Privacy Policy

The short version

• We don't sell, rent or trade your data. We don't run ads. We don't track you across the web or build a profile of you.
• The personal data we store is what you give us: the email you sign in with, the email addresses and usernames you ask us to scan, and the results — so you can see them in your dashboard. Beyond that, your account holds only what's needed to sign you in securely (including the IP address and browser type of each sign-in) and a record of your payment.
• We count visits and clicks on our own site to learn what works. Nothing in those counts says who you are: no account, email address, IP address or device details are recorded with them.
• Payment is handled by Paddle, our Merchant of Record. We never see your card number.
• You can delete your account and all associated data at any time.

Who we are

Ramu LLC, trading as EraseYourself.Online ("we", "us") runs EraseYourself.Online and is the controller of the personal data we collect about users of the site and service. Our address: 100 N Howard ST, STE R, Spokane, WA, 99201. For privacy questions, email privacy@eraseyourself.online.

What we collect and why

Account data. Your email address, held by our sign-in system, so we can send you one-time sign-in codes and contact you about your account.

Scan targets. The email addresses and usernames you enter into the scanner, so we can run the scans you ask for. You choose these — we do not scrape or infer them.

Scan results. The list of breaches and accounts we find for the targets you gave us, so you can work through them. With each result we keep the status you give it (such as "Deletion requested" or "Not mine"), any reminder date you set, the steps you tick, and a dated history of those changes. We don't store anything you type about a result: there is nowhere to type it. Deletion request emails are put together in your browser and copied from there; we don't send or keep them.

Payment records. Your Paddle transaction ID and when you paid, so we know your account is unlocked and can handle refunds. Card numbers and billing details are collected by Paddle, not us.

Sign-in records. When you request a code or sign in, our sign-in provider (Supabase) records your IP address and browser type (user agent) with your session, and in a security log of sign-in activity. We use these to keep accounts secure and prevent abuse.

Technical data. Our hosting providers (Vercel and Supabase) process IP addresses in short-lived request logs to deliver the site and keep it secure.

That's all of it. We don't ask for your name, address, phone number or date of birth, and we don't buy or collect data about you from anywhere else.

What we count

We count how the site is used, to see where visitors come from and which parts get used. The counting is done by our own site and our own server; no other company's code is involved. Nothing we count has your account, email address, IP address or browser details recorded with it, whether you're signed in or not.

• Where visits come from. The name of the website a visitor arrived from, such as "google.com" (never the address of the page they were on, or their search terms), and the label on the link if it's one we shared ourselves, such as "?ref=x-launch-post" on one of our own posts.
• Which pages and buttons get used. How many times each kind of page was opened (the home page, the dashboard, this page) and how many times certain buttons were pressed (Get started, Copy request email). Never a page's full address, and never anything you typed, scanned or found.
• The steps of a visit. Each time the site is loaded, your browser makes up a random number, and the pages and buttons used during that visit are recorded under it, in order, so we can see how people move through the site (for example home, then sign-in, then the dashboard). The number lives only in the open page: it is not a cookie, it is never saved on your device, and it's gone when you close or reload the tab, so it can't be used to recognise you next time. It stays the same if you sign in during the visit, but your account is not recorded with it.

The daily totals are a name, a date and a number, and we keep them. The steps of a visit are recorded with the date only (no time of day) and kept for 30 days; after that they are added into the totals and deleted. Nothing in them says who you are, and we never try to work out whose visit one was.

Who can see your data

In the app, only you can see your saved emails, usernames and results: every request is checked against your sign-in, and our database only lets an account read its own rows.

We'd rather be straight with you than overpromise: to run a scan, our servers have to read the emails and usernames you give us, so it would not be true to say we can't access them. What we commit to is that we don't: we don't browse, analyse or use what's in your account for anything other than running your scans and showing you the results. The only exceptions are when you ask us for help with your account, or when the law requires it.

Legal basis

We process account data, scan targets, results and payment records to perform our contract with you (providing the service you signed up and paid for). We process sign-in records and technical data, and keep the counts described above, on the basis of our legitimate interests in keeping the service secure, preventing abuse and understanding how the site is used. We keep payment records where the law requires it.

What we do NOT do

• No third-party analytics (no Google Analytics, no Mixpanel, no Segment). The only counting is our own, described above, kept on our own systems.
• No advertising trackers or retargeting pixels.
• No tracking you from visit to visit or across other websites, no fingerprinting your device, and no profile of you.
• No selling, renting or trading of data — personal or anonymous.
• No social login. Email one-time code only.
• No passwords — there's nothing to leak.

Who we share data with

We share the minimum necessary with a small number of providers:

• Hosting & database (Supabase / Vercel) — store your account, scans, and results and deliver the site.
• Email delivery (Supabase) — sends your sign-in codes, so it receives your email address.
• Paddle — our Merchant of Record. Paddle sells you the product, processes your payment, and handles tax, invoicing and refunds. When you open checkout we pass Paddle your sign-in email (to pre-fill the form) and your account's internal ID (so the payment unlocks the right account). Paddle is an independent controller of the payment data it collects; see Paddle's privacy notice.
• Have I Been Pwned — receives the email addresses you ask us to check for breaches.
• Our username-search server — a server we run ourselves that receives the usernames you ask us to check.
• Public websites — to check whether a username exists, that server requests the matching profile page on about 3,000 public websites (for example, github.com/yourname). Each site sees a request for that username coming from our server — not your IP address, your email or your account. Those sites may log the request under their own policies.
• Advisers and authorities — our professional advisers where needed, and authorities where the law requires it or to protect people's rights and safety.

We do not sell, rent, or trade personal data with anyone.

International transfers

Our database and hosting run on servers in the United States. Where personal data leaves the UK or EEA, it's protected by our providers' standard contractual clauses (or an equivalent safeguard recognised by law).

How long we keep data

Scan results stay in your dashboard for as long as your account exists so you can come back and re-check them. When you delete your account, everything tied to it is deleted from our database immediately: your account, saved emails and usernames, scan results (with their statuses, reminders and history), payment records, sign-in sessions, and your entries in the sign-in security log (including their IP addresses). It's removed from backups within 30 days. Short-lived request logs kept by our hosting providers expire automatically under their retention settings (currently within 7 days). Paddle keeps transaction records for as long as tax law requires. Our usage counts aren't recorded against your account, so deleting your account doesn't change them; the steps of individual visits are deleted after 30 days in any case.

Security

We use encryption in transit (HTTPS) and at rest, strict per-user access controls in our database, and we never store passwords or card details.

Cookies and local storage

We don't use tracking or advertising cookies, and our usage counts don't use cookies or store anything on your device. Your browser's local storage holds your sign-in session, which is essential for the service to work; signing out removes it. It also remembers that you closed the "What to do" guide on your results, so it isn't shown again. While a tab is open, your browser also remembers how far you had scrolled on each page, so going back returns you to the same spot; that is cleared when you close the tab. When you open checkout, Paddle may set cookies needed to process your payment — see Paddle's privacy notice.

Your rights

You can access, correct, export or delete your data, restrict or object to how we use it, and withdraw any consent — email us and we'll respond within one month (usually within 7 days). You can delete your account yourself from your account page at any time. If you're in the UK or EU, you can also complain to the Information Commissioner's Office (UK) or your local data protection authority. We give the same rights to everyone regardless of location, because it's simpler.

Contact

Privacy questions: privacy@eraseyourself.online