Is it safe to use no IV, or the same IV for scrypt, if the encrypted data is readily available to a hacker? The only time we use IVs is for a web login system to prevent rainbow tables, right? Since the data is client side and therefore in the hacker's hands, is there a need to use an IV?

I have a web app, in which I am encrypting user data client side. Each client has their own password, which is used to derive an encryption key (via Scrypt) for encrypting their data. Since the data is client side and a hacker has full access to the (encrypted) data, would it be necessary to use a salt for Scrypt? The reason why we use a salt for KDFs is to reduce rainbow tables affecting web servers. Since there is no web server in play here, and the attacker can attack however they like, then a salt would provide no additional benefit, am I correct?