What we collect, how long we keep it, who else touches it, and what you can ask us to do about it. Read it. Then read the Transparency Report where we grade ourselves by the same rubric we apply to everyone else.
The Privacy Beat does not require accounts, does not set tracking cookies, and does not run ads or analytics. We do not sell, rent, or share your data with anyone for any reason.
When you analyze a privacy policy, the text you enter is sent to our LLM provider (Anthropic) and the resulting analysis is cached on our servers so the next person asking the same question gets an instant answer at lower cost. Your IP address is hashed and counted for abuse prevention. That's it.
The full policy below specifies retention windows, third parties, and your rights.
The Privacy Beat is a privacy-policy analyzer that scores publicly available privacy policies against U.S. federal law. The service is operated from the United States and is currently in pre-formation status — the operating entity has not yet been incorporated.
This policy describes the data practices that are in effect today and that will become legally binding when the operating entity is formed. The technical architecture, retention windows, and third-party relationships described here are real and accurate at the time of publication.
We collect three categories of data, each with a specific purpose. Nothing else.
| Category | What it is | Why we collect it | Where it's stored |
|---|---|---|---|
| Query input | The privacy policy text or URL you submit for analysis. | To send to our LLM provider for scoring against the rubric. | Supabase (cached); Anthropic (in-flight only). |
| Analysis output | The structured JSON report returned by the LLM for your query. | To return to you, and to serve to the next user who asks the same question without re-running the analysis. | Supabase (cached). |
| Hashed IP | Your IP address, processed through SHA-256 with a static salt. | Per-IP rate limiting (abuse prevention) and aggregate request counts. | Upstash Redis (rate limit window); Supabase (request log). |
About the IP hash: we hash your IP address with a static salt (pb-salt-2026) before storing it. Hashing is a form of pseudonymization, not anonymization — a determined adversary with the salt and a list of candidate IPs could reverse-engineer the mapping. We treat the hashed IP as personal data and apply the same protections we apply to other categories.
We don't collect the following. If we ever start collecting any of them, we'll update this policy and notify users on the home page before the change takes effect.
Each category has a specific retention window. We don't keep anything longer than we need to.
| Category | Retention | How it ends |
|---|---|---|
| Query input | Until superseded | Cached analyses are retained until a fresher analysis replaces them. Our re-check schedule is tiered: results under 24 hours old serve immediately, results between 1 and 7 days old are probed for source-policy updates when accessed, and results over 7 days old are always re-analyzed. In practice no cached entry persists more than a few weeks of active use. |
| Analysis output | Until superseded | Same as query input — analysis is paired with the query that generated it. |
| Hashed IP | 90 days | Hashed IPs are retained for up to 90 days for abuse prevention and aggregate request counts, then deleted. Rate-limit windows in Upstash expire on a rolling 1-hour basis. |
Honest disclosure: the 90-day deletion of hashed IPs is currently performed manually. A scheduled deletion function in Supabase is on the roadmap and will be deployed in a future release. See the Transparency Report for the full roadmap.
The Privacy Beat is built on commercial infrastructure. The following vendors process data on our behalf. Each has its own privacy policy, which we link to so you can review them yourself.
Because we don't collect identifying information, most of the rights below are easier to exercise practically than legally — there is rarely anything to find or delete that's tied to you specifically. We commit to the following standards regardless.
All requests should be sent to the contact address in § 12. We will respond from the same address. If you don't receive a response within 30 days, follow up — we'd rather be reminded than miss a request.
Honest disclosure: we do not yet have a formal rights-request endpoint or workflow. Requests are handled manually by the operator. A formal endpoint with verification flow is on the roadmap. See the Transparency Report.
The Privacy Beat is built with security as a first-order concern, not an afterthought.
We have not commissioned a third-party security audit, do not have a published vulnerability disclosure program, and do not yet have a formal incident response plan. These are on the roadmap. See the Transparency Report.
If you discover a security issue, please report it to the contact address in § 12 with the subject line "Security". We will respond within 5 business days.
If we discover a security breach affecting data covered by this policy, we will:
Because we do not collect personally identifying data, the practical impact of any breach is significantly limited. The most sensitive information we hold is hashed IPs, which cannot be used to identify a specific user without additional context.
Honest disclosure: we do not yet have a documented incident response plan. The commitments above will be operationalized into a written runbook on the roadmap. See the Transparency Report.
The Privacy Beat is not directed to children under 13. We do not knowingly collect any data from children under 13.
Per our own Methodology page, we apply the Epic Rule to ourselves: a "not directed to children" disclaimer is not enough on its own. The reason we score well on this category despite the disclaimer is structural — our service does not collect personal information from any user, regardless of age. There are no accounts, no profiles, no behavioral advertising, no behavioral tracking. A child using the analyzer is not at greater data-protection risk than an adult, because we collect the same minimal amount from both.
If you are a parent or guardian and believe a child has provided personal information through any contact with us (for example, by writing to our contact address), please email us and we will delete the information within 30 days.
We will update this policy as our practices change. Material changes — anything that expands what we collect, reduces user rights, or adds a new third-party recipient — will be announced on the home page at least 30 days before they take effect, with a link to the previous version of the policy archived for comparison.
Non-material changes — typo fixes, clarifications, link updates — take effect immediately and are noted in the version history at the bottom of this page (to be added in a future update).
The version of this policy is shown in the meta panel at the top of the page.
For privacy questions, data-subject requests, security reports, or anything else related to this policy:
A dedicated privacy@theprivacybeat.org address is on the roadmap. Until then, the Gmail address above is the canonical contact.