What this score is
Every score on Paranoia is our opinion, derived transparently from the rubric below and applied consistently across every entity. A score is not a legal finding and is not an accusation — it is a structured summary of what a company's own disclosures, independent audits, and public registries say about how it handles data. Every claim behind a score links to a primary source ("receipt"), and we favor precise, policy-grounded phrasing (for example, "policy permits sharing data with X") over accusatory language not supported by the cited source.
Scores run 0-100. A higher score means the entity is MORE privacy-respecting. A score of 100 is the best possible outcome; a score of 0 is the worst.
The five pillars
The composite score is a weighted average of five pillar subscores (each 0-100, same direction — higher is better):
Pillar weights sum to exactly 1.00.
Scoring anchors
Each pillar subscore is assigned against the anchors below, and every subscore traces to sourced claims published in-app alongside it — with Paranoia Plus on company and app files, and free on the files of public officials. Anchors describe evidence thresholds, not a company's reputation: a score moves only when the cited record moves.
One principle governs the whole rubric: absence of evidence is not evidence of good behavior. Finding no enforcement action against a company earns a middle score, never a high one, because we may simply be looking at a company nobody has examined. Climbing above the middle requires affirmative, published evidence of protective practice.
Collection (25%)
· 85-100 — Collects little or nothing beyond what the feature strictly requires. No account needed, or account data limited to an identifier the user chooses. No behavioral profile is built.
· 65-84 — Purpose-limited collection with published retention periods and working export and deletion controls.
· 45-64 — Collection is broader than the feature strictly needs, but is disclosed, bounded, and subject to user controls.
· 25-44 — Broad collection across services, including inferred attributes or data obtained from third parties.
· 0-24 — Collection extends to people who are not users, or combines first-party, third-party, and offline sources into a persistent profile.
Tracking Tech (20%)
· 85-100 — No third-party trackers or fingerprinting in the product; independent scans find none.
· 65-84 — First-party analytics only, with no cross-site or cross-app identifiers.
· 45-64 — Conventional analytics and a small number of third-party components, with no evidence of fingerprinting.
· 25-44 — Multiple advertising components or trackers, with cross-device or cross-app identity linking.
· 0-24 — Fingerprinting, session replay, or an identity graph spanning properties the person never visited.
Sharing (25%)
· 85-100 — Architecturally cannot share meaningful user data — end-to-end encrypted, local-only, or zero-knowledge, verifiable from published design or audits — or a published contractual commitment not to sell or share, with a disclosed subprocessor list containing no advertising or data-broker destinations.
· 65-84 — Published no-sell and no-share commitment, with disclosed subprocessors limited to infrastructure and named service providers, and no advertising-network destinations.
· 45-64 — Routine vendor and analytics sharing with a working opt-out that is honored, including recognized browser opt-out signals.
· 25-44 — Policy permits sharing with advertising partners for targeting; an opt-out exists but is partial, hard to reach, or does not cover every flow. A precautionary "this may be considered a sale or share" concession of the kind most advertising-supported notices carry belongs here, not lower, so long as targeting remains opt-out-able.
· 0-24 — Sells or shares personal data into the advertising or data-broker ecosystem as a core part of the business model, or makes an unqualified self-declaration that it sells or shares personal information under state privacy law.
Ownership Transparency (15%)
· 85-100 — The company itself publishes a complete, current ownership chain up to the ultimate parent, and announces material changes.
· 65-84 — Ownership is traceable through mandatory public filings, such as securities regulators or company registries, with a clearly named ultimate parent.
· 45-64 — A parent is named, but the chain must be assembled from several sources, or intermediate holding entities are undisclosed.
· 25-44 — Privately or opaquely held, with ownership identifiable only through indirect reporting.
· 0-24 — Neither the operator nor the ultimate owner is identifiable from any authoritative source, or the disclosed operator conflicts with the public record.
Track Record (15%)
· 85-100 — A clean record over the covered period, together with three or more affirmative artifacts: recurring published third-party security or privacy audits; documented resistance to overbroad legal demands with a public outcome; transparency reports carrying actual request and compliance counts; a funded public bug-bounty or vulnerability-disclosure program with published scope.
· 65-84 — A clean record over the covered period plus one or two of those affirmative artifacts.
· 45-64 — A clean record over the covered period with no affirmative artifacts. This is where "we found no enforcement actions" lands, and it cannot climb higher on absence alone.
· 25-44 — Self-disclosed and remediated incidents, a dated or narrow regulator action, or a single breach of limited scope.
· 0-24 — Substantiated enforcement actions, a large-scale breach, or a documented pattern of incidents or broken commitments.
Incidents set a ceiling; affirmative artifacts place the score beneath it. A narrow incident inside the covered period that the entity publicly and completely remediated caps this pillar at 64 — artifacts then position it within 45-64 rather than being barred from counting at all. Remediation is not a clean record and never reaches 65, but it is worth something, because following through on a privacy failure is part of what this pillar measures. An incident that is unremediated, still open, repeated, large-scale, or that carried a monetary penalty caps the score at 44 or lower under the tiers above, whatever artifacts exist alongside it.
The covered period is the last five years. Older events are never erased — every incident we find stays disclosed in the entity's claims and in the rationale, and weighs against where the entity sits inside its tier — but a single limited-scope incident that was self-disclosed and remediated more than five years ago does not by itself bar the tiers above 45. Two things bar them regardless of age: a large-scale breach or a substantiated enforcement action carrying a monetary penalty, and any pattern of incidents continuing into the covered period. This keeps a decade-old, fixed bug from being scored like last year's failure, without letting a landmark breach quietly expire.
Grade bands
Grade bands are ordered highest-first; an entity's grade is the highest band whose minimum the composite score meets or exceeds.
Alerts
What triggers an alert
An alert is a single event row with a primary-source receipt, attached to a company or official you are watching. The kinds we publish, in plain words:
· A score re-review, when a file is reassessed against the rubric above
· New receipts, when a claim is added to a file you're watching
· A privacy-policy or terms page change
· A new federal court docket naming the company
· A regulator or state attorney-general press release mentioning the company
· A breach record
· A tracked-bill vote by an official you're watching
· An official sponsoring or cosponsoring a tracked bill, or withdrawing a cosponsorship
· A tracked bill of theirs advancing in committee or becoming law
· A news headline about the company or official, linked to the original reporting
· A class-action settlement approved in a case naming the company, with a link to the court-approved claim site
When it fires
An alert fires when we publish a change, not at the moment something changes in the world. Checks run on a schedule — daily for structured sources, weekly for anything a person has to read first — and a reviewed item is not published until someone has read the receipt and confirmed the wording is accurate. Never read the absence of an alert as the absence of a change: it may simply not have reached publication yet.
Automated versus reviewed
Published automatically, straight from a structured source with a stable identifier:
· ToS;DR approved points
· Have I Been Pwned breach records
· Roll-call votes on our tracked-bill list
· Sponsorship, cosponsorship, and committee or enactment action on our tracked-bill list
Drafted by automation and published only after a person reviews the wording and the receipt:
· Privacy-policy and terms-page changes — the plain-English description of what changed may be drafted by a language model from the page's own text diff, but nothing it writes reaches you unreviewed: a person reads it, corrects it where needed, and approves it before publication, exactly like a docket or a settlement notice
· Court dockets
· Regulator and attorney-general press releases
· News headlines
· Settlement notices
The split exists because a structured record — a breach entry, a recorded vote — is a fact with a stable identifier we can publish as-is. A text diff, a docket, or a headline is evidence that still needs a person to describe accurately before it reaches you.
What an alert is not
A detected text change is not a judgment that a policy got better or worse — it says a page changed, nothing more, until a reviewer describes what changed. That description may be drafted by a language model from the page's text diff, and it is always read, corrected where needed, and approved by a person before it is published; the diff itself remains the receipt, and the description is bounded by what the diff shows, never by an opinion about whether the change is good or bad. A court docket is a filing, not a finding, and never means a company was found liable for anything. A news headline is a link to someone else's reporting, not ours, and listing it here is not an endorsement of it. The same opinion framing that governs every score governs every alert: what we publish describes what a primary source says, never a verdict handed down about the company.
Cadence and limits
Structured sources are checked daily; policy pages, dockets, and press releases are checked weekly. Each company or official has a daily cap on how many alerts of a given kind can be raised in a single run, so one busy day never floods a file. A device receives at most one push per company per day; when several alerts land together, they arrive as a single batched notification instead of several. The free tier carries three alert slots today; Paranoia Plus removes that cap entirely.
Sources and licenses
· ToS;DR (CC BY-SA 3.0)
· Have I Been Pwned (CC BY 4.0, link required)
· Congress.gov, the House Clerk, and U.S. Senate roll-call, bill-action, and cosponsorship records (U.S. Government works)
· CourtListener's RECAP Archive, via Free Law Project (public-domain court records)
· FTC and state attorney-general press releases (linked, never republished)
· Publisher headlines (headline and link only)
· GDELT (citation and a link to gdeltproject.org required)
· Our own weekly policy-page fetches (self-run; the diffs are ours)
· Settlement notices come from federal court records and from the court-approved claims-administrator or notice site named in the court's own order. Class-action aggregator sites — ClassAction.org, Top Class Actions, ClaimDepot, and OpenClassActions among them — are proprietary content. We never scrape them and never cite them here.
News article text is never stored or shown — only the headline, the publisher, and the link.
Settlements
A settlement card starts with a docket: a federal court record showing that a judge granted preliminary or final approval of a proposed class action settlement in a case that names the company. What we publish alongside that docket is a person's summary of who the settlement's own notice says may be able to claim.
The framing is a rule, not a suggestion: a card says you may be eligible if something is true of you — never a flat statement that you qualify, and never a promise that you will receive anything. Whether you can actually claim is decided by the settlement administrator against the notice's own terms — never by this app.
Every settlement card is written by a person before it is published. None is generated and sent automatically. The docket link on the card is the receipt, and it points at the court record itself.
A docket naming a company says nothing about the merits of the case or its outcome. An approved settlement means a court approved a proposed resolution between the parties — it is not a finding that the company did anything wrong.
Deadlines move, and claim windows close. The deadline shown on a card is the one on file when the card was written; the official claim site is always the authority on whether that deadline still holds.
The same in-app corrections channel covers settlement cards like everything else here: tell us if a card is wrong, stale, or misdescribes what the notice says.
Corrections
The same in-app corrections channel described below covers alerts: tell us if one is wrong, misdescribed, or simply noisy. A rejected alert is remembered, so the same story does not come back.
Officials
This section explains who gets a file among public officials, which votes we track, why officials carry no score, and how party is and is not used.
Who gets a file
Every member appearing in the unitedstates/congress-legislators project's legislators-current.json dataset at the moment we generate the roster gets a file — every voting member of the House and Senate, plus the six non-voting delegates and the resident commissioner from Puerto Rico. The current roster was generated 2026-08-24 and recorded 537 members (100 senators, 437 representatives, including the six delegates and the resident commissioner). A resignation, a death, or a special election changes who holds a seat; the roster is regenerated periodically from the same live source, and a departed member's existing file is retained as a historical record rather than deleted.
Tracked bills
Not every vote, sponsorship, or committee action becomes a claim on a file — only activity on our tracked-bill list does. The inclusion test, quoted exactly as it governs the list: "a bill is tracked if its floor action changes what governments or companies may collect, retain, buy, or query about people without a warrant or consent." A bill enters or leaves the list only by that test, never by its outcome or by who sponsored it. A file can carry a vote, a sponsorship or cosponsorship (or its withdrawal), and a committee or enactment action on the same tracked bill — each is its own claim with its own Congress.gov receipt.
Why there is no officials score
We don't score officials. A file is the record — committee seats, votes on tracked bills, sponsorship and cosponsorship of tracked bills, tracked-bill committee and enactment action, and money from surveillance-industry sources — with a primary source on every line. An officials score is possible in a future version, but only after a bipartisan-neutrality check confirms the rubric treats every party identically; until that check passes, no officials score ships.
Neutrality
Party affiliation is recorded on every file as a fact, the same way a committee seat or a vote is. It is never used to order, color, group, or filter anything in this app — the sort order, the sections shown, and the wording used are identical regardless of party.
Sources and their limits
Officials' files draw on Congress.gov, the U.S. House Clerk's and Senate's roll-call records, OpenFEC, the Senate's Lobbying Disclosure Act (LDA) database, and the unitedstates/congress-legislators project. A disclosed campaign contribution or lobbying filing is a transaction record, not evidence of influence — we state what was disclosed and by whom, never what it caused. The LDA database reflects registrant self-reporting under federal law; a company or lobbyist not appearing there may still lobby through channels the Act does not require to be disclosed.
Corrections
The same in-app corrections channel described below covers officials' files: if a claim is wrong, tell us and we'll review it against the primary source it cites.
Corrections
If you believe a claim, source, or score is inaccurate, use the in-app corrections channel to submit a correction. Every correction is reviewed against the cited primary source before any score changes.
Versioning
This rubric is versioned. A published version's weights and grade bands are never edited in place — any change to the pillar weights or grade bands ships as a new version, so every historical score remains traceable to the exact rubric that produced it.
Version 1.1 carries the same five pillar weights and the same grade bands as version 1.0, unchanged. What it adds is the scoring-anchor section above. An audit of every score published under version 1.0 found that two pillars, Sharing and Track Record, were never being scored above roughly 70 and 60 respectively: there was no stated path for a product to earn credit for encrypting data so it cannot be shared, or for publishing audits and resisting overbroad legal demands. That held the top of the scale out of reach. The anchors open it, while keeping the rule that an absence of found enforcement can never by itself earn a high score. Every score published under version 1.1 has been assessed against these anchors.
Version 1.2 again carries the same five pillar weights and the same grade bands as version 1.0 and 1.1, unchanged. It adds the Alerts section above, explaining the new receipted event feed and push-alert feature in plain terms. This is a prose-only addition — no weight, no grade band, and no scoring anchor changed. No previously published score moves because of version 1.2.
Version 1.3 carries the same five pillar weights and the same grade bands as version 1.0, 1.1, and 1.2, unchanged. What it adds is the full Alerts section above, replacing version 1.2's one-paragraph placeholder: which kinds publish automatically versus after human review, what an alert is not, cadence and limits, every source's license, and how a rejected alert is remembered. It also corrects version 1.2's imprecise statement that an alert fires "when something changes" with the accurate statement that it fires when we publish a change — checks run on a schedule and a reviewed item takes time to reach publication. No previously published score moves because of version 1.3.
Version 1.4 again carries the same five pillar weights and the same grade bands as version 1.0 through 1.3, unchanged. It adds the Officials section above: who gets a file, the tracked-bill list quoted from its own source of truth, why officials carry no score today and what would have to be true before one ever ships, the neutrality statement, officials' own sources and limits, and the corrections channel. This is a prose-only addition — no weight, no grade band, and no scoring anchor changed, and officials are never scored, so no previously published score moves because of version 1.4.
Version 1.5 again carries the same five pillar weights and the same grade bands as version 1.0 through 1.4, unchanged. It adds the Settlements subsection above, plus one new triggers bullet, one new entry in the human-reviewed list, and one new sources-and-licenses line naming the settlement source policy: federal court records and the court-approved claims-administrator or notice site named in the court's own order, never a class-action aggregator site. This is a prose-only addition — no weight, no grade band, and no scoring anchor changed, so no previously published score moves because of version 1.5.
Version 1.6 again carries the same five pillar weights and the same grade bands as version 1.0 through 1.5, unchanged. It discloses the new bill-action detector: sponsorship, cosponsorship, cosponsorship withdrawal, and committee or enactment action on our tracked-bill list now publish automatically, the same posture as a roll-call vote. It adds two new triggers bullets, one new entry in the automated-publish list, extends the Congress.gov sources line to name bill-action and cosponsorship records, and updates the Officials section's Tracked bills and Why there is no officials score paragraphs so neither describes a file as containing only votes. This is a prose-only addition — no weight, no grade band, and no scoring anchor changed, and officials are still never scored, so no previously published score moves because of version 1.6.
Version 1.7 again carries the same five pillar weights and the same grade bands as version 1.0 through 1.6, unchanged. It discloses that a privacy-policy or terms-page change's plain-English description may now be drafted by a language model from the page's own text diff, and states that nothing a model writes reaches a reader unreviewed — a person always reads, corrects where needed, and approves the wording before publication, exactly like a docket, a press release, or a settlement notice. It updates the "Automated versus reviewed" entry for policy and terms changes and the corresponding sentence in "What an alert is not" to say so, and states that the text diff itself remains the receipt and the description is bounded by what the diff shows, never by an opinion about whether the change is good or bad. This is a prose-only addition — no weight, no grade band, and no scoring anchor changed, so no previously published score moves because of version 1.7.