Poof Links
Self-destructing urls for sending sensitive information.
Score
Notes
The policy does not mention behavioral marketing.
Even if there is a reasonable delay before the data is fully deleted (as is common), the data still counts as "permanently deleted" and satisfies the parameters for this question.
Score
Citation
"A secret message can only be retrieved within the window of time specified by the submitting party, up to a maximum of 7 days, and secrets that have not been retrieved within the designated window are considered 'expired'. Secrets are wiped from our servers once viewed, and secrets that expire are immediately inaccessible and are permanently removed from our database within two (2) minutes of their expiration."
Score
Notes
There is no mention of law enforcement anywhere in the policy.
This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).
Note that whether the policy allows sharing aggregated user data does not affect this question.
If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).
If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).
Score
Citation
"Your data stays on our servers - we don't sell or lease your data to any third party."
Notes
The policy indicates that the data is not sold or leased to third parties, but does not mention if it is (or is not) shared.
Note that all companies operating in the EU are subject to Art. 33 of the GDPR, which requires companies to notify their data protection authority of a data breach within 72 hours of discovering it.
Score
Citation
"Unsurprisingly, we collect the secret messages you submit to us. While we don't use cookies, we do log IP addresses to monitor usage and prevent abuse."
Notes
The service collects so little personal data that notification would not be possible.
Score
Citation
Effective: November 18, 2020
Notes
A "Last modified" date is present at the start of the policy.
Score
Notes
The service only collects IP addresses, so notification would be impossible.
Score
Citation
"Your secret message is never written into our server logs, and we never write unencrypted messages to our databases."
Notes
The policy provides information regarding keeping messages obscured from system operators, but nothing specific about the security practices surrounding the collected IP addresses.
Score
Citation
"Unsurprisingly, we collect the secret messages you submit to us. While we don't use cookies, we do log IP addresses to monitor usage and prevent abuse."
Score
Citation
"Unsurprisingly, we collect the secret messages you submit to us. While we don't use cookies, we do log IP addresses to monitor usage and prevent abuse."
Some services allow users to opt-out or opt-in to of non-critical collection or use of personal data, such as collecting data for personalized advertisements.
Score
Notes
The policy states that only the data necessary for submitting a message is collected.
This includes the use of data brokers and independent verification authorities (such as background check providers).
Score
Notes
The service doesn't have enough information to identify users.
Last Updated
August 19, 2021
Sources
Contributors
