error reports only, never your name, email, cookies, or headers.
• PostHog: our anonymous product-analytics provider. It receives anonymous usage events only, never tied to your identity.
• Postmark: sends account and service emails (welcome, letter reminders, support replies). It handles your email address and the content of the transactional emails we send you.
• GitHub Actions: runs scheduled monitoring jobs, for example checking that the pull worker is healthy, and can send an internal alert to our team over Telegram if something is wrong. It only ever handles operational status, never member data.
• goatmonitoring.com (Goat Monitoring LLC): handles enrollment, identity verification, and billing, and is the original source of your credit report data. Everything you enter during enrollment is governed by the privacy policy presented there, not this one.

We do not use any of this data for advertising, and we do not sell it.

4. What unlinking your Goat Monitoring account does

If you unlink your Goat Monitoring connection inside DisputeGoat:

• The stored derived access credential described in Section 2(b) is deleted. We can no longer retrieve new report data on your behalf after this point.
• Your connection status record is removed.
• Report data already pulled before you unlinked is not automatically deleted by the unlink action itself. It is retained under the retention default described in Section 2(c) and Section 8 until it ages out, or until you separately request deletion under Section 9.
• Your disputes, letters, and account remain intact. Unlinking only affects the credit-report connection, not your DisputeGoat account.

Unlinking does not cancel your Goat Monitoring Membership or billing. That is handled separately on goatmonitoring.com under Goat Monitoring's own terms.

5. How we use your information

• To operate the workspace: show your report data, generate letters, track your disputes, and keep your account signed in.
• To retrieve your report data on your behalf through your linked Goat Monitoring connection.
• To respond to support requests.
• To detect and prevent fraud or abuse of the Service.
• To comply with legal obligations.
• To send you service-related email (account, letter, and dispute-status notifications) through Postmark.
• To monitor and improve the reliability of the Service using de-identified error and usage data.

We do not use your credit report data, letters, or disputes for advertising or marketing purposes, and we do not sell your personal information as that term is defined under the California Consumer Privacy Act or similar state laws.

6. Cookies and local storage

We use essential cookies and browser local storage to keep you signed in and to hold draft content before it syncs, as described in Section 2(g). We do not use third-party advertising cookies on the DisputeGoat product pages.

7. SMS / text messaging

If you provide your mobile phone number and check the SMS consent box, you agree to receive text messages from DisputeGoat / Goat Monitoring related to your waitlist status, enrollment, and account (for example, launch invitations and service notifications). Consent to receive text messages is not a condition of purchasing any goods or services. Message frequency varies. Message and data rates may apply.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. We do not share your mobile number or SMS consent status with anyone except as necessary to deliver the messages (for example, our SMS delivery provider acting on our behalf) or as required by law.

You can opt out at any time by replying STOP to any message. Reply HELP for help, or contact support@disputegoat.com.

8. Data retention

• Account and connection records are kept for as long as your account is active, plus a reasonable period after closure to comply with legal obligations and resolve disputes.
• Credit report pulls: the newest three per member by default; older pulls are deleted automatically.
• Disputes and letters: kept for the life of the account as your historical dispute record, since letters are not editable once created.
• Support tickets: kept for as long as reasonably necessary to resolve your request and maintain an internal support history.
• Local browser drafts: until they sync, or until you clear your browser’s site data.

9. Your privacy rights and how to reach us

Depending on where you live, you may have the right to know what personal information we have collected about you, request that we delete or correct it, opt out of sale or sharing (we do not sell your information), receive a portable copy of it, and not be discriminated against for exercising these rights.

To make a request, email privacy@disputegoat.com.

We will respond within the time frame required by applicable law (generally 45 days under the California Consumer Privacy Act and similar laws) and may need to verify your identity before completing certain requests.

10. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data described above, including encryption in transit, access controls limiting who can reach the database directly, and a written information security program. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we experience a security incident affecting your information, we will notify you as required by applicable law.

11. Children

DisputeGoat is intended for adults age 18 and over and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided personal information to us, contact privacy@disputegoat.com and we will delete it.

12. Changes to this policy

We update this Privacy Policy as our practices change. Effective August 25, 2026, we rewrote this policy to describe our current data practices, including server-side storage of your credit report data, the derived access credential used to retrieve it, and the vendors that process it on our behalf. Material changes will be flagged on our site or by email. Continued use of the Service after a change takes effect means you accept the updated policy.

13. Contact

Questions about this policy, or privacy requests: email privacy@disputegoat.com. For general support, email support@disputegoat.com. Or write to: