Privacy Policy

Paranoia is built and published by Stack Holdings LLC, an Arizona company at 1110 W Elliot Rd #1167, Tempe AZ 85284, which is the controller for the personal data described below. Paranoia is published on the App Store under the developer account of Diego Fill, the sole member of Stack Holdings LLC.

This policy covers two things: the Paranoia app on iOS, and this website at checkparanoia.com. They are separate systems and they are described separately. The terms you agree to by using either are in the Terms of Use.

You can reach us at hello@checkparanoia.com.

You can use Paranoia without signing in. Signing in with Apple, Google, or a passwordless email link is optional on iPhone, from version 3.4: it syncs your watchlist and alert picks across your devices, and keeps Paranoia Plus with your account. The Android app currently asks you to sign in before you use it; this page describes the iPhone app from version 3.4 onward except where it says otherwise. Every company file, score and search works the same either way, signed in or not. Paranoia ships two measurement SDKs, both optional: Meta’s advertising SDK, which helps us measure whether our own advertising brought you to the app, and PostHog’s product-analytics SDK, which helps us understand how the app is used and when it breaks. Both are switched on by default and both can be switched off at any time, in Profile, under MEASUREMENT — see ADVERTISING MEASUREMENT below, and PROCESSORS for what PostHog records, for exactly what each one does. When you first open the app we ask, through Apple’s own App Tracking Transparency prompt, whether we may measure whether an ad brought you here. The prompt reads, word for word: “Used only to measure whether our ads brought you here. Paranoia works identically if you decline.” If your device’s region is set to a country in the EU, the EEA or the UK, neither SDK is started and you are never asked; see YOUR RIGHTS below. There are still no advertisements inside Paranoia, and we still buy no datasets — this measurement is about how we advertise to bring people to the app, not about anything inside it. Paranoia does not build a profile of you for its own use and does not sell your personal information; it does share limited data with Meta Platforms for advertising measurement, described precisely in ADVERTISING MEASUREMENT below.

Here is everything that can leave your device. Some of it happens whether or not you sign in; the rest happens only once you do. Everything below is from the app installed on your iPhone or Android device — see WEB APP (APP.CHECKPARANOIA.COM) below for what the web app at app.checkparanoia.com does instead.

What can leave your device whether or not you sign in:

• —If you turn on alerts for a company or official, a push token, the entities you have alerts on, your platform, your app version, your weekly digest setting, and your device's time zone offset (minutes from UTC, not your location) are stored on our server so we can notify you. That record is not linked to your identity unless you sign in — described in WATCHING AND ALERTS below.
• —Meta’s advertising SDK reports to Meta that the app was installed and each time it is opened, when you finish first-run setup, and, if you subscribe to Paranoia Plus, that you purchased it (which plan, the price charged and the currency), together with an anonymous identifier Meta generates for this install, whether or not you allowed tracking. Your device’s advertising identifier (IDFA) goes with it too, but only if you allowed tracking at Apple’s prompt — described in ADVERTISING MEASUREMENT below.
• —If you subscribe to Paranoia Plus, a record of that purchase leaves your device to RevenueCat, and RevenueCat also sends that purchase to Meta from its own servers — not from your phone — only if you allowed tracking at the prompt — described in SUBSCRIPTIONS and ADVERTISING MEASUREMENT below.
• —Apple’s own SKAdNetwork mechanism separately sends the advertising network a delayed, aggregate report that an install or a purchase happened. It contains no identifier for you or your device, and it comes from Apple, not from us.
• —PostHog’s product-analytics SDK sends usage events, error reports when something in the app fails, the text of a search that finds no companies, and, unless you switch it off, session recordings — tied to an anonymous identifier unless you sign in — described in PROCESSORS below.

That’s five things in total, from anyone using the app, guest or signed in.

What leaves your device only if you sign in:

• —The email address you sign in with, an internal account ID, and — if you use Sign in with Apple — the revocation token described in YOUR ACCOUNT below, are stored against your account as soon as you sign in.
• —If you have saved companies or apps to your watchlist, their slugs and a timestamp for each are synced to your account the moment you sign in — described in WHAT STAYS ON YOUR DEVICE below.
• —The push token and the entities you have alerts on, already described above, become linked to your account identifier from the moment you sign in, instead of sitting unlinked — described in WATCHING AND ALERTS below.
• —The RevenueCat purchase record already described above becomes associated with your account identifier too, so Paranoia Plus follows you to any device where you sign in — described in SUBSCRIPTIONS below.
• —PostHog is given your account identifier, instead of only an anonymous one — described in PROCESSORS below.
• —If you redeem a referral code in the Paranoia web app, a one-way hash of your email, the code, and grant records are stored — described in SUBSCRIPTIONS below. Referrals are available only in the web app, and only once you sign in. The iPhone and Android apps do not offer them.
• —If you redeem a creator code in the Paranoia web app, your account identifier, the code, a one-way hash of your email, the number of days granted and when you redeemed are stored — described in SUBSCRIPTIONS below. Creator codes are available only in the web app, and only once you sign in. The iPhone and Android apps do not offer them; on iPhone and iPad, App Store offer codes are redeemed through Apple.
• —If you send feedback from the in-app Feedback screen, the kind you picked, your message, the page you were on if you sent it from a company page, your app version, platform, and OS version are stored against your account ID so we can read and act on it, kept until you delete your account, plus a reply-to email too if you enter one. Described in CONTACT AND LAST UPDATED below. Feedback is available only once you sign in.

That’s seven more things in total, once you sign in — twelve altogether, guest and signed-in combined.

Using the app sends nothing else. Visiting checkparanoia.com in a browser is a separate activity, with its own conditions, described in ADVERTISING MEASUREMENT and THIS WEBSITE below.

In short: An email address and an account ID, stored for every account (plus a one-way hash of that email if you redeem a referral code); a push token, the companies and officials you have alerts on, and your weekly digest setting and time zone offset, if you turn on notifications; a purchase record if you subscribe, tied to your account. If you leave the two Profile → MEASUREMENT toggles on, two more items are collected: a device identifier and in-app usage events. Both of those, plus the purchase record when it is shared with Meta, are used for tracking — only if you allowed tracking at the App Tracking Transparency prompt. Turn either toggle off any time; the rest is not used for tracking. That is this site’s own restatement of what the app collects, not a reproduction of Apple’s wording. Apple publishes its own privacy label on the listing, and it is worth reading alongside this page: check the App Privacy section on the App Store ↗.

You can sign in with Apple, with Google, or with an email sign-in link. (If you use Sign in with Apple or Google, that provider processes the sign-in request natively before Paranoia sees the result.) But you don’t have to. Every file, score, source list, search, and the map are free whether or not you sign in; the only paid tier is Paranoia Plus, and you can buy it as a guest too. Signing in is worth doing for three reasons: your watchlist and alert picks follow you across devices; Paranoia Plus follows you to a new device automatically, instead of only restoring by Apple ID; and, in the web app, referral and creator codes and their grants exist only against an account.

• —What is stored: your email address and an account ID. The email address you sign in with — if you use Apple’s Hide My Email, that private relay address is what is stored, and Paranoia never sees your real one — and a random account identifier, held by Paranoia’s auth provider, Supabase. These are declared as collected and linked to your identity in the App Store privacy label. If you sign in with Apple, Paranoia’s server also stores the Apple sign-in token needed to revoke that connection when you delete your account; it is deleted with the account. No password is ever stored, because there are no passwords.
• —What it is used for. Signing you in, and associating data you choose to sync with your account. Your email may also be used for account-service messages — for example, a sign-in link you requested, or notice of a change to these terms. It is never used for marketing without your consent, never sold, and never shared with advertisers. If you send feedback and enter a reply-to email, that address is used only to reply to that message.
• —Deleting your account. Profile → ACCOUNT → DELETE ACCOUNT, inside the app. Deletion is immediate: it permanently removes your account and everything linked to it on our servers, including your email, your account ID, and any feedback you sent, and it revokes Paranoia’s Sign in with Apple access with Apple. Some purchase records are the exception: your Paranoia Plus record at RevenueCat, the auto-renewal consent record for a web purchase, and our own purchase log. When you delete your account we remove everything in our purchase log that identifies you (your account ID and any ID RevenueCat used for you), and keep the rest (product, price, dates, store transaction number) as an anonymous accounting record. See HOW LONG WE KEEP IT below. It cannot be undone. If alerts are turned on, the app keeps them working on that device afterward, by re-registering its push token and your alert picks with no link to any account — turn alerts off first, in Profile, if you don’t want that. You’re left browsing as a guest, the same as anyone who has never signed in. An active subscription is managed by Apple and is not cancelled by deleting your account — cancel it in iOS Settings → Subscriptions, or at apps.apple.com/account/subscriptions ↗.

Meta Platforms, Inc. is an independent controller of the data described in this section — not a processor working under our instructions. We have not placed it under Meta’s Limited Data Use program, so it decides its own uses for what it receives, within its own privacy policy. There are five paths by which data about your use of Paranoia reaches Meta, each with its own condition.

• —Meta’s on-device advertising SDK reports app installs, app opens, finishing first-run setup and Paranoia Plus purchases. When you first open the app we ask, through Apple’s own App Tracking Transparency prompt: “Used only to measure whether our ads brought you here. Paranoia works identically if you decline.” The SDK reports to Meta that the app was installed and each time it is opened, that you finished first-run setup, and, when you subscribe to Paranoia Plus, which plan you chose, the price you were charged and the currency, together with an anonymous identifier Meta generates for this install. These reports are sent whether or not you allow tracking; the purchase report carries no email address, account identifier or transaction identifier. The SDK is given your device’s advertising identifier (IDFA) only if you allow tracking at that prompt — if you decline, no advertising identifier is collected.
• —RevenueCat sends purchase events to Meta from its own servers. When you subscribe, RevenueCat — the company we use to manage subscriptions — sends Meta a purchase event carrying Meta’s anonymous identifier for your device, your device’s vendor identifier, and your IP address. It never carries your email address. This event is sent only when you allowed tracking at the ATT prompt described above.
• —Apple’s own SKAdNetwork mechanism sends a delayed, aggregate report. Separately from anything we control, iOS itself tells the advertising network that an install or a purchase happened, on a delay, in aggregate. It contains no identifier for you or your device, and it comes from Apple, not from us.
• —A pixel on checkparanoia.com reports page views, gated by your location and your browser’s Global Privacy Control signal. The pixel loads only for visitors outside the European Union, the European Economic Area, the United Kingdom and Switzerland, and never at all when your browser sends a Global Privacy Control signal — for those visitors the pixel simply never loads. Where it does load, it sets two first-party cookies on checkparanoia.com, _fbp and _fbc, that Meta uses to match your browsing to an advertising outcome.
• —A server-side call to Meta’s Conversions API sends a Lead event when someone joins the Android waitlist on checkparanoia.com. The event carries the request’s IP address and user agent, and the _fbp/_fbc cookie values when present. It does not include your email address, hashed or otherwise. It is sent from our server, not your browser, so it happens whether or not the pixel loaded in that visitor’s browser.

We use Meta’s advertising pixel and the server-side Conversions API path described above on checkparanoia.com. See DO NOT SELL OR SHARE MY INFO below for every way to opt out of any of this.

• —Your watchlist. The companies and apps you watch are always kept in this device’s local storage. If you sign in, they’re also synced to your account: the slugs of the companies and apps you watch, and a timestamp for each, are stored against your account ID, so your watchlist follows you to any device where you sign in with the same account — visible only to you, and deleted with your account. If you never sign in, your watchlist stays on this device only. Your watchlist is unlimited and watching alone sends nothing to our alert list; turning on an alert (the bell) stores a push token and the entities you have alerts on on our server, not linked to your identity unless you sign in (see WATCHING AND ALERTS below). Entries a lapsed Paranoia Plus subscription left with alerts off, after trimming your alerts back to three, stay on your watchlist until you tap the bell on them. If you sign out, the device’s local copy is not cleared — it just stops syncing until you sign back in.
• —Search and filter state. Searching or filtering the list of companies happens on your device, over data already stored on it. A search that finds companies sends nothing you typed. If product analytics is switched on and a search finds no companies, the text of that search is sent to PostHog, as described under PROCESSORS below.
• —Your preferences and privacy lens. Any settings you choose — including the privacy lens that personalises how companies are ranked for you, and the city you pick for City Watch — are stored in this device’s local storage only. The ranking is computed on your device, not on a server, so your choices are never transmitted to make it work. Signing in does not change that. One caveat about the map: rendering the city you picked fetches map tiles for that area from OpenFreeMap, a third-party tile server — like any web request, the tile request carries your device’s IP address and reveals which area of the map is being drawn.
• —Share cards. When you generate a shareable score card for a company, that image is rendered entirely on your device from already-public dossier data. What happens to the resulting image after that — whether you post it, save it, or send it — is handled by iOS’s own share sheet, not by Paranoia.

The web app at app.checkparanoia.com is a different surface from this website — it is where you sign in, keep a watchlist, and buy Paranoia Plus in a browser. Everything below describes it specifically; THE APP above describes the iPhone and Android apps, and THIS WEBSITE below describes checkparanoia.com.

What it stores in your browser. The web app sets no cookie of its own. It writes only to this browser’s local storage and session storage (session storage is cleared when you close the tab), grouped by what each group is for:

• —Your sign-in session — if you sign in, your session token and, briefly, the code verifier used while a sign-in is completing.
• —Your local watchlist, history and preferences — the companies and apps you watch, recently viewed companies and officials, categories you follow, and your local display and profile preferences, the same as WHAT STAYS ON YOUR DEVICE above describes for the app.
• —Alerts you are subscribed to, and any alert or watchlist removals waiting to sync to your account.
• —Onboarding and tour flags — whether you finished onboarding, dismissed the guided tour strip, or saw the in-app alerts and sync-your-data notices, plus bookkeeping for returning you to the right page after signing in or after the guided tour.
• —Tracking-prompt timing — a small attExplainer.v2 record of when you first visited, how many times you opened Profile, and whether the iPhone app’s tracking-permission explainer was offered. The web app shares this code with the iPhone app but never shows that explainer or asks for tracking permission, and the record never leaves your browser.
• —Your analytics choice — the consent.v1 record of whether you accepted or rejected product analytics, described below.

Every group above is strictly necessary or functional storage set without asking for your consent — none of it is analytics, and none of it is shared with anyone. Stripe’s checkout frame, when you buy Paranoia Plus on the web, sets its own cookies on Stripe’s own domain, not on app.checkparanoia.com; the web app itself never sets one.

Your analytics choice. The first time you visit, a bottom sheet asks whether we can count how the site is used, with two equal-weight buttons: Accept and Reject. If your browser sends a Global Privacy Control or Do Not Track signal, we treat that the same as Reject automatically and never show you the sheet. You can change your choice at any time from Profile, under MEASUREMENT.

After you accept, and only then: PostHog. If you accept, we load PostHog’s product-analytics code — from our own code, not a third-party script tag — which sends page views (by pathname only, never a full URL with query parameters) and product events to PostHog’s EU servers at eu.i.posthog.com. If something on a page fails, it also sends an error report, built and limited exactly as PROCESSORS below describes for the app. There is no session recording on the web app: no screenshots, no replay. The web app also sends the text of a search that finds no companies, with the same limits as in the app. PostHog is given an anonymous identifier for your browser; it is never linked to your account, even if you are signed in, and it is never given your email address or anything else from your profile. Its keys are stored in this browser under names starting with ph_, and switching analytics off in Profile removes all of them immediately. PostHog is configured to discard the IP address on events sent from the web app.

Every other service the web app contacts. Supabase (guiufthmfvlfmdbhhhxn.supabase.co), our auth and database provider, is contacted on every visit to sign you in and sync your watchlist, alerts and history — Google sign-in also runs through a redirect to that same Supabase domain, so it loads no separate script of its own. It is also contacted once when you open a company page, to check whether that page has a newer review or has been removed. The request carries only the page’s name. Apple’s sign-in script (appleid.cdn-apple.com) loads only when you open the sign-in panel and choose Sign in with Apple, and the sign-in itself then runs on appleid.apple.com. RevenueCat (api.revenuecat.com) is contacted to check and manage your Paranoia Plus subscription; its own SDK analytics are turned off, so it is used only for subscription status, never for its own measurement. Stripe (js.stripe.com, api.stripe.com and hooks.stripe.com) is contacted only at checkout, to process payment for Paranoia Plus. OpenFreeMap (tiles.openfreemap.org) serves the map tiles and map fonts for City Watch, only when you open City Watch. Vercel, which hosts the web app, keeps the same kind of ordinary request logs described under INFRASTRUCTURE LOGS above for the app’s own host, Supabase.

OpenFreeMap and Cloudflare. OpenFreeMap is served through Cloudflare. If a map tile fails to load, your browser may send Cloudflare a network error report to a.nel.cloudflare.com, naming the address that failed and your IP address. This only happens on a failed tile request while you have City Watch open.

Location, only on City Watch. Only when you press USE MY LOCATION, your browser shares your location with the page. It is matched to the nearest city inside your browser, and the coordinates are never stored or sent to us or anyone else. If you decline or your browser does not support it, City Watch keeps working with manual city search.

City Watch data files. City Watch’s camera, city, ZIP code and record files download from app.checkparanoia.com itself, the same host serving the page you are on.

The full, current list of every host the web app can contact, and exactly when, is published and kept in sync with this section at app.checkparanoia.com/scan ↗, alongside a Blacklight privacy scan of the web app itself.

Alerts and feedback you choose to send are the two exceptions to the WHAT STAYS ON YOUR DEVICE list above. During first-run setup you pick a few companies to watch — you can swap or remove them at any time — and the WATCH button on any company or official’s file adds it to or removes it from your watchlist, which has no limit — whether or not you’re signed in. The bell next to it turns alerts on or off for that file. Watched entities appear in your list, and — once notifications are enabled and you turn on an alert — we store a push token and the entities you have alerts on on our server so we can notify you, together with your weekly digest setting and your device's time zone offset (described under Weekly digest below). If you’re not signed in, that record is not linked to your identity: nothing ties it to you beyond the token itself. If you sign in, it’s linked to your account from that moment. If you sign out, it goes back to being unlinked the next time the app syncs. Nothing is stored on the server until you allow notifications. Turning an alert off, or removing that entity from your watchlist (which also turns its alert off), removes it from the server-side alert list. The push token record itself is not removed when you delete the app: deleting the app makes the token permanently undeliverable, and the record is disabled after the next delivery attempt to it fails, then kept in that disabled state; see HOW LONG WE KEEP IT below. Deleting your account removes everything linked to it on our servers, apart from the purchase records described in HOW LONG WE KEEP IT below (our own purchase log keeps only an anonymous remainder); if alerts are turned on, the app keeps them working on that device afterward by re-registering the push token and your alert picks with no link to any account — turn alerts off first, in Profile, if you don't want that.

Free users can have alerts on for 3 companies and officials at a time, guest or signed in; Paranoia Plus removes the cap, and the watchlist itself is unlimited for everyone. Entries a lapsed Paranoia Plus subscription left with alerts off, after trimming your alerts back to three, stay on your watchlist until you tap the bell on them — that is real, not a display quirk, and it is why some entries in your list may not be receiving alerts.

Weekly digest. The app can send one weekly digest notification, on Sunday evening in your device's local time. It summarizes new entries on file for the companies and officials you have alerts on, plus settlement notices that newly opened. It is only sent when something is new; if nothing is, no digest is sent. It is chosen from your alerts only: watching a company without turning its bell on does not put it in a digest. To send it in your evening, the app sends our server your weekly digest setting (on or off) and your device's time zone offset: the number of minutes your device's clock differs from UTC, for example -420. It is not your location. It is shared by every device in the same band of time zones, which spans many countries, and we receive no coordinates, region, time zone name or language setting with it. These two values are sent only once notifications are allowed, together with your alert picks, and they are linked to your account only if you are signed in, exactly like the push token. For each digest we also keep a send record: the push token, the week, the start of the period it covered, the identifiers of the entries and settlement notices it summarized, and whether it was delivered. We delete send records after 60 days, or sooner when the device record is deleted. The notification text carries company names and counts only and is delivered through Expo's push service, like any other alert. You can turn the digest off at any time in Profile, under Alerts, then Weekly digest. Older versions of the app do not receive it.

The app reads published company and app dossier data from Paranoia’s database, hosted on Supabase, over an encrypted HTTPS connection. These are read-only requests for public content. The one write path to our database from inside the app is the in-app Feedback screen, described in THE APP above and CONTACT AND LAST UPDATED below, and nothing else you do inside the app influences what gets requested beyond which public dossier records are fetched. If you’re not signed in, every request from the app to Paranoia’s database carries only a publishable key — no identity attached. If you sign in, those same requests also carry your session’s authentication token, which identifies your account — that is how signed-in features work. Either way it sends no advertising or device identifiers, and no part of your watchlist travels with the request. (One exception, described in WHAT STAYS ON YOUR DEVICE above: rendering the city map fetches tiles from OpenFreeMap, and that tile request carries your device’s IP address and the area being drawn.)

The app ships with a snapshot of the scored dataset. On launch it checks whether newer dossier data is available and quietly fetches it in the background; if that check fails, is offline, or is misconfigured, the app simply keeps showing you the data it already has — you will never see an error message about it.

Paranoia Plus is an auto-renewable subscription, available in annual and monthly terms, sold either through the App Store or on the web at app.checkparanoia.com. App Store purchases: Apple is the merchant of record, takes the payment, holds the purchase record and issues the receipt. Web purchases: Stack Holdings LLC is the seller of record, US customers only, and payment is processed by Stripe through RevenueCat. Either way, we never see a card number, a billing address or a name.

• —What is collected: purchase history. Whether you have an active subscription, which term you bought, when it started, whether any free or discounted period applied to it, and whether it renewed or lapsed. This is handled on Paranoia’s behalf by RevenueCat, a subscription-management provider. RevenueCat tells us about each purchase event, and we keep our own record of it: which product, when, the price, whether it was a renewal or a refund, and the store’s transaction identifiers. That record carries the same random ID or account ID RevenueCat uses for you. It never carries your email address, your name, or any advertising identifier.
• —Your subscription is associated with your account if you sign in. RevenueCat identifies your subscription with a random, device-generated ID whether or not you sign in. If you sign in, that ID also becomes associated with your account identifier, so Paranoia Plus follows you to every device where you sign in with the same account. If you never sign in, your subscription restores the same way any App Store purchase does — with the same Apple ID, on the same or a new device. The association, when it exists, is your account identifier only, never payment details.
• —If you redeem a referral code in the web app, one hash of your email is kept. To stop the same person redeeming referral codes repeatedly through different accounts, Paranoia stores a one-way cryptographic fingerprint — a SHA-256 hash — of the normalized email address on the redeeming account. The raw email address is never written into referral records, the hash cannot be reversed into your address, and it is used for nothing except preventing repeat redemptions. Referral weeks are promotional grants handled through the same RevenueCat record described above.
• —If you redeem a creator code in the web app, a redemption record is kept. The record holds your account identifier, the code, the same kind of one-way SHA-256 hash of your normalized email address described above (the raw address is not stored in it), the number of days granted, whether the grant went through, and the time you redeemed. We use it to enforce one creator code per account and per email address, to enforce each code’s redemption limit, and to keep the days granted accurate. We also keep a running count of redemptions on each code. We may tell a creator or a partner platform how many times a code has been redeemed. We do not tell them who redeemed it, and they receive no account identifier or email hash. The record is readable only by us, not by other users, and is deleted when you delete your account. The granted days are a promotional entitlement handled through the same RevenueCat record described above.
• —A record of your purchase is shared with Meta for advertising measurement. Meta’s advertising SDK in the app reports the purchase (plan, price charged, currency), and RevenueCat, on our behalf, also sends Meta a record that you subscribed — see ADVERTISING MEASUREMENT above for exactly what that record contains and when it is sent. Outside that measurement purpose, purchase history is used only to unlock the features you paid for. It is never sold, and never shared with anyone else for marketing.
• —No payment details ever reach Paranoia. On the App Store, the transaction is processed entirely by Apple through StoreKit. On the web, the transaction is processed by Stripe through RevenueCat. Neither Paranoia, nor RevenueCat, ever sees your card number, bank details, or billing address.
• —Web purchases: we keep a record that you agreed to auto-renewal. US law requires proof that you affirmatively agreed to a subscription that renews automatically. For a web purchase, we store your account identifier, the plan and price you bought, the text of the consent you agreed to and its version, and the time you agreed, in a dedicated consent record. This record is kept for at least three years, including after the account it belongs to is deleted, because it exists to prove consent was given, not to identify you for any other purpose.
• —If you never subscribe, none of this happens. Every company file, Paranoia Score, letter grade, pillar subscore, and written rationale — plus search, the city map, and every source link on the files of public officials — is free and requires no purchase. As of 2026-08-24, source links on company and app files and ownership chains and subsidiaries moved behind Paranoia Plus; see PARANOIA PLUS in the Terms of Use.

Apple’s handling of an App Store purchase is governed by Apple’s privacy policy: apple.com/legal/privacy ↗. Stripe’s handling of a web purchase is governed by Stripe’s privacy policy: stripe.com/privacy ↗. Subscription price, term, renewal, referral limits, and cancellation are covered in the Terms of Use.

Paranoia’s hosting provider, Supabase, briefly retains standard server request logs (for how long, see HOW LONG WE KEEP IT below) — the kind every website and API on the internet keeps for a short time for operations and security purposes. These logs include technical details such as IP addresses.

Paranoia does not access these logs to build a profile of any individual user, does not use them for advertising, and does not combine them with anything else about you. We are disclosing this plainly here even though it goes beyond what is strictly required: this policy is intentionally broader and more conservative than the minimum privacy label Paranoia displays in the App Store.

How long each kind of data is kept:

• —Your account, your synced watchlist, alert picks linked to your account, feedback, referral records (including the email hash), and the Sign in with Apple revocation token: until you delete your account. Deletion removes them immediately. The push token record linked to your account is deleted at the same time, unless alerts are still turned on, in which case the app re-registers it with no link to any account, as YOUR ACCOUNT above describes.
• —Alerts on a device that is not signed in: the entities you have alerts on are kept until you turn those alerts off or stop watching them, which deletes them immediately. The device record itself (the push token, your platform, your app version, your weekly digest setting, your time zone offset, and records of alerts sent to it) is kept after that. The weekly digest send record (see Weekly digest above) is deleted after 60 days, or immediately when the device record is deleted. If the app is deleted, that record is marked undeliverable after the next failed delivery attempt and is kept in that state. We do not yet delete these device records automatically. To have one deleted, email hello@checkparanoia.com.
• —Your Paranoia Plus purchase record at RevenueCat: kept by RevenueCat for as long as it holds customer records for Paranoia, so your subscription can be managed and restored. Deleting your Paranoia account does not delete it. If you want it deleted, email hello@checkparanoia.com and we will delete it at RevenueCat and remove the identifying parts of our own purchase log for it. Apple keeps its own record of an App Store purchase, under its own privacy policy.
• —Our purchase log: one row per purchase event (new subscription, renewal, cancellation, refund). Kept for 7 years for accounting and tax records. When you delete your account, the parts of it that identify you are removed immediately and the remainder is kept without them.
• —The auto-renewal consent record for a web purchase (web purchases are available to US customers only): kept for at least three years after the purchase, including after the account is deleted, because it exists to prove you agreed to automatic renewal, as SUBSCRIPTIONS above describes. We do not yet delete these records automatically after that period.
• —Server request logs: Supabase keeps them for the period our Supabase plan sets, no more than seven days, and then deletes them. Vercel, which hosts this website and the web app, keeps its request logs for the period it sets for its own operations and security; Vercel does not publish a fixed period. We keep no copies of either.
• —An email address on the Android waitlist: until you ask us to remove it.
• —Product analytics: session recordings are deleted after 30 days. Usage events and error reports are kept for the retention period our PostHog plan sets. The app never starts product analytics on devices set to the EU, the EEA or the UK, and the web app sends events only after you accept analytics.
• —Data Meta receives: Meta decides how long to keep it, as an independent controller. On devices set to the EU, the EEA or the UK, the app never starts Meta’s SDK and never asks for tracking, and the pixel on this website never loads for visitors there.
• —Everything kept on your device: until you delete it in the app or delete the app.

Source links — the receipt attached to every claim in the app — and recommended-alternative links open in an in-app Safari view. Once you leave to visit one of those destinations, that destination’s own privacy policy applies. Paranoia has no control over what happens on someone else’s website.

Links under “Tools We Recommend” are diegofill.com/go/ redirects. Stack Holdings LLC may earn a commission if you subscribe to a recommended tool through one of these links, at no additional cost to you. This is the same affiliate disclosure shown in-app on the About screen.

This website loads exactly one conditional third-party script: Meta’s advertising pixel, described fully in ADVERTISING MEASUREMENT above. It loads only for visitors outside the European Union, the European Economic Area, the United Kingdom and Switzerland whose browser does not send a Global Privacy Control signal; for everyone else, nothing is requested and no cookie is set. Where it does load, it sets two first-party cookies on this origin, _fbp and _fbc, that Meta uses to match your browsing to an advertising outcome. Meta Platforms, Inc. is an independent controller of that data, not a processor working under our instructions, exactly as ADVERTISING MEASUREMENT states above. The fonts are self-hosted: they are downloaded once at build time and served from this origin, so viewing a page sends no request to a font CDN.

Separately from the pixel, and unaffected by whether it loads for you, site traffic is also measured with Vercel Web Analytics, a cookieless, aggregate processor. It sets no cookie of its own: visitors are identified by a hash derived from the incoming request, and that visitor session hash is discarded after 24 hours, so a browsing session cannot be reconstructed across sites or across days. No IP address is stored with this measurement.

Each data point stores:

• —Event timestamp
• —URL
• —Dynamic path
• —Referrer
• —Query parameters, filtered
• —Geolocation, at country, region and city level
• —Device operating system and version
• —Browser and version
• —Device type
• —Script version

Vercel publishes what it collects and how: vercel.com/docs/analytics/privacy-policy ↗.

You give this site one thing directly, and only if you choose to: an email address, typed into the Android waitlist. It is used for one purpose — to contact you about an Android version of Paranoia — and for nothing else. There is no confirmation email, and no message has been sent to that list from this website. It is entirely optional: every page works identically if you never touch it. Separately, and not something you type in or agree to on this site, Meta observes your page views and the _fbp identifier described above, for allowed visitors as described in ADVERTISING MEASUREMENT — see DO NOT SELL OR SHARE MY INFO below for how to stop it.

Your browser never contacts our email provider. Submitting the form posts the address to this site, and the request to Resend is made from the server. That is what keeps the form itself true — filling it out and submitting it sets no cookie, loads no third-party script, and adds no third-party request to the page, whether or not the pixel elsewhere on this page has loaded for you. Resend stores the address; nothing else about you is sent with it, and no name is collected. Resend is named in PROCESSORS below. To come off the list, email hello@checkparanoia.com and the address is deleted.

Separately from that measurement, the host and its CDN write ordinary request logs — IP address, user agent and timestamp — which are retained briefly for security and operations. We do not publish a retention period here because our host does not publish one, and a number we could not stand behind is worse than an honest gap.

These are the processors involved in running Paranoia, named here in full, each scoped to only what it receives:

• —Apple processes App Store subscription purchases as merchant of record, and — when you choose Sign in with Apple — processes that sign-in natively before Paranoia sees the result. Apple provides the same or equivalent protection of user data as is stated in this policy. Its policy: apple.com/legal/privacy ↗.
• —Google processes Sign in with Google requests natively when you choose that option, before Paranoia sees the result — Paranoia never sees your Google password. Its policy: policies.google.com/privacy ↗.
• —Supabase is the app’s auth provider, hosts the published dossier database the app reads, holds the feedback you choose to send from the in-app Feedback screen, and it is the source of the infrastructure logs described above. Supabase provides the same or equivalent protection of user data as is stated in this policy. Its policy: supabase.com/privacy ↗.
• —RevenueCat manages subscription status on Paranoia’s behalf on both the App Store and the web, and, on our behalf, sends Meta Platforms a purchase event when you subscribe and allowed tracking at the ATT prompt — see ADVERTISING MEASUREMENT above for exactly what that event contains. RevenueCat processes that purchase-event data in the United States under the European Commission’s Standard Contractual Clauses, and under the UK Information Commissioner’s Office’s International Data Transfer Addendum for UK users — RevenueCat does not claim Data Privacy Framework certification. RevenueCat provides the same or equivalent protection of user data as is stated in this policy. Its policy: revenuecat.com/privacy ↗.
• —Stripe processes web subscription purchases on Paranoia’s behalf (through RevenueCat Web Billing), for US customers only. Stripe handles your card number, billing address and the payment itself; Paranoia and RevenueCat never see them. Its policy: stripe.com/privacy ↗.
• —OpenFreeMap serves the City Watch map tiles and map fonts, only when you open City Watch, and is served through Cloudflare: a failed tile request may send Cloudflare a network error report to a.nel.cloudflare.com, naming the failed address and your IP address. OpenFreeMap sets no cookie and requires no registration. Its terms: openfreemap.org/tos ↗.
• —Meta Platforms, Inc. is an independent controller — not a processor working under our instructions — of the advertising-measurement data described in ADVERTISING MEASUREMENT above. We have not placed it under Meta’s Limited Data Use program, so it decides its own uses for what it receives, within its own privacy policy, and it is certified under the EU–U.S. Data Privacy Framework. Its policy: facebook.com/privacy/policy ↗.
• —PostHog, Inc. provides the app’s optional product-analytics SDK, on servers in the European Union, in Frankfurt. When switched on, in Profile under MEASUREMENT, it records your sessions in the app: a stream of screenshots of what you saw and did, which companies you searched for and opened, the app’s own log output, and the network requests it made. The email field on the sign-in screen, the search field, the name and city fields in Profile, and the feedback message and reply-to email fields are masked in those recordings; nothing else is. PostHog is given an anonymous identifier for your device; if you sign in, that becomes your account identifier instead. It is never given your email, your name, or anything else from your profile. Recordings are deleted after 30 days. PostHog Inc. is a United States company; where it accesses that data from the United States to operate the service, it relies on the EU–U.S. Data Privacy Framework and on Standard Contractual Clauses. Its policy: posthog.com/privacy ↗. Error reports. When product analytics is switched on, and only then, the app also sends PostHog an error report when something in the app fails. An error report contains the kind of error; its message, with email addresses, the query part of any web address and long runs of digits removed, and cut to a fixed length; the list of places in the app’s own code that led to it, as file names and line numbers, never the values the code was working with; the page you were on, as a path only, never a query; the app’s version; and your platform. It is sent the same way, to the same place and under the same identifier as the usage events above. We never attach what you typed into search, notes, or anything else you wrote to an error report. The app sends at most 10 error reports per session, meaning each time the app starts or the web app loads in a browser tab, and sends the same error only once in that time. A crash inside the app’s native code, below the layer these reports come from, is not sent to PostHog. Switch Product analytics off in Profile, under MEASUREMENT, and none of this is recorded or sent from your device, error reports included, from that point forward. Searches that find nothing. When product analytics is switched on, and only then, the app also sends PostHog the text of a search that returns no companies, so we can see which companies and apps people look for that we do not cover yet. Before it is sent, the text is trimmed, changed to lowercase and cut to 40 characters. It is dropped entirely, and never sent, if it contains an @ sign, five or more digits, a web address (“www.” or “://”), any of the characters / \ ? # =, or a plus sign followed by a digit at the start, or if it is shorter than two characters. Each distinct search is sent once per session. It is sent the same way, to the same place and under the same identifier as the usage events above, so if you sign in it is tied to your account identifier. It follows the same regional rules and the same switch as the rest of product analytics. A search that finds companies never sends the text you typed.
• —Expo delivers alert notifications, including the weekly digest (receiving the push token and the content of each notification) and, at launch, checks whether an over-the-air app update is available: a version check that sends your platform, the app’s version, and a random identifier the update service generates for this install, which is not linked to your account, along with your IP address, as every web request does. Expo (650 Industries, Inc.) is certified under the EU–U.S. Data Privacy Framework and its UK Extension. Its policy: expo.dev/privacy ↗.
• —OpenFreeMap serves the map tiles for City Watch. Rendering the city you picked fetches tiles for that area from OpenFreeMap — like any web request, the tile request carries your device’s IP address and reveals which area of the map is being drawn. Its site: openfreemap.org ↗.
• —Vercel hosts this website and provides the aggregate analytics described above. Vercel provides the same or equivalent protection of user data as is stated in this policy. Its policy: vercel.com/docs/analytics/privacy-policy ↗.
• —Resend holds the Android waitlist for this website. It receives the email address of someone who joins that list, and nothing else — no name is collected, and no message has been sent to the list. Resend provides the same or equivalent protection of user data as is stated in this policy. Its policy: resend.com/legal/privacy-policy ↗.

We do not sell your personal information, and no data broker receives anything from the app or this site. We do share limited data with Meta Platforms for advertising measurement — described precisely in ADVERTISING MEASUREMENT above, and in DO NOT SELL OR SHARE MY INFO below. The processors and the independent controllers named above (Meta, and Apple and Google for App Store purchases and their own sign-in, as YOUR RIGHTS below explains) are the only third parties that receive anything, and each receives only what its row describes.

The app is rated 4+ and is suitable for a general audience. It contains no social features, no user-generated content and no advertising.

Paranoia is not directed at children, is not designed to appeal to children, and is not intended for anyone under 13. We do not knowingly collect personal information from children. If you believe a child has signed in, email hello@checkparanoia.com and we will delete the account and its data. See THE APP and YOUR ACCOUNT above for what an adult account holds.

If you are in the EU or the UK. Our lawful basis for the aggregate site measurement and the security logs described above is legitimate interests — understanding whether the site works and keeping it available — assessed against the fact that neither identifies you. Our lawful basis for your account and for your subscription is performance of a contract: we cannot sign you in, sync what you save, or give you the features you paid for without them. The installed app sets no cookie and writes to your device only what WHAT STAYS ON YOUR DEVICE above describes, none of which requires consent. The web app at app.checkparanoia.com sets no cookie either, but does use strictly necessary browser storage for your sign-in session, your local watchlist and preferences, and your analytics choice itself — see WEB APP (APP.CHECKPARANOIA.COM) below for the full list; none of that strictly necessary storage requires consent, and the one piece of browser storage that does (PostHog’s analytics keys) is written only after you accept. The one collection on this site that does rely on consent is the Android waitlist: joining it is the consent, it covers contacting you about a possible Android version and nothing further, and it is withdrawn by asking to be removed. You have the right of access, rectification, erasure, restriction, objection and portability, and the right to complain to your supervisory authority.

Why we are allowed to use each kind of data, if you are in the EU, the EEA or the UK. Each use of your data this policy describes rests on one legal basis under Article 6(1) of the GDPR and the UK GDPR. (The website’s own aggregate measurement and the Android waitlist are covered in the paragraph above.)

• —Your account (your email address, your account ID and, if you use Sign in with Apple, the revocation token), your synced watchlist, your Paranoia Plus purchase record, and account-service emails such as a sign-in link you asked for: performance of a contract, Article 6(1)(b). We cannot sign you in, sync what you save, or give you what you paid for without them.
• —Our purchase log (event type, product, price, dates, store transaction identifiers, and your account or random purchase ID): our legitimate interest in counting purchases and revenue accurately and keeping accounting records, Article 6(1)(f). For a signed-in subscriber it also supports performance of a contract, Article 6(1)(b).
• —Alerts, including the weekly digest (the push token, the entities you have alerts on, your platform, your app version, your weekly digest setting, your time zone offset, and the digest send record): performance of a contract, Article 6(1)(b). You turned alerts on to receive them. Nothing is stored until you allow notifications, and turning alerts off removes your picks.
• —The map tiles the app fetches from OpenFreeMap to draw the city you picked: performance of a contract, Article 6(1)(b), so we can show you the map you asked for.
• —Feedback you send from the Feedback screen, and a reply-to email if you enter one: our legitimate interest in reading and acting on what you tell us, including corrections to company files, Article 6(1)(f).
• —The one-way hash of your email kept when you redeem a referral code: our legitimate interest in stopping one person from redeeming codes repeatedly through different accounts, Article 6(1)(f). It cannot be reversed into your address and is used for nothing else.
• —The creator-code redemption record (account identifier, code, email hash, days granted, time): our legitimate interest in limiting each person to one creator code and each code to its redemption limit, Article 6(1)(f).
• —The auto-renewal consent record kept for a web purchase: our legitimate interest in being able to prove, if it is ever questioned, that you agreed to automatic renewal, Article 6(1)(f).
• —Server request logs kept by Supabase and Vercel, and the update check the app sends to Expo at launch: our legitimate interest in keeping Paranoia secure, available and patched, Article 6(1)(f).
• —Advertising measurement and product analytics, including error reports: your consent, Article 6(1)(a), as the next paragraph describes. On the web app, product analytics starts only after you accept it.

Where we rely on legitimate interests, we have weighed them against your rights. None of these uses builds a profile of you, and none is used for advertising. You can object to any of them by emailing hello@checkparanoia.com.

Our lawful basis for the app’s advertising measurement and product analytics, described in ADVERTISING MEASUREMENT and PROCESSORS above, is your consent, under Article 6(1)(a) of the GDPR. You can withdraw it at any time, using the two switches in Profile under MEASUREMENT and, on iOS, by revisiting the App Tracking Transparency permission in your device Settings. Withdrawing your consent does not affect anything we did with data before you withdrew it.

If your device’s region is set to a country in the EU, the EEA or the United Kingdom, neither of these services is started at all, and you are never shown the tracking prompt.

Where your data travels: Meta Platforms, Inc. is certified under the EU–U.S. Data Privacy Framework. RevenueCat, Inc. processes purchase-event data in the United States under the European Commission’s Standard Contractual Clauses, and under the UK Information Commissioner’s Office’s International Data Transfer Addendum for UK users — RevenueCat does not claim Data Privacy Framework certification. PostHog stores product-analytics data in the European Union, in Frankfurt; where it accesses that data from the United States to operate the service, it relies on the EU–U.S. Data Privacy Framework and on Standard Contractual Clauses.

Stack Holdings LLC is based in the United States, so if you use Paranoia from the EU, the EEA or the UK, your data is processed in the United States. Supabase, Inc., our database and authentication provider, stores your account, your synced watchlist, your alert record and any feedback you send on servers in the United States (Amazon Web Services, us-east-1). That transfer relies on the European Commission’s Standard Contractual Clauses in Supabase’s Data Processing Addendum, with the UK Information Commissioner’s Office’s International Data Transfer Addendum for UK users. Expo (650 Industries, Inc.) delivers alert notifications and answers the app’s update check from the United States, and is certified under the EU–U.S. Data Privacy Framework and its UK Extension. Vercel Inc., which hosts this website and the web app, and Resend, which holds the Android waitlist, are each certified under the EU–U.S. Data Privacy Framework and its UK Extension. Apple and Google process Sign in with Apple, Sign in with Google and App Store purchases as independent controllers, under their own privacy policies. You can ask for a copy of the safeguards we rely on by emailing hello@checkparanoia.com. Each of these processors maintains its own sub-processor list; we link to them rather than enumerate them here, so this policy cannot drift out of date with a list we do not control.

Using your rights. To use any of the rights listed above, email hello@checkparanoia.com. We answer within one month. If we need to confirm the request comes from you, we will ask for no more than that. If you never signed in, your data is not linked to you, so we may not be able to find it unless you give us something that identifies it, such as your device’s push token. You can complain to the data protection authority where you live or work, or where you think a problem occurred.

Do you have to give us any of this? No. On iPhone, you can use every company file, score, source and search without an account and without alerts. (The Android app currently asks you to sign in first, as THE APP above describes.) An email address is needed only if you choose to sign in, and a push token only if you turn on alerts. If you don’t provide them, those features don’t work, and nothing else changes.

Automated decisions. The Paranoia Score is an editorial rating of companies and apps, not of you. We make no automated decisions about you that have legal or similarly significant effects, and we do not profile you. The privacy lens that reorders companies for you is computed on your device, not on our servers.

If you are in California. In the past twelve months, the categories of personal information collected from the app are identifiers — an email address and an account ID, stored for every account (plus, for Sign in with Apple, the revocation token described under YOUR ACCOUNT, and the slugs and a timestamp for any companies or apps you watch, synced against that same account ID and described under WHAT STAYS ON YOUR DEVICE), a one-way email hash and referral code from someone who redeems a referral code, a push token, linked to your account if they are signed in, from someone who enables notifications, and, from someone who sends feedback from the in-app Feedback screen, a reply-to email address if they entered one — the content of that feedback, together with the kind picked, the company page it was sent from if any, and the app version, platform and OS version, is also stored against that same account ID, as described under THE APP above — and commercial information, in the form of the purchase history described under SUBSCRIPTIONS and the referral grant records described under Paranoia Plus in the Terms of Use. Enabling notifications also stores the companies and officials picked, described under WATCHING AND ALERTS. From this website, four categories arise: internet and network activity, in aggregate form in the host’s request logs and, for an allowed visitor as described in ADVERTISING MEASUREMENT above, in non-aggregate form as a page view sent to Meta; an IP address, in the host’s request logs and, for an allowed visitor, also sent to Meta with the pixel and the CAPI Lead event; the _fbp/_fbc cookie values, set on this origin for an allowed visitor; and, from someone who joins the Android waitlist, an identifier — the email address they typed in.

We do not sell your personal information. We do share it — using the word the way California’s privacy law defines it — for cross-context behavioural advertising. The categories we share are: identifiers (Civil Code §1798.140(v)(1)(A)) — your advertising identifier, your device’s vendor identifier, an anonymous identifier Meta assigns your install, the _fbp/_fbc cookie values set on checkparanoia.com, and your IP address; commercial information (§1798.140(v)(1)(D)) — that you purchased Paranoia Plus; and internet or other electronic network activity information (§1798.140(v)(1)(F)) — that the app was installed and opened and that you finished first-run setup, and, on checkparanoia.com, the pages you viewed there and the page that referred you to it. The recipient is Meta Platforms. The purpose is measuring whether our advertising works.

In the app, in the twelve months before the date of this policy, we did not share personal information for cross-context behavioural advertising. We began doing so with version 3.2.0. On checkparanoia.com, we began sharing personal information for cross-context behavioural advertising on September 15, 2026. We do not have actual knowledge that we sell or share the personal information of anyone under 16.

You can opt out in five ways: decline the tracking prompt when it first appears; switch Ads measurement off in Profile, under MEASUREMENT; use the Do Not Sell or Share page; email hello@checkparanoia.com; or turn on Global Privacy Control in your browser, which we honour automatically on checkparanoia.com. The first two take effect immediately. We act on an emailed request within 15 business days. You do not need an account to opt out on the website. Once you opt out, we wait at least 12 months before asking you to opt back in.

On checkparanoia.com we honour Global Privacy Control: when your browser sends the signal, our gate route never loads the Meta pixel for that browser, and our server sends no Conversions API event for that request — the signal decides whether the pixel loads at all, it is not a promise we apply after the fact. Under 11 CCR §7011(e)(3)(F), we disclose that the signal applies to that browser or device, not to your account, because a signal cannot identify who you are across devices. The app has no equivalent browser signal; in the app, the ATT prompt and the Ads measurement switch in Profile are the controls, and each applies to that device only. You have the right to know, to delete, to correct, and to be free from discrimination for exercising any of them.

We give every user these controls, whether or not California law requires it of a company our size.

How to revoke consent or request deletion, wherever you are. Email hello@checkparanoia.com and say what you want done. We will answer within thirty days.

Three things you can do yourself, without waiting for us:

• —Deleting the app removes everything held on the device: your preferences and privacy lens, your search and filter state, and the device’s own copy of your watchlist. Turning an alert off, or removing that entity from your watchlist, removes it from the server-side alert list right away. The push token record itself is not removed the moment you delete the app — deleting the app makes it permanently undeliverable, and it is disabled after the next delivery attempt to it fails, not at the moment of uninstall, and is then kept in that disabled state (see HOW LONG WE KEEP IT above). Deleting your account removes everything linked to it on our servers, apart from the two purchase records described in HOW LONG WE KEEP IT above; if alerts are turned on, the app keeps them working on that device afterward, re-registered with no link to any account, unless you turn them off first.
• —Deleting your account — Profile → ACCOUNT → DELETE ACCOUNT, in-app, immediate and irreversible — removes what is held against the account, which deleting the app does not touch: your email address, your account ID, and the synced watchlist slugs and timestamps stored against it. Deleting the app alone does not remove these; they are deleted with your account.
• —Your purchase record belongs to Apple and is managed through your Apple ID. Note that deleting your account does not cancel an Apple subscription — cancel that in iOS Settings → Subscriptions.

The controls described under YOUR RIGHTS above — declining the tracking prompt, the Ads measurement switch in Profile, Global Privacy Control on this site, and email — are also gathered on one dedicated page, built for a reader who arrives here with no other context: Do Not Sell or Share My Personal Information. No account is required to use it.

Paranoia scores companies, and the sources below are the evidence behind those scores. To be explicit, because the phrase “data sources” invites the wrong reading: this is data about companies, not data about you. None of it is collected from users, and nothing you do in the app is sent to any of them.

• —ToS;DR ↗ — CC BY-SA
• —PrivacySpy ↗ — CC BY
• —Privacy Guides ↗ — CC BY-SA
• —Wikidata ↗ — CC0
• —GeoNames ↗ — CC BY 4.0
• —Atlas of Surveillance ↗ — CC BY 4.0
• —Blacklight (self-run scans) ↗ — —

Never a purchased or scraped dataset.

The list above is the sources we redistribute under a specific licence. The evidence base is wider than that: it also draws on companies’ own policies and disclosures, App Store privacy labels, Have I Been Pwned, SEC and FTC filings, state attorney-general and regulator records, CourtListener (Free Law Project), and congressional records — Congress.gov, House and Senate roll calls, OpenFEC, the Senate Lobbying Disclosure database, and the public-domain unitedstates/congress-legislators registry. None of these carries a redistribution licence of its own; we cite the specific filing, record or report beside the claim it supports.

Every score shown in Paranoia is our editorial opinion, derived from public sources and applied consistently through a published, weighted rubric — it is not a legal or regulatory finding. Every individual claim links to its primary source so you can verify it yourself.

This policy changes when the app or the site changes. When it does, the “Last updated” date at the top of this page changes to reflect it, and the current version is published here.

We will not make changes that expand what Paranoia collects without updating both this policy and the in-app App Privacy disclosure to match.

We review this policy at least every twelve months whether or not anything has changed, so that the date at the top means something.

On 2026-09-22, this policy was updated for in-app feedback: the Feedback screen lets you send a bug report, feature request, idea, a note that something is wrong on a company page, or anything else, with an optional reply-to email if you want us to write back. What you send is stored against your account ID, kept until you delete your account, and deleted along with it. The feedback message and reply-to email fields are masked in session recordings, matching the fields already masked above, and PostHog receives only the kind of feedback you sent, never the message or the email. The list of everything that can leave your device is now ten things instead of nine.

On September 24, 2026, we made signing in optional again on iPhone, starting with version 3.4. You can browse, search, open any company or official’s file, keep a device-local watchlist, turn on alerts, and buy Paranoia Plus without an account; sign-in is no longer required for any of that. Signing in is still the only way to send feedback. If you turn on alerts before signing in, the push token and the entities you watch are stored on our server not linked to your identity, and stay that way unless and until you sign in. If you delete your account, any alerts still turned on keep working on that device afterward, re-registered with no link to any account, unless you turn them off first. The single ten-item list this section used to describe no longer applies the same way to everyone who uses the app, so it is now two lists: five things that leave your device whether or not you sign in, and seven more that leave it only if you sign in — twelve altogether. The Android app has not shipped this change yet; it still asks you to sign in before you use it, and this update does not apply to it.

On September 29, 2026, this policy added a WEB APP (APP.CHECKPARANOIA.COM) section describing the separate web app at app.checkparanoia.com: what it stores in your browser, that it sets no cookie of its own, your analytics choice and what happens only after you accept it (PostHog, on EU servers, never linked to your account, no session recording), and every other service it contacts. The enumeration and headings above are now scoped explicitly to the app installed on your iPhone or Android device, and the YOUR RIGHTS passage that used to say there is no cookie and no local storage to agree to now distinguishes the installed app (which sets neither) from the web app (which uses strictly necessary browser storage without consent, and analytics storage only after you accept).

On September 30, 2026, this policy added what the EU and UK data protection rules ask a privacy policy to say, ahead of Paranoia becoming available in the European Union: the legal basis for each use of your data, not only for measurement; that Stack Holdings LLC and Supabase, which stores accounts, watchlists, alert records and feedback, are in the United States, and the safeguards each transfer relies on; a new HOW LONG WE KEEP IT section, including two records that deleting your account does not remove and device records for alerts that we do not yet delete automatically; how to use your rights and where to complain; that you do not have to give us any of this data; and that we make no automated decisions about you. It names the controller’s postal address and explains why the App Store lists Diego Fill as the developer. It also corrects the description of the app’s update check, which does send a random identifier for your install and your IP address, and the PROCESSORS description of what PostHog is given. Nothing the app collects has changed: five things can leave your device whether or not you sign in, and seven more only if you sign in, twelve altogether.

On October 1, 2026, this policy disclosed that opening a company page on the web app also contacts Supabase once, to check whether you are looking at the most current version of that page, carrying only the page’s name. Nothing else the app or the web app collects has changed, so the list of everything that can leave your device is unchanged: five things whether or not you sign in, and seven more only if you sign in, twelve altogether.

On October 2, 2026, this policy added error reports to product analytics, in the app and on the web app. When product analytics is on in the app, or after you accept analytics on the web app, and only then, PostHog also receives a short report when something fails: the kind of error, a shortened message with email addresses, the query part of web addresses and long runs of digits removed, the places in the app’s own code that led to it, the page path, the app’s version and your platform. We never attach what you typed into search, notes, or anything else you wrote, and the app sends at most 10 error reports per session. Error reports travel with the PostHog item in the list of everything that can leave your device, to the same recipient and under the same switch, so that list is unchanged: five things whether or not you sign in, and seven more only if you sign in, twelve altogether. Because what the web app’s analytics choice covers has changed, the web app asks for that choice again.

On October 2, 2026, we began keeping our own record of each Paranoia Plus purchase event (clarified in SUBSCRIPTIONS AND PURCHASES, DELETING YOUR ACCOUNT, HOW LONG WE KEEP IT and the EU/UK legal-basis list). It holds no email, name or advertising identifier, and the parts that identify you are removed when you delete your account.

On October 5, 2026, this policy disclosed that when product analytics is on in the app, or after you accept analytics on the web app, and only then, PostHog also receives the text of a search that returns no companies, trimmed, lowercased and cut to 40 characters, and never sent if it looks like an email address, a phone number, a web address or a similar identifier. A search that finds companies never sends what you typed. This travels with the PostHog item in the list of everything that can leave your device, to the same recipient and under the same switch, so that list is unchanged: five things whether or not you sign in, and seven more only if you sign in, twelve altogether.

On October 5, 2026, this policy disclosed what is stored when you redeem a creator code such as WATCHERS, in the web app during onboarding or from Profile → REDEEM A CODE once you are signed in: your account identifier, the code, a one-way hash of your email, the days granted and the time. We may tell a creator or partner platform how many times a code was redeemed, never who redeemed it. The record is deleted with your account. This adds a record kept on our server only if you redeem a code; it is not a new category of data that leaves your device, so the list of everything that can leave your device is unchanged.

On October 5, 2026, watching and alerts became two separate controls. The WATCH button adds a company or official to your watchlist, which is unlimited for everyone and, on its own, sends nothing to our alert list. The bell next to it turns alerts on, and only an alert stores the push token and the entity on our server, exactly as before. Free users can have alerts on for 3 companies and officials at a time; Paranoia Plus makes alerts unlimited. This changes what turns on an alert, not what is collected, so the list of everything that can leave your device is unchanged.

On October 9, 2026, referral codes and creator codes, and what is stored when you redeem one, became limited to the Paranoia web app. The iPhone and Android apps do not offer them, and signing in on iPhone no longer unlocks a referral program. On iPhone and iPad, App Store offer codes are redeemed through Apple. This removes a way to cause the records described above on iPhone and Android; it adds no new data collection, so the list of everything that can leave your device is unchanged.

On October 8, 2026, we added an optional weekly digest notification, sent on Sunday evening in your device's local time when something new is on file for companies you have alerts on or a settlement notice opens. To send it in your evening, the app now also sends our server your weekly digest setting and your device's time zone offset (minutes from UTC, not your location), alongside your alert picks and only once notifications are allowed, and we keep a send record for 60 days. Watching a company without an alert still sends nothing to our alert list. You can turn the digest off in Profile under Alerts. This adds fields to the alert record described above, which travels with the alert item in the list of everything that can leave your device, so that list is unchanged: five things whether or not you sign in, and seven more only if you sign in, twelve altogether.

On October 13, 2026, Meta’s on-device advertising SDK began also reporting to Meta that you finished first-run setup and, if you subscribe to Paranoia Plus, the purchase: which plan, the price charged and the currency. These reports are sent whether or not you allowed tracking, carry no email address, account identifier or transaction identifier, and are not sent on devices set to the EU, the EEA or the UK or after you switch measurement off in Profile. RevenueCat’s separate server-side purchase event is unchanged and still sent only when you allowed tracking. The number of paths by which data reaches Meta is unchanged at five.

Questions about this policy or requests under it: hello@checkparanoia.com. If you believe any claim, score, or piece of information in Paranoia is inaccurate, the same address is the corrections channel — it is the one shown in-app on both the About and Methodology screens. You can also reach us from the in-app Feedback screen, opened from the feedback button in the app’s navigation bar or from Profile → SEND FEEDBACK.

Last updated October 13, 2026.