What you can check, not what we promise.
Privacy claims are easy to write. Below is the mechanism, the exact data we hold, what we've committed to, and where to send a security report.
How a match happens without us seeing you.
Cyberinity uses k-anonymity over prefix buckets with signed indexes — the same family of technique used for password checking, applied to every identifier type.
- A 5-character hash prefix
- The index version you asked for
- The identifier itself, hashed or plain
- Which entry matched, or that anything matched at all
- Your household details, documents or plan
The whole data dictionary.
That is the complete list. No advertising identifiers, no device fingerprint, no third-party analytics, no tracking pixels in our mails.
Five things we've tied our hands on.
No ads, no data sales — structurally
Neither app contains an advertising SDK or a third-party analytics SDK. There is nothing to switch on later, and the only revenue is what you pay us.
One-click delete, 30-day purge
Deleting your account removes the record immediately and clears backups within thirty days. No retention window for 'legitimate interest'.
If we are acquired, you are told first
Any change of control triggers a notice before the transfer completes, with export and deletion available until then. Your data is not part of the sale by default.
No fear tier
Bad news is never gated behind an upgrade. If we detect something, you see it in full on the plan you already have.
Breakage over silence
If a source, an index or a feature stops being trustworthy, we say so in the changelog and pull it — as we did with the daily reminders.
Every sub-processor, named.
No analytics provider, no advertising network, no CDN that can read your traffic. This list changes only in the changelog.
Both apps keep working on your device with no server behind them — a property of local-first, not a promise.
- Your plan exports as PDF and JSON, offline
- Your watchlist exports as plain text
- The last signed index stays usable, it simply stops refreshing
- We publish a closing notice 60 days ahead and delete accounts on day one
Median reply to a written question: 9 hours, measured over the last 30 days.
Found something? Write to the address below — we reply within two working days and will credit you unless you'd rather we didn't.
No bug bounty yet, and we won't pretend otherwise. An independent review of the matching core is scheduled before open beta, and we'll publish it whatever it says.