Privacy
What WhatTerms does — and doesn't — collect.
We rate other services' policies, so we hold ourselves to the same standard. Plain English, concrete specifics.
Accounts
WhatTerms has no accounts, no logins, and no user profiles. There is nothing for us to tie a session to a real person by.
Analytics
We use Vercel Web Analytics, which is cookie-free and processes aggregated, anonymized traffic data only. Before sending page-view events we strip any query string from /scan URLs, so the address you pasted into the scanner never leaves your browser in an analytics event.
On-demand scans
When you use /scan, WhatTerms fetches the URL you provide, extracts the Terms of Service and Privacy Policy text, and sends those documents to our AI provider for analysis. The result is displayed to you and discarded — we do not store the URL, the extracted text, or the generated report on our side.
We apply short-lived rate limiting (tens of scans per hour per visitor) to prevent abuse. The limiter hashes your IP with a server-side secret; the plaintext IP is never written to storage.
Browser storage
The only thing we keep in your browser is a localStorage entry called whatterms-recently-viewed. It's a short list of the last 5 service pages you opened, used to show the "Recently viewed" row. You can clear it any time from your browser's storage settings; we can't see it.
Directory data
The services in the directory are public companies' published policies, scored against an openly documented rubric. Scoring happens in a backend pipeline that reads the public policy URLs; no user input is involved.
Data we share
We don't sell, rent, or share data. Our infrastructure providers (Vercel for hosting and analytics, Supabase for the directory database, the AI gateway for /scan inference) process traffic to the extent needed to serve requests.
Contact
Questions or requests about this policy: open an issue on the GitHub repository.