Security & data

Written in English.

A privacy product you can't understand isn't a privacy product. Here is everything we collect, why each field exists, where it lives, and what we will never do. We update this page like a changelog.

How your data moves

You

name · addresses · email · phone

OptOutHQ

encrypted at the field level · disclosure log

Each opt-out target

only the fields that removal requires

Your inbox

not connected — there is no arrow to or from it, by design

Every disclosure is logged and shown to you: “we sent your name + city to Spokeo on May 12.” If a broker asks for something we don't hold, the request lands in your Action Needed queue instead of our database.

What we collect, and why

Your name

Data brokers index you by it. Removal requests fail without an exact match.

Current + past addresses

People-search sites list old addresses too. We only send each one where it's needed.

Email address(es)

To create your unsubscribe alias and tell you what we removed.

Phone number(s)

For Do Not Call registration tracking and broker removals that require it.

Year of birth

Brokers use it to distinguish you from people with the same name. Year only — never the full date.

That's the whole list. Each opt-out only receives the fields it strictly needs, and your dashboard logs every disclosure: who we sent what, and when.

Where it lives

Vercel

Hosting. Runs this site and the app.

Neon

Database. Addresses and phone numbers encrypted at the field level.

Stripe

Payments. We never see your card number.

Resend

Email. Powers your unsubscribe alias and our (rare) emails.

Optery

Broker removals. Receives only the fields a given removal requires.

What we will never do

Sell or share your data, in the CPRA's technical sense or anyone's common sense.
Ask for inbox access. Email unsubscribe works by forwarding — zero OAuth scopes.
Collect your SSN. Where a registry needs it (OptOutPrescreen), you enter it on the official site yourself.
Run ad trackers. Not on this site, not in the app, not ever.

How long we keep things

Account profile (name, addresses, phones)

Life of account + 30 days

Forwarded email bodies

Parsed, then deleted within 7 days. Sender + action kept as your opt-out log

Opt-out evidence (screenshots, responses)

Life of account — it's your record

Deleted account

Hard delete within 30 days; backups age out within 90. Confirmation email sent

Deleting everything is one button. Account settings → Delete my account. No retention dark patterns, no "are you sure" gauntlet, no survey. You'll get one confirmation email, and then we won't have anything left to email you about.

The boring technical part

Field-level encryption. Addresses, phone numbers, and birth year are encrypted with AES-256-GCM before they touch the database — a database leak would expose ciphertext, not your address.
Strict allow-lists per integration. Each opt-out target has a hardcoded list of fields it may receive. There is no code path that sends “everything.”
Forwarded email handling. When you forward spam to your alias, we parse the headers, execute the unsubscribe, keep sender + outcome as your log, and delete the message body within 7 days.
No SSNs, structurally. The one opt-out that requires a Social Security number (OptOutPrescreen) is a guided handoff to the official site. Our database has no SSN column to breach.

Last updated: June 2026 · Draft, pre-launch.