How it works

We find an app's terms and privacy policy, keep a copy, and have an AI reader pull out the lines that matter and answer 15 fixed questions about them. The reader must back each answer with a line we check word for word against the document; an answer we cannot verify scores no better than "not stated". The score and letter are then computed by fixed rules, so the same answers always give the same grade.

The 15 questions

Grades

Every app shows a traffic light: green "Low risk" for a score of 48 or more (grades A+, A, B), amber "Medium risk" for 34 to 47 (C, D), red "Highest risk" below 34 (F). On the tier list, A+ is shown as S. The letter and the score stay on the page under "How we got here". A+ ≥ 64 · A 56–63 · B 48–55 · C 40–47 · D 34–39 · F below 34. Each report keeps the score calculated from its policy documents. A few practices still cap the letter no matter the total: No accessible privacy policy (max F); Uses your content for AI training with no opt-out (max C); Shares data with data brokers (max D); Sells or shares your data with no opt-out (max D); Exposed database or plaintext chats in the last 24 months (max D); Fined by a regulator for data practices in the last 24 months (max C).

Scam warnings, for apps that can act

Most apps only store data. A few can also buy, book, click, or send for you. For those apps, the 15 policy questions are scaled to 90. The other 10 points ask one thing: does the company's own page say the agent refuses an unsafe website? If it does not, those 10 points are zero, and the report says the app may transact on unsafe websites on your behalf. Apps that cannot act keep the original 100. Their grade does not change.

The score reflects what the company says on its own page, not a test we ran. If that page is wrong or outdated, you can report it from the app page.

Reading level

We also measure how hard the documents themselves are to read, with no AI involved. We count the words, sentences and syllables and apply the Flesch reading ease formula; the reading time assumes 230 words a minute. Most privacy policies score between 30 and 50, which is college level or harder. This measure is shown for information and does not change the grade.

Words to know

The words to know list is a fixed glossary of about 50 legal and privacy terms, each explained in one plain sentence with an everyday example. A term appears only when it shows up in one of the quoted lines on the page, so the list is different for every app. We wrote the glossary ourselves; the AI does not touch it.

Account discovery

When you enter your own email or username, we check public profile pages and account-signup endpoints on a few hundred sites using the open-source user-scanner project (MIT) plus the WhatsMyName dataset (© Micah Hoffman, CC BY-SA 4.0): about 140 sites for an email address and 940+ for a username. Checks that would email the address are never run. "Couldn't check" means a site blocked us, not that you have no account. We store submitted email addresses, connected Gmail addresses and waitlist signups with their source and timestamp. These email records are retained separately from scan results, which expire after 7 days. Usernames are hashed.

Where the app list comes from

The apps in the library were read from a starting list of the 100 most used US apps published by the open-source FinePrint TOS Analyzer project (MIT) and the companies in its public fine-print.org library, plus the AI apps we track ourselves. The reading-level measure and the words-to-know idea were inspired by the Terms Guardian browser extension; none of its code or text is used here. Anyone can add an app by pasting its link on the home page.

Our own privacy

Gmail account discovery

If you connect Gmail, Google asks for the gmail.modify permission, the same one Norton Family Assistant uses. We cannot request a read-only scope for this integration. Today we only use it to search for emails from apps in our catalog over the last two years and to read their sender, subject, date, and authentication headers. We also read your Gmail address to show which inbox was searched. We do not fetch message bodies or attachments. We do not send mail, delete anything, or change your mailbox. We request the broader permission now so we can send opt-out and deletion requests for you once that feature is built. Until then, we do not use the extra permissions.

This search runs in your browser. Gmail tokens, email metadata and discovery results are kept in memory for the page session, rather than saved to our database or browser storage. Your connected Gmail address is saved on our server. Message metadata, tokens and results are not sent to our servers, search providers or AI models, used for advertising, or used to train models. Opening a policy report sends the app's name in the page URL; it does not send the email evidence. Reloading or leaving the page clears the in-memory results.

Gmail access is revoked automatically when a scan finishes or fails. Results remain in page memory until you clear them or leave. Use “Disconnect & clear results” to stop a scan early and revoke access. You can also remove access in your Google connections. Leaving the page clears the local token and attempts to revoke access. If the page closes before that request finishes, you can remove the connection directly in Google. Account emails show historical evidence; a login code alone does not confirm completed signup or a current account.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Policy scans

Policy text is sent to xAI's Grok API for reading (xAI states it does not train on API inputs and keeps requests 30 days for abuse monitoring). Policy links come from the You.com search index; we then fetch that page, or use You.com's copy of it when a site blocks automated readers. Your email or username is never sent to the AI.