LAST UPDATED AUGUST 2026
Account info: your email address, and your name/email if you sign in with Google instead of a password. We never see or store your password itself — that's handled entirely by our authentication provider, Supabase.
Scan activity: the platforms, mode, character rules, and length range you request; the usernames a scan generates or checks and their availability status; and any plain-English text you type into AGENT.
Claims: if you mark a username "claimed," we store that platform/username pair against your account, self-reported by you — we don't verify it against the platform itself.
Billing: handled entirely by Stripe. We never see or store your card number. Stripe holds your payment details under its own privacy policy; we only receive confirmation of your subscription tier.
Preferences: small local-only settings like your claim-tag color and whether you've turned decorative motion back on, stored in your browser (see Cookies & Local Storage below).
No analytics or ad-tracking scripts run on this site. No third-party advertising pixels. No tracking of you across other sites. We don't sell your data, and we never will.
To run the scanner: your account and scan data exist to let you run scans, see results, and pick up where you left off. To enforce tier limits: your subscription tier determines your monthly scan quota and which features you can access. To bill you: Stripe uses your payment details to process your subscription; we only act on the confirmation it sends us. To keep the service working: aggregate, non-identifying signals (like whether a platform is returning errors) help us keep scans running reliably.
We don't sell or rent your data to anyone. A short list of infrastructure providers process data on our behalf, each under their own privacy/security terms:
Supabase — database, authentication, and (if you use it) Google sign-in. Stripe — payment processing and billing. Railway — application hosting; standard web server logs (like IP address and request timing) pass through it as part of normal operation. Google Fonts — the typefaces on this site are loaded from Google's font CDN, which receives your IP address as part of that request, the same as any font or asset loaded from an external host.
We may also disclose information if required by law, or to protect the security of the service or its users.
We don't use advertising or tracking cookies. Your login session is kept in your browser's local storage by Supabase so you stay signed in between visits. A couple of small preferences (claim-tag color, the motion-effects toggle) are also stored locally in your browser, never sent to any third party. Clearing your browser storage will sign you out and reset those preferences.
We keep your account and scan history for as long as your account is active, so your history stays available to you. If you delete your account (see below), we delete your personal data within a reasonable period, except where we're required to retain billing records for legal or tax purposes.
Wherever you're located, you can ask us to: give you a copy of the personal data we hold about you, correct inaccurate data, delete your account and associated data, or stop processing your data for a specific purpose. If you're in the EU/UK, these map to your rights under the GDPR; if you're a California resident, to your rights under the CCPA (and to be clear: we don't sell personal information, so there's nothing to opt out of on that front). We don't yet have a self-service "delete my account" button in the product — email us (below) and we'll action a deletion request by hand.
unclaimed_ is not directed at children under 13, and we don't knowingly collect personal information from anyone under that age. If you believe a child has created an account, contact us and we'll delete it.
Data is encrypted in transit (HTTPS) everywhere on this site. Database access is protected by row-level security policies, so an account can only read its own data. We don't store passwords or card numbers on our own servers — that's handled by Supabase and Stripe respectively, both of which maintain their own security practices.
If this policy changes in a material way, we'll update the date at the top of this page. Continued use of unclaimed_ after a change means you accept the revised policy.
Questions, or a request to access/correct/delete your data: use the CONTACT link in the footer below.
Bugs, ideas, things you like or don't - it goes straight to the team.