BearScan is run by Thybris Labs. This page lists everything we collect, why, and who else touches it. We don’t sell personal information, we don’t share it for advertising, and we don’t run analytics or ad trackers.

What personal information we collect

Identifiers. Your email address. If you sign in with Google or GitHub, also the name, profile photo and account ID they share with us. Nothing else from those accounts.
Internet activity. While you’re signed in, the IP address and browser user agent of each session, so you can be signed out and so we can spot misuse.
Where you came from. On your first visit we note the website that linked to us (its domain only, never the full address or anything after it), any campaign tags on the link, such as utm_source, and the page you landed on. We keep that with a random per-browser id, and attach it to your first scan, sign-up and purchase, so we can tell which channels bring customers. It never includes your IP address.
A scrambled form of your IP address to limit how many free scans one visitor can run a day, and, if you came from our ChatGPT ad, to spot one person claiming the free report many times. We store a keyed hash of the address (and, for the ad, of your browser’s user agent), never the address itself, and it can’t be turned back into one. Posts to the lawsuit tracker are limited by address without storing it.
Commercial information. What you bought and when. Card details go straight to Stripe; we never see or store your card number.
What you give us about your business. The address of each site you scan, and your answers to the questions shown during a scan, such as where the business is based.
Messages you send us. If you use the support form or email us, your email address, what you wrote and, if you give one, the page it’s about. We use it to answer you.
An address for a report email. If you ask us to email the report of a scan that’s still running, the address you give. We keep it with the scan, send that one email, and use it for nothing else.
Lawsuit tracker posts. Whatever you type into the form, and any file you upload as evidence. Posts are anonymous: we don’t ask who you are.

We also store the public pages, screenshots and findings from the sites you scan. Those are about a website, not about you.

Where we collect it from

From you, when you scan a site, answer a question, buy a report or post a claim.
From Google or GitHub, only if you choose to sign in with them.
From Stripe, which tells us whether a payment went through.
From your browser, which sends its IP address and user agent with every request.
From public court records on CourtListener, for the lawsuit tracker. Those name the business that was sued, not people.

How we use it

To run your scans and show you the results, to keep you signed in, to take payment and send receipts and reports, to email you about your sites (you can turn off anything that isn’t a receipt or a report you bought), and to stop abuse such as one client starting hundreds of free scans.

How we share it

We share personal information only with these categories of service providers:

Hosting and email: Cloudflare hosts the site, runs our scanner, stores our database and files. Resend sends our emails.
Payments: Stripe.
Reading scanned pages: the text and screenshots of the public pages we scan go through OpenRouter to AI models (Typesafe’s Jev, Google Gemini and DeepSeek) that classify each page, read its legal documents and check what a person would otherwise check by eye. These are pages of the website you scan, not information about you.
Sign-in providers: Google and GitHub, only if you sign in with them.
Advertising measurement: OpenAI, only if you came from our ChatGPT ad. When you arrive from an ad on ChatGPT, we tell OpenAI when you start a scan, sign up, claim the free report or pay, using only the click reference OpenAI added to the link and the amount. Never your name, email, IP address, browsing data or the sites you scan.
Site icons: DuckDuckGo serves the small icons shown next to your sites. Your browser asks DuckDuckGo for the icon of each site’s domain.

We’ll also disclose information if the law requires it.

We don’t sell or share your personal information

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising, as California law defines those terms. So there’s nothing to opt out of.

Sensitive personal information

We don’t collect sensitive personal information as California law defines it: no government ID numbers, account passwords, precise location, health, or financial account details. Stripe handles card numbers, and we never receive them.

Cookies

Only the ones needed to keep you signed in, plus three: one that records the ChatGPT ad click, a random per-browser id so the free report can be claimed once per browser, and one that remembers where you first came from (the referring site’s domain and campaign tags), for 30 days. We keep only a keyed hash of that id, with the free report it claimed, and never share it. Details are on our cookie policy.

How we keep it safe

Everything between your browser and us travels over HTTPS.
Our database and files sit on Cloudflare, encrypted at rest. Only our own services can reach them; the scan API isn’t open to the public internet.
There are no passwords to leak. You sign in with a one-time email link, Google or GitHub, and sessions can be ended by signing out.
Keys and secrets are stored as encrypted secrets, never in our code.
Each account sees only its own sites. Evidence uploaded to the lawsuit tracker is never published.

How long we keep it

For each kind of information:

Your account, sites, scans and answers: until you delete them or ask us to. Email hello@bearscan.app from the address on your account and we’ll delete everything within 30 days.
Sessions: until you sign out or the session expires, whichever comes first. Sign-in links expire after 15 minutes.
Purchases: for as long as tax law requires us to keep the record.
Support messages: until you ask us to delete them, which you can do by emailing hello@bearscan.app.
Lawsuit tracker posts and evidence: until you ask us to remove them.
Hashed IP and device records used to limit free scans and stop abuse of the ad offer: until you ask us to delete them along with your account.

Your rights

Wherever you live, you can ask us what we hold about you, for a copy of it, to correct it, or to delete it, and we won’t treat you differently for asking. This covers the rights given by laws like the GDPR and the California Consumer Privacy Act. If you’re in the EU or UK, you can also complain to your data protection authority.

Children

BearScan is a tool for businesses and isn’t meant for anyone under 16.

Contact us

For anything about your data or this policy, email hello@bearscan.app, or write to BearScan, 7700 Windrose Avenue, Plano, TX 75024. We reply within 10 business days.

Changes

If this policy changes, we’ll update the date at the top. If a change affects how we use data you’ve already given us, we’ll email you first. See also our terms.

Privacy policy