Privacy

Sign-in isn't available yet. The sections on signing in, cookies and the bot check describe how it will work when it launches.

Looking up firms

Looking up firms needs no account and sets no cookies.

Signing in (only to suggest a firm)

You sign in with Google. Google gives us a unique, random-looking ID number for your Google account. We immediately turn it into a scrambled code (a keyed hash) and store only that code, so even our database doesn't hold your Google ID. We never ask Google for your email address. Google also sends your name and profile picture during sign-in; we discard them immediately and never store them. We don't post anything or read anything else from your Google account.

Cookies

Signing in sets one cookie, __Host-sid, that keeps you signed in. It is strictly necessary, lasts at most 30 days, and is deleted when you sign out. While you sign in, a second cookie (encrypted, about 10 minutes) protects the sign-in step and is then removed. We use no advertising or analytics cookies.

Bot check

The suggestion form uses Cloudflare Turnstile, a Cloudflare script that runs only on that form, to tell people from bots. Cloudflare processes technical signals such as your IP address, browser user-agent, and connection fingerprint for this check, under Cloudflare's Turnstile privacy addendum. Turnstile gives our site a one-time token; it doesn't set a cookie on our site.

What we keep, and for how long

• Your suggestions are about firms, not people, and may stay after your account is gone.
• We link a suggestion to your account only for limits and status. That link is removed 30 days after the suggestion closes.
• A scrambled, day-specific code of your IP address is used for rate limits and deleted after 7 days.
• Audit records may hold your account's code for up to 12 months.
• Accounts with no activity for 24 months are deleted.
• We never show who suggested a firm.

Deleting your account

Use "Delete my account" on your account page. We immediately delete your sign-in sessions and your account record, and unlink your suggestions. Remaining audit references expire within 12 months. For any other data request, use the dispute/correction form.