Privacy

Analytics

In production, Google Analytics records page views and a small set of product events (for example, that a comparison was viewed); it sets Google's standard analytics cookies. We also keep our own record of the same kind of events - which pages were viewed, which buttons were clicked, and outcomes such as a claim being verified - in our database, tied to a random identifier in a first-party cookie (hv_vid). That record holds no name or email; it exists so we can see where people get stuck on the way to signing up. You can block either kind of cookie without losing any functionality on this site. We use analytics to understand which pages and tools are useful - never to build advertising profiles. Preview and local builds run without Google Analytics.

Accounts and sign-in

Signing in works by emailed magic link. There are no passwords - we never ask for one and never store one. A successful sign-in sets an httpOnly session cookie whose only job is to keep you signed in. For a buyer account we store your email, your plan state, and (on team plans) the emails of teammates you invite. For a vendor claim we store the claimant's name and work email, which we use to verify the claim against the company's domain.

Forms, watches, and intro requests

Everything a form collects is what the form shows, stored for the purpose you submitted it for:

• The vendor-request tool stores the vendor name, the category you selected, and - only if you choose to provide it - your email, used solely to tell you when the profile publishes.
• Watching a vendor stores your email and that vendor. Every alert we send includes a one-click unsubscribe that deletes the watch.
• Requesting an intro stores your email and optional note, and we share both with that vendor - that is the introduction you asked us to make.
• The evidence-submission flow stores the documents and business contact details a vendor submits for editorial review.
• The sales form on the pricing page stores your email and note so we can reply.

Payments

Paid plans are billed by Stripe. Card numbers go to Stripe directly and never touch our servers; what we keep is your plan state and Stripe's reference IDs so your subscription works.

Email

We send transactional email only: sign-in links, the alerts and digests you subscribed to, and billing notices. There is no marketing list, and alert emails carry their own unsubscribe.

What we do not do

We do not run advertising, sell or rent data to anyone, or share your details except where this page says so (the intro you request, and the processors below). The only third-party cookies on the site are the analytics cookies described above.

Where the data lives

The site runs on Vercel, the database is Neon (Postgres), email is sent through Resend, payments run on Stripe, and analytics on Google Analytics. Each processes data only to provide its service to us.

Corrections and deletion

To see, correct, or delete anything above - a watch, a request, a lead, or an account - contact us via the address on our About page and we will handle it.