Privacy

You can check names without an account. History requires sign-in. To enforce a daily limit, guest requests use a one-way identifier derived from the IP address: a keyed hash (HMAC-SHA256 under a server-side secret), not the address itself. That secret is what makes it impossible to reverse without it, unlike a plain hash of an IPv4 address, which is small enough to brute-force in minutes. Nothing about a guest is linked to an email or a name, because there isn’t one to link.

An account stores an email and a password (handled by Supabase Auth; we never see or store your password in plain text), plus whatever you choose to keep: your history, saved names, and any share links you create. That is the complete list. No profile data is collected beyond what you enter to sign up.

The name and optional description you research are stored so history and reports work, and are sent to the sources that research them. A share link exposes the score, category and headline figures of one report to whoever holds it, and never your account, your other searches, or how you were identified.

The only cookies set are the session cookies Supabase uses to keep you signed in. There is no advertising, tracking or analytics cookie on this service.

Only the name and description being researched are ever sent onward, never your email, password or IP address. Each source receives a search query and nothing else about you:

• GitHub, npm, PyPI, YouTube, Apple App Store, Wikidata, SEC EDGAR, UK Companies House and the other public registries: read-only lookups, queried directly with the name.
• Tavily powers general web and Google Play research. It receives the name and, on a Deep Check, your description.
• Groq writes the optional AI explanation on a Deep Check, from a compact summary of what was already found. It never receives your account information.

Two providers host the service rather than researching anything: Supabase (account data and history, hosted in the US) and Vercel (application hosting). If you are outside the United States, your data is processed there as a result.

None of them are permitted to use what they receive to advertise to you, and none is an ad network or an analytics platform. This service doesn’t run any of its own either.

Data is kept until you delete it. There is no automatic expiry, which is stated plainly because promising one that doesn’t exist would be worse than not having it.

From account settings you can export everything stored about you as a single file, or permanently delete your account and everything attached to it. Both take effect immediately, and deletion cannot be undone. Individual searches can be removed from your history at any time. As a guest, deleting a search works the same way; there is no account to delete.

Account and research data is protected by row-level security in the database: a signed-in user can only ever read their own rows, enforced by the database itself rather than by application code remembering to filter. A shared report is reachable only through its own unguessable link, and revoking that link makes it unreachable immediately.

This service is not directed at children and is not knowingly used to collect data from anyone under 13.

If this policy changes in a way that matters, the date above changes with it. Continued use after that means you accept the update.

Questions, or a request to export or delete your data, can go to zainmahmood.me@gmail.com.