Privacy Policy

Effective November 3, 2026

StrikeMyData is operated by Brook Baston, doing business as StrikeMyData ("we," "us"). This policy explains what we collect, why, who receives it, and the choices you have. Our purpose is to help you remove your information from data brokers, so we collect as little as we can and protect what we hold.

Information we collect

Account information: a username and password. We store only a one-way hash of your password, never the password itself. If you turn on two-factor authentication, the secret your authenticator app uses is stored encrypted, and your backup codes are stored only as one-way hashes. Your recovery key, which you save when you sign up, is never stored; we keep only a copy of your encryption key that the recovery key unlocks.

Information you ask us to remove: your full name, other names you've used, email addresses, phone numbers, current and past addresses, state of residence, and optionally your year of birth. You choose what to provide.

Your contact email, which we verify and which receives brokers' replies.

Email preferences: whether you asked for account reminders or follow-up emails, and when. If you turn either on, we keep a second copy of your verified contact email, encrypted with a key our servers hold, so we can email you while you're logged out. If you turn on follow-ups, we also keep the number of sites your exposure check found you on, but not which ones. Turning both off deletes the copy and the number.

Your agent authorization: the authorization text, the name you typed to sign it, and the date and time.

Request tracking: which sites you contacted, the dates, status, a reference number for each request, and any notes you add.

Exposure check results: which people-search sites you marked as listing you, and when. You run these searches yourself in your own browser; we don't visit those sites for you.

Replies from data brokers: requests ask brokers to reply to a dedicated address we operate, as well as to you. We match each reply to your request, store it encrypted so only you can read it, and then delete it from that mailbox.

Support messages: what you write when you contact us, and the email address you give for our reply. These are encrypted so that only our support staff can read them.

Payment: if you buy a plan, Stripe collects your payment details directly. We never see or store your card number. We keep your plan, its status and renewal date, and Stripe's customer and subscription references, so we can tell whether you're covered. For a Duo plan, each person's account stays separate; the plan holder sees only the other person's username.

Activity records: we log events such as sign-ins, requests sent and payments, tied only to an internal account number, never to your name or contact details. We use them to keep the service running and secure.

Technical information: our application logs record the time, page and result of each request, not your IP address. Our hosting and network providers may process your IP address in transit in order to deliver the site.

We use one cookie, which keeps you logged in. We don't use advertising cookies or tracking pixels. We don't use analytics.

How we use it

Only to provide the service: to create and secure your account, to send the deletion and opt-out requests you choose, to let brokers locate and verify your records, to verify your email address, to track and suggest statuses for brokers' responses, to answer your support messages, to process payment, and to prevent fraud and abuse. We don't use your information for marketing, profiling or training AI models.

Who receives it

Data brokers you select. Each request necessarily includes the identifying details on your profile and your signed authorization, so the broker can find and delete your records. That's the core of the service, and it happens only for the brokers you choose.

Service providers that help us run the service, under obligations to protect the data: our hosting provider, our email provider (which carries requests, verification emails and support replies, and briefly holds brokers' replies until we process them), our network provider (which delivers the website securely), and Stripe (payments).

Our support team, only if you choose. Support can see account details that aren't encrypted (such as your username, plan, sign-up date, which sites you've sent requests to and their statuses, and the activity log), but not your profile, notes or brokers' replies. If you want help with those, you can share specific items on a support ticket. They're encrypted so only support can read them, and deleted when the ticket closes or after 30 days, whichever comes first. You can withdraw them sooner.

Legal requirements. If we're legally compelled. Because your profile is encrypted with a key only your password unlocks, we generally can't read it ourselves.

We do not sell or share your personal information, as those terms are defined in California law, and we never have.

How we protect it

Everything you enter about yourself, plus your tracker notes, exposure results, authorization and brokers' replies, is encrypted before it's stored, using keys only your password unlocks. Brokers' replies are encrypted the moment they arrive, with a key that can lock them but not unlock them, so they stay unreadable until you log in. We store neither your password nor that key. While you're logged in, the unlocked key exists only in the server's memory, and it's discarded when you log out or after 30 minutes of inactivity. The site is served only over encrypted connections. No system is perfectly secure, but a copy of our database alone can't reveal your information.

As a result, we can't reset a forgotten password. The recovery key you save at signup lets you set a new password yourself. If you lose both your password and your recovery key, your stored information can't be recovered and you'll need a new account.

The exception you can choose: if you turn on email reminders or follow-ups, the copy of your contact email described above is encrypted with our key rather than yours, so we can read it to send those emails. Nothing else in your profile is.

How long we keep it

Until you delete your account, which you can do at any time from My information, removing everything immediately. Accounts with no login for 2 years are deleted automatically. Support conversations are kept for up to two years after they close, so we can answer follow-ups and keep a record of privacy requests, and are unlinked from your account if you delete it. Because your contact email is encrypted, we can't send a warning first. Encrypted backups are kept for up to 14 days and then overwritten, so deleted information leaves our backups within that window.

Your choices and rights

You can view and correct your information on My information and delete your account there at any time. Depending on where you live, privacy laws may give you rights to know what we hold, get a copy, correct it, delete it, limit the use of sensitive information, and opt out of its sale or sharing. We honor these requests for everyone, whether or not a particular law applies to us. We won't charge you, give you a lesser service, or treat you differently for exercising any privacy right.

How to make a request

The fastest way is through your account, since we can't decrypt your profile ourselves. You can also email [email protected], and you don't need an account to ask. We'll confirm who you are using details already tied to the account, such as a code sent to your verified contact email. Someone else can make a request for you with your signed permission, or with a valid power of attorney.

We'll respond within 45 days. If a request is complicated and we need up to 45 more, we'll tell you why within the first 45. Requests are free.

If we say no

If we deny any part of a request, we'll explain why in writing. To appeal, email [email protected] with "Appeal" in the subject line and tell us what you think we got wrong. We'll answer in writing within 45 days. If we deny the appeal, you can contact your state attorney general, or in California, the California Privacy Protection Agency.

If the business is sold

If StrikeMyData is sold or transferred to a new owner, your account and encrypted information transfer with it, and the new owner must follow this policy for the information transferred. We'll post a notice on the site at least 30 days before the transfer, and subscribers will also get an email at the address they gave Stripe. You can delete your account at any time before or after. Because your information is encrypted with your password, the transfer doesn't let anyone read it. Your agent authorization names the business that runs the service, so after a transfer no new requests are sent for you until you sign a new authorization naming the new owner.

Emails we send

Without your consent we email you only what you ask for (a verification code), what your plan requires (receipts and renewal notices, sent by Stripe, and a confirmation when you subscribe), and replies to your support messages. With your consent: account reminders (a broker replied, a deadline passed, it's time to recheck, and a summary before your plan renews), and separately follow-ups about your exposure results and privacy tips, which stop once you have a plan and after at most three messages per check. Every reminder and follow-up has a one-click unsubscribe link, and you can change these choices any time under Account.

Do Not Track and Global Privacy Control

We don't track you across sites or sell or share your information, so browser Do Not Track and Global Privacy Control signals don't change anything we do. We still treat them as valid opt-out requests.

Who can use the service

The service is for adults (18 or older) who live in the United States. It isn't directed to children, and we don't knowingly collect information from anyone under 18. It isn't offered to people in the European Union or the United Kingdom.

Changes

If we make a material change, we'll update the effective date and show a notice when you next log in. Continuing to use the service after that means you accept the change.

Contact

Brook Baston, doing business as StrikeMyData · [email protected]

Back