Privacy

The short version

We collect what we need to run the service, and we keep it for as long as it's useful. We don't sell your data. We don't share it with anyone we don't have to. If you don't like that, don't make an account.

What we collect

• Your email and a hash of your password.
• Whatever you do on the site: searches, monitors, plan changes, sign-ins. Your search terms are stored as you typed them so you can see your own history.
• Payment info, but only what your card or crypto provider tells us.
• Standard server stuff like your IP and user-agent on each request.
• Your browser locale and timezone, so we can figure out what languages to support and where our users are. Aggregate only - we never look at any individual's.
• Where new accounts came from: the referring site's hostname, campaign source, medium and campaign labels, and when the first arrival was recorded. This helps us measure which links lead to signups and paid accounts. Our own servers record this attribution. It does not store full referrer URLs, browsing histories or a new tracking ID.
• Visits to our public pages, measured with Google Analytics: the page's path, the page before it, and the device, browser and rough location Google works out from the visit. It never receives a page's query string, so it never sees what you search for, and it does not run in the dashboard or on account pages. Google Analytics sets its own cookies to tell visits apart. Google signals and ad personalisation are off.
• When browser protection is enabled, a server-issued browser ID in an HTTP-only cookie prevents free allowances from resetting when you switch accounts. It is not a login credential or a hardware fingerprint. Accounts using the same browser share its free allowance.
• Error reports and sampled performance timings help us find broken or slow pages. These include error messages, stack traces, page paths and technical runtime details. We exclude cookies, request bodies, request headers and URL query strings from automatic monitoring. We do not record session replays.
• When public profile history is enabled, we retain selected public profile fields and profile images observed during username searches. This archive is shared between customers authorized to view full results; it does not identify who ran a search. Email and phone lookup results are not added to this shared archive.

How long we keep it

Account and billing records stay as long as we need them for support, taxes, and chargebacks. Activity logs are different, and you should read this part before you run a sensitive query: they include your search terms as you typed them, together with the IP address and user-agent they arrived from, and they have no expiry. They are our compliance trail, so we keep them until we have a legal reason not to. If you need a specific timeline for a specific record, email us.

Public profile history is separate from activity logs. Archived field values remain available for up to 90 days after that value was last observed; checking an account does not renew fields that were not observed. Historical revisions and image references also expire after 90 days. Expired information is no longer served while background deletion completes. Identical image bytes may remain if another unexpired profile still references them, but an expired profile reference cannot retrieve them.

The browser-ID cookie lasts up to 180 days and is renewed during continued use. Signing out does not remove it. Its separate usage record expires after 180 days without use; account usage records remain independent. Clearing cookies or using a private window creates a new browser identity, but does not reset an existing account's usage.

First-arrival attribution stays in an HTTP-only cookie for up to 30 days, without extending that window on each visit. It is removed after successful signup or Google sign-in. If you create an account, the recorded source stays with the account record; returning sign-ins do not replace it.

Who we share it with

• Stripe - so we can take your money.
• Resend - so we can send you email.
• Cloudflare Turnstile - so bots can't spam our login page.
• Search and data-processing infrastructure, when you run a query.
• Sentry - to diagnose application errors and performance problems.
• Google Analytics - to count visits to our public pages.

We comply with valid legal orders. If we get one, we hand over the minimum needed to satisfy it. We'll tell you about it unless we're legally barred from doing so.

We don't sell anything to anyone.

Your stuff

You can see your own activity log at Account → Activity. You can delete your account from the dashboard. Deleting it ends your access immediately and cancels any subscription. It does not erase your activity log: that is the compliance trail described above and it survives the account. If you want something specific removed, email us and we will tell you whether we are able to.

Questions

Email [email protected]. Real human reads it.