Privacy: what we collect, and why.

A privacy service should ask for as little as the job needs and say plainly what it does with it. This page is the whole list.

If you only browse

We collect nothing that identifies you. We count page views and steps of the check; each count is one line holding the page, the step and the hour, and for some steps a fixed word or two about it, such as which of the four answers you picked if you answer “What’s stopping you?”, or, on the checkout, the way you chose to pay and why a payment didn’t go through. It holds no IP address, no identifier and no phone number. The only device details a count can hold are two fixed words: when we offer to open a page in your phone’s own browser, whether the phone is an iPhone or an Android; and on the checkout, whether your browser offers Apple Pay or Google Pay. Fonts are served from our own domain. The exceptions to “nothing that identifies you” are the measurement of our ads and our session analytics, next.

Measuring our ads on Facebook and Instagram

We advertise on Facebook and Instagram. To learn which ads bring people who run the check and buy, our pages load Meta’s pixel (from connect.facebook.net). It tells Meta that a page of this site was opened, that a check was completed, that the checkout was opened and, if you start a free trial or buy, the plan and the amount. As with any page that loads Meta’s code, your browser also sends Meta your IP address and browser details, and Meta sets its own cookies here; if you are logged in to Facebook or Instagram in this browser, Meta can link these events to that account.

When you confirm your code and when you start a free trial or pay, our server also sends Meta that same event, with the same details (IP address, browser, and the values of Meta’s cookies), so it is counted once even if your browser blocks Meta’s script. Until Stripe confirms your order, these details are kept with your checkout at Stripe; then they are deleted.

Meta is never sent your phone number, your name, your email address, the result of your check or anything you type. Under some US state laws, California’s among them, this counts as sharing for advertising. You can turn it off: we honour Global Privacy Control, or use the switch below. Either one stops the pixel and our server’s copy.

Session analytics (Microsoft Clarity)

To find what makes the check or the checkout hard to use, our pages load Microsoft Clarity (from clarity.ms). It records how the pages are used (taps, clicks, scrolling, and the size of your screen) so we can replay a visit and see where people get stuck. Before anything leaves your browser, every piece of text on the page and everything you type is replaced with placeholders, and the parts that show your details (your number, the code, your results, the checkout and the details step) are hidden entirely. We never tell Clarity who you are.

As with any page that loads Microsoft’s code, your browser sends Microsoft your IP address and browser details, and Clarity sets its own cookies (below). Microsoft handles this data under its own privacy statement and keeps recordings for about 30 days. Global Privacy Control or the switch above stops Clarity from loading.

If you run the check

• Your phone number. You type it; we use it to text you a verification code and, while the code is on its way, to run one lookup (past a daily limit on these early lookups, only once you confirm the code). Before the code is confirmed we show only how many items of personal information that lookup found, never what they are, and only the number that received the code can be looked up. In the browser built into an app such as Facebook or Instagram, on a phone, the text carries a one-time link instead of a code: opening it confirms the number and opens your results in your phone’s own browser, and the lookup runs then.
• Where the number is kept. In an encrypted cookie in your own browser, which stops working 30 minutes after the text is sent. If we text you a link, our server also keeps one encrypted copy of the number for that link, with the values of Meta’s _fbp and _fbc cookies from the browser you asked from (or your choice to turn ad measurement off), so that the browser that opens the link can be told which number it confirmed; only our site can read it. It is deleted as soon as the link is opened, and a link that is never opened stops working after 15 minutes and its copy is deleted within the hour after that. If you open your report in your phone’s own browser from an app such as Facebook or Instagram, our server also keeps one encrypted copy of the number for the link that opens it (with the email address you gave us, if any, and the values of Meta’s _fbp and _fbc cookies from the app’s browser, or your choice to turn ad measurement off), so that browser can show your report; the lookup runs again there. Only our site can read the copy, never anything from the lookup is in it, and it is deleted within the hour after the link’s 30 minutes are over, or as soon as you tap for a new link. Otherwise our servers keep no copy of it. To stop the same number being checked again and again, our rate limits keep a one-way scrambled fingerprint of the number and of your IP address for about a day; neither can be read back from it.
• The lookup result. The record that comes back (name, age, addresses, relatives, email addresses, other phone numbers) is partly hidden before it reaches your screen. The first few values of each kind are kept as the lookup returned them, only in encrypted cookies in your browser, for the same 30 minutes: until you confirm the code, in a second encrypted cookie of its own (the code page is told only how many items it holds), then in the session cookie. We don’t store it on our servers or write it to logs. If you buy a plan, the details you confirm after paying go into your fulfilment record, described below; otherwise it is used for nothing else. We never ask for your Social Security number.
• On our scan page (keepmehidden.com/scan), the report shows the record as the lookup returned it, not partly hidden, and its first few values of each kind are kept that way, in the same encrypted cookies in your browser for the same 30 minutes. Nothing more of it is kept anywhere.
• The device card on that report. It shows what your browser and connection tell every site you open: your browser and system (from what your browser sends with each page), an approximate city and region (from your IP address, as our host, Vercel, reads it) and your local time (from your device’s clock). It is shown to you only: we don’t store it, log it or count it.

The breach check

After the phone check, we look your name, state and birth year up in a breach-exposure database run by a third party, to see whether a Social Security number of yours was in the 2024 National Public Data breach. That third party is not sent your phone number or your email address. Our own lookup service uses your phone number and the ZIP code and street number of your addresses only to tell your record apart from those of other people with the same name, and does not pass them on. If there is a finding, your results show it, with the name of the breach and at most the last two digits of the number, and digits only when the name on the breach record matches the name the lookup returned. We keep nothing of it: the answer is shown on that one page view and is not stored, logged, emailed or attached to an order. Reload the page and it is gone.

While the check runs, the few things it needs from the record (the name, state and age, the street number and ZIP code of each address, and up to two email addresses) are held in a second encrypted cookie in your browser. It never holds the answer, is deleted when the check ends, and stops working after five minutes.

The check itself starts only after you confirm the code. Until then, those few things wait with the lookup’s result in its own encrypted cookie, described above.

The email you give to start a removal

• Why we ask: after the check, the results page shows what came back, partly hidden, and when you choose to delete your data it asks for your email before the plans. The email holds the summary only: what kinds of details turned up and how many, never the details themselves.
• What we keep: the email address you give, the kinds and counts in your report (for example “3 addresses, 4 relatives”, and whether the breach check found something), when you asked, and which of the emails went out. Never your phone number, a name, an address or anything else from the record.
• What we send: the report at once, then at most two short follow-ups about removing your listings (3 hours and 1 day later). Nothing after that, and no follow-ups once you buy a plan.
• Where it’s kept: in private storage at Vercel, our host, filed under a code derived from your address. Resend delivers the emails. For the rest of your 30-minute visit it also waits in the encrypted session cookie in your browser, so the payment page can fill it in for you.
• How long: until you unsubscribe, when we delete your address straight away, or 90 days after the last email, whichever comes first. Every email has an unsubscribe link, or write to hello@keepmehidden.com.

If you buy a plan

• What you give us: your email address at checkout (and a phone number, if you skipped the check), then for each person the plan covers: full name, date of birth, current address and any past ones, email addresses, phone numbers, and their authorisation for us to act as their agent. The phone number you verified is attached to the order. For Couple and Family plans, the same for each person covered, each adult giving their own authorisation.
• On our scan page (keepmehidden.com/scan), the checkout doesn’t ask for your email address: you give it right after you pay, with the details of who the plan covers, and we use and keep it as below, as we would an email given at checkout. Until then, Stripe holds an address of ours in its place, which names the order and nothing about you. If you pay with Apple Pay or Google Pay, your wallet may share its email address with Stripe for the receipt.
• What we do with it: find your listings on people-search and data-broker sites and send those sites requests to delete your information and stop selling it. That means giving each site the details it needs to find your listing. We use your email to send your confirmation, a reminder before a free trial’s first charge, progress updates and replies.
• Your fulfilment record: those details are sent, encrypted, to our operations mailbox so we can file your requests, and deleted 30 days after the last request is filed. The site itself keeps no copy of it.
• Payment: card details go to Stripe; we never see or store your card number. Stripe keeps a record of the order: your email, and each person’s name, city, state, phone number and the time they gave their authorisation. Dates of birth, street addresses and the rest of the fulfilment record never go to Stripe.
• How long we keep it: the order record, while your plan is active and for 12 months after it ends, so we can answer questions about past requests; then we delete it. The fulfilment record, until 30 days after the last request is filed. Stripe keeps payment records for as long as the law requires.

If you log in later

Customers log in with their phone number and a texted code: no password. Your dashboard reads your order from our payment provider each time you open it and shows who is covered and where each request stands. Nothing about your order is stored in your browser beyond the same 30-minute session cookie.

Companies that process data for us

• Twilio sends the verification text. It receives your phone number.
• Searchbug and EnformionGO (commercial people-data providers) answer the lookup: each check asks one of the two, and the other only when the first can’t answer. The provider asked receives your phone number and returns the record it holds.
• Stripe takes the payment and keeps the order record. Card details go straight to Stripe and never reach our servers.
• Resend delivers our emails. It receives your email address and the content of the email. Your fulfilment record passes through it encrypted; Resend cannot read it.
• Microsoft Clarity records how pages are used, with all text and everything typed hidden (above). It never receives your phone number, your results or your email.
• Vercel hosts the site. Like any web host it receives the request your browser sends, including your IP address, to deliver pages and keep the site secure. It also stores the email address you give for your report, and the report’s counts (above). If we text you a link, it holds that link’s encrypted copy of your number until the link is opened or its 15 minutes are over (above). If you open your report through a link from an app, it holds that link’s encrypted copy of your number until the link’s 30 minutes are over (above).

We don’t sell your phone number, and we don’t share it or your consent to receive texts with anyone for their own marketing; the providers above receive it only to do their part of the service.

We don’t sell your information, and we don’t use it to build a profile of you. The only sharing for advertising is the ad measurement described above, which you can turn off.

Cookies

5 of our own, all strictly necessary and none readable by scripts. The encrypted session cookie described above, once you start the check. The encrypted cookie that holds the lookup’s result between the text and your code, until the results page takes it over; it stops working with the session. The encrypted cookie described under “The breach check”, for the few minutes that check runs. On our scan page’s plans, a cookie that holds one thing: the time its 20% offer ends, so that reloading the page can’t restart the countdown; it expires after a day. After you pay, a cookie that holds the first few characters of your order’s id and the time it was set, so that our checkout shows your plan has started instead of selling it to you again; it expires after 30 days. Meta’s pixel sets its own: _fbp, and _fbc when you arrive from one of our ads, each a random id kept for up to 90 days. They are not set once you turn ad measurement off, which we remember with one more cookie, kmh_ads, for a year. Microsoft Clarity sets _clck (a random id, up to a year) and _clsk (joins one visit’s pages, a day), and Microsoft may set its own MUID cookie; none of them is set once you turn measurement off. On the checkout page only, Stripe’s card form is loaded from Stripe (js.stripe.com); Stripe may set its own cookies there to prevent fraud. If you choose to finish in Safari or Chrome, the link that opens it holds no personal details. That browser gets a copy of the session cookie for the rest of its 30 minutes, and Meta’s _fbp and _fbc values from this browser so the visit is counted once (if you turned ad measurement off, it gets that choice instead). If we text you a link, the browser that opens it gets the session cookie, with your number confirmed, for the rest of its 30 minutes, and Meta’s _fbp and _fbc values from the browser you asked from so the check is counted once (if you turned ad measurement off there, it gets that choice instead). If you open your report in your phone’s own browser from an app, the link itself holds no personal details. That browser gets a copy of the session cookie for the rest of its 30 minutes, and Meta’s _fbp and _fbc values from the app’s browser so the visit is counted once (if you turned ad measurement off there, it gets that choice instead).

Not for looking up other people

The check is for your own number. Keepmehidden is not a consumer reporting agency, and nothing it shows may be used to decide anyone’s eligibility for credit, insurance, employment, housing or any other purpose covered by the Fair Credit Reporting Act.

Your choices

You can ask us what we hold about you, ask us to correct or delete it, or withdraw your authorisation at any time by writing to hello@keepmehidden.com. Withdrawing it stops new requests; it can’t recall requests already sent. Refunds are described in the Terms: in short, money back if we don’t file the first batch within 24 hours of receiving your details, and a full refund for any reason within 30 days of paying.

Other sites

Links to people-search sites and to other removal services open those companies’ own pages, under their own privacy policies. We don’t see what you type there. Links on the comparison page go through a short address on our site (it starts with /go/) so we can count the click, and may earn us a commission.

Changes and contact

Keepmehidden is operated by Augment Inc.. If this changes, this page will say so before it happens. Questions and requests: hello@keepmehidden.com. Postal address: Augment Inc., 6113 Monte Cristo Ln, Plano, Texas 75024.