Privacy policy.

Last updated 12 October 2026. What we receive, what becomes public, and your data choices.

Trust Me Bro finds real sources for claims. To do that it has to send the claim somewhere. Here is exactly what moves, what stays, what we never touch, and the rights you have over all of it. We make money from subscriptions, not from selling you: we do not sell personal information or share it for advertising. We use the service providers described below to process the information needed to provide the service. Who we are. The data controller is Ashdown Receipts Inc., a US company that operates Trust Me Bro, reachable at [email protected]. This policy covers the browser extension, the trustmebro website, our connected AI plugin, and our public pages (Receipts, the Trust Feed, and the Trust Wiki).

What we receive

• The text you check. When you run a lookup or check a claim or quote, that text is sent to our server so we can search the academic literature and return sources. Nothing is sent until you act; highlighting alone sends nothing.
• Text from features we have retired. Earlier versions offered essay review, document upload and a web workbench. Those features are no longer offered and no longer receive new text. Drafts and reviews already saved to an account follow the retention rules below until you delete them or the account.
• Page title and address, sometimes. When you check a claim from a page, the page's title and URL ride along to improve the search. That is the only page data we see.
• A device ID. A random identifier stored in your browser, used to count checks and remember your tier. It is pseudonymous, not a guarantee of anonymity. A device linked to an account connects its records to that account.
• Account details, if you have an account. Email address and, if you set a password, its salted hash. When you sign in with Google or Apple, we store the provider's identifier for you and your verified email address. For Apple, we also store an encrypted authorization token so we can disconnect that authorization when you delete your account. It is excluded from account downloads and public receipts. You can use the free extension without an account. An account is required for a Bro or Pro subscription, and to submit disputes or contributions.
• Votes, disputes, and contributions you submit on Receipts.
• Review-notification requests. If you ask to be notified about a claim, we receive your email address and the claim identifier for that request.
• Payment metadata. Payments run through Stripe. Your card details go to Stripe, never to us; we hold only a Stripe customer reference and your subscription status.
• Waitlist emails, if you join a waitlist.

What stays on your device, and what does not

Two different things live in two different places, and we want to be straight about it.

• Local history and server records are different. The "Recent lookups" drawer and citation-format preference live in extension storage; that drawer is not uploaded as a list. The server separately keeps device usage, account-linked records and claim-related notifications. Notifications can associate an account or device with a claim or receipt. API billing records are linked to the API account.
• Public claim checks enter our database. Claims submitted for public verification are stored on our servers with its verdict and sources, so repeat lookups are instant, so Receipts have an honest history, and so the public library grows. That record is stored as a claim record. Public receipt pages do not add your account or device identifier, but claim text, explanations and cited sources can contain names or other identifying details. Separate service records can link activity to a device or account.

Treat text you submit for a claim check as potentially public. It is not automatically anonymized, and it may appear publicly even if you do not press Share. The plugin's private quote and argument tools follow the separate rules below.

What we never collect

• Browsing history. The extension does not track the pages you visit.
• Page content you didn't explicitly check.
• Names from unrelated pages or files. Names you include in submitted text, account details or messages to us are received with that information.

Why we use it, and our legal bases

Where GDPR or UK GDPR applies, each use has a legal basis:

We do not make automated decisions about you that have legal or similarly significant effects.

Your content, and what we may do with the claim corpus

This is the part most privacy policies fudge, so here it is plainly.

• Your personal data is not for sale. Not now, not later, not to anyone. We do not sell or share it for advertising, and we do not hand it to data brokers.
• We do not use your content to train AI models. Google's terms do not permit training on what we send to Vertex AI. DeepSeek, which judges sources and writes part of each check, is different: its published privacy policy lets it use submitted data to train and improve its models, and we do not rely on a no-training commitment from it. See "Third parties we use" below.
• The claim corpus, which we may license. Claims, verdicts, evidence, and Receipts make up a public and growing body of work. We may license access to that corpus, or to an API built on it, to businesses including AI companies. What would be licensed is the claim-verdict-source record, the same material anyone can already read on our public pages. Account records, device identifiers and requester-history records are not part of that license. Public text can still identify people: publication does not make it anonymous or authorize selling personal information.
• Because a claim box accepts free text, please do not type personal details about yourself or anyone else into a public claim check. Treat it as a public question, because that is what it becomes.

Chrome Web Store

Trust Me Bro's use and transfer of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements: data the extension handles is used only to provide and improve its single purpose, finding sources for claims, and never for advertising, creditworthiness, or sale to data brokers. The extension also tells you this up front, on first run, before anything is sent.

If you use the Trust API

The API is for developers building on our engine, and the data picture is deliberately narrow. What we receive. The claim text you POST, the API key it came from (which identifies your account, not your users), the time, whether the answer came from the corpus or was constructed, and what it cost. Plus the IP the request came from, to enforce limits and stop abuse. We do not receive, and do not want, any identifier for your own end users. If one appears in a claim, it is because you put it there. What happens to the claim. A claim we have not checked before can be checked and published as a Feed item or Receipt. This is the same treatment a claim gets from the extension, and it is what keeps the corpus-lookup price near cost. The published record carries the claim and the evidence without adding your key or account fields. The text itself may identify your users. Please do not send personal or confidential text through the API. Treat a claim as a public question. Who is responsible for what. You decide what to send us. For text that originates with your own users, you are the one who must have a lawful basis for sending it and who must tell them. Once a claim is published it is part of our public record and we are responsible for it as a controller, on the same terms as every other Receipt. Legal bases (for those who need them): performing our contract with you, for serving and billing API calls; our legitimate interest in preventing abuse, for the IP and rate-limit data; and our legitimate interest in maintaining a public verification record, for the corpus itself. Retention. Keys are stored as hashes and kept until you revoke them, then removed within 30 days. Ledger entries are kept as long as tax and accounting law requires. Published claims and verdicts are kept indefinitely, like every other checked claim. Abuse and rate-limit logs are kept for 5 days. Age. The API is for business use. Do not use it if you are under 18.

If you connect an AI client to the Trust Me Bro plugin

Connection and consent. Reading and searching stored public receipts does not require an account connection. Verification tools require you to sign in to your existing Trust Me Bro account and explicitly allow the named client on our consent page. The connection uses that account's balance or allowance; quote checking can use an extension allowance you select. We keep connection metadata linking the client, account and selected allowance. Authorization codes and bearer tokens are stored as hashes. We do not ask for an API key or your AI client's sign-in secret. What the client sends and receives. We receive the text and request identifier submitted to a tool, rather than access to your unrelated chat history. Tool results return to the connected client, where that client's own privacy and retention rules apply. Text sent for verification or analysis can be processed by the AI, academic database and search providers described below. Private processing still requires that external processing; it does not mean the text stays on your device. Public claim verification. The public claim tool can add the submitted claim, verdict and evidence to public receipts and the claim corpus. It does not add your account or connection credentials to the public receipt, but the submitted text can identify people. Do not use that tool for confidential text. Account deletion does not remove an existing public receipt; use the receipt removal process below. Private quote and argument tools. These tools do not add their inputs or results to public receipts or the claim corpus. A private result may contain excerpts from your input. We retain completed results for a seven-day replay window, so retrying the same request can return its result without repeating provider work. Results become eligible for removal after that window and are removed by our cleanup process. Deleting the account clears these stored results from the live database. The account-deletion window for retained copies described below also applies. Separate service and financial records. Request identifiers and keyed fingerprints help prevent duplicate execution. We separately retain tool names, timestamps, request states, allowance or billing records, and provider-cost and reconciliation summaries. Cost summaries contain call identifiers, model or provider identifiers, usage counts, recorded costs and known, unknown or pending status; they do not contain submitted text, source passages, search queries or connection credentials. These service and financial records outlast the seven-day result window. Account deletion clears request identifiers and fingerprints and revokes all plugin connections. Minimal financial and reconciliation records remain linked to a retained account reference for accounting and resolving outstanding work, as with the API ledger. Payment records follow the financial retention rules below. Disconnecting and your data. A client that supports token revocation can revoke its connection; deleting your Trust Me Bro account also revokes its connections. Revocation prevents future authenticated calls, but may not stop provider work already admitted. Disconnecting alone does not delete completed results or public receipts. Your account download includes supported plugin call records, available results, cost summaries and active connection metadata, while excluding tokens, authorization codes, credential hashes and keyed request fingerprints.

Public pages: Receipts, the Trust Feed, and the Trust Wiki

Receipts are permanent public records. Their text can identify you or other people.

• Public receipt fields omit account identifiers. A Receipt carries the claim, recorded verdict, explanation and sources. It does not add your device ID or account details. Names, email addresses and other identifying details included in the text or sources may still appear. Do not submit confidential or personal information.
• Fresh claims may appear on our public pages. The Trust Feed and Trust Wiki publish claims the engine has judged. Don't type anything into a claim box you wouldn't want on that wall, because the claim can appear there even if you never share it.
• Sharing distributes an existing public link. A Receipt may already be public before you share it. People receiving your link may associate you with its claim. The claim and sources can also identify people independently of sharing. The link is permanent and search engines can index it, so review its content before sharing.
• Receipts can quote and cite third-party published sources. If you are an author, publisher, or person referenced on a Receipt, you can dispute it via the link on the page; we review disputes within 7 days and publish dated corrections (see the Terms of Service, Sections 10 and 11).
• To request removal of a shared Receipt, use the dispute link or email us and we'll sort it, normally within 7 days.

Receipt dividends and attribution

• Attributed receipt and invite links use a random referral code connected to a device. Attributed receipt links contain a per-link token mapped to that code on our server. Copying a regular public receipt URL does not necessarily add a referral token. These identifiers are pseudonymous, not anonymous.
• If someone opens a Receipt through an attributed link, we set a first-party cookie (tmb_ref) in their browser for 30 days so a later subscription can be credited to your wallet. The token connects the visit to referral records. Conversion records can include a hash of the subscriber's device identifier; payment and account records are held separately. We do not ask for your address book to send an invitation.
• The token-to-referral-code mapping is stored on our server. Anyone receiving an attributed link can see the token in its URL; it should not be treated as secret.

Cookies

We use these first-party cookies:

• tmb_session: sign-in, HttpOnly, up to 90 days; it can be revoked sooner.
• tmb_ref: referral attribution, 30 days.
• tmb_lang: your explicitly selected display language, up to one year.
• tmb_oauth: temporary sign-in state, up to 10 minutes.
• tmb_admin: an authenticated administrator's session, HttpOnly, with an operator-configured lifetime (12 hours by default).

We do not use third-party advertising or analytics trackers. Referral attribution uses the first-party cookie and server records described above.

Third parties we use

These providers receive the information described below. Submitted text and search queries can themselves contain identifying information:

• Google Vertex AI (Gemini) receives the text being checked, to plan the search and route it to the right sources. Earlier checks also used it to judge sources and write the summary. Google's terms do not permit training on this data.
• DeepSeek receives the text being checked and retrieved source passages, to judge how well a source supports a claim and to write the summary. DeepSeek's privacy policy says it processes and stores personal data in the People's Republic of China, and that it may use submitted data to train and improve its models; users have a right to opt out of that. Anything typed into a claim box, including names and other personal details, can reach DeepSeek. Do not put personal details into a claim.
• Academic databases, including Europe PMC, OpenAlex, Semantic Scholar and Crossref, receive search queries derived from your claim.
• Web search services, including Brave Search, Exa, Serper and TinyFish, can receive claim text or search queries derived from it to locate sources. Which service is used depends on the check and service availability. Source websites also receive requests when our server retrieves their pages. Names and other personal details in the submitted text can remain in these queries; omitting your account fields does not remove them from the text.
• Google Fact Check Tools API (Pro features) receives the claim text.
• Stripe handles payment processing; Stripe's privacy policy applies to that step.
• Google or Apple sign-in, if you choose it, processes your sign-in request and returns account identity information used to authenticate you.
• Google Cloud Run hosts our application servers (United States, us-central1).
• Neon hosts our Postgres database (United States).

International transfers

Our servers and most providers above are in the United States, so your data is processed there, and wherever Google and Stripe operate, regardless of where you live. The exception is DeepSeek, which processes data in the People's Republic of China, a country without an EU or UK adequacy decision. For users in the EEA, UK, and Switzerland, we rely on Standard Contractual Clauses and, where providers hold them, EU-US Data Privacy Framework certifications, as the safeguards for these transfers.

Retention

• Checked claims and results are kept indefinitely, cached so repeat lookups are instant, with an append-only log of claim events so a Receipt can show its history honestly. The claim text and engine output may contain identifying information.
• Saved essays and account-linked batch reviews are retained while the account exists. Reviews are not automatically saved to your Library. Deleting the account removes saved essays and clears its linked batch text and results from the live database. Our deletion window is 30 days, including retained copies. Accountless batch text and results have a 30-day retention window after completion, failure or cancellation. Public receipts and the separately retained records below remain. Drafts and notices without a recorded completion or expiry are not deleted by that sweep; we do not invent those dates. A signed-in library draft follows the account.

• Draft hand-offs (the stash used to move an essay into the side panel) are deleted on first read or within 1 hour, whichever comes first.
• Accounts are kept until you delete them. Disputes and contributions are kept as part of the public record of the Receipt they concern.
• Lost-device paid access can be moved onto another browser that is already linked to the same account, after password or provider confirmation. We do not attach a purchase to an account from an email address or a guessed device. A purchase that was never linked remains a support request. Public receipts are unchanged.
• Apple disconnection requests may continue after your TMB account is deleted. We retry using the encrypted authorization token, without retaining your account ID or email in that request record. The token is cleared on successful disconnection or by the cleanup following its seven-day expiry. Undelivered request status is removed by the cleanup after 30 days. You can also disconnect TMB in your Apple Account settings.
• Apple account-change notifications are received from Apple when a user revokes Sign in with Apple or asks Apple to delete their account with us. Revocation disconnects Apple sign-in and signs that user out. Deletion removes the TMB account's private data. Public receipts remain. Hide My Email on/off events do not change the stored contact email, because email is not used to attach an account.
• Google Cross-Account Protection notifications are received from Google when a signed-in Google account has a security event. Session and token revocation signs that user out. Hijacking or an unspecified disabled Google account disconnects Google sign-in. A remaining password or other provider keeps the TMB account. A passwordless account with no remaining identities is erased. Public receipts remain. Email in those events is not used to attach or rewrite an account. Stream registration with Google is operational and separate from this receiver.
• Payment disputes are recorded from Stripe. A held or lost chargeback reduces wallet credit or pauses that subscription's paid access. A won or reinstated dispute restores only from Stripe's current paid state. Public receipts and other financial records remain.
• Stripe event identifiers (id and type only) are kept so a payment update that failed to apply can be retried from Stripe. We do not store card numbers or the raw webhook body.
• Payment records are kept as long as tax and accounting law requires.

Your rights

Wherever you live, you can ask us what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. You do not have to ask us for most of it: signed in, Your data lets you download the available account export and delete your account. The export contains supported account records and saved essays; it omits credentials and internal receipt inventories, and is not a copy of every operational record. Contact us for other information or removal requests. Where you would rather write to a person, email [email protected] from your account address, or include your device ID (shown in the extension's settings) for extension-only data. We answer within 30 days. If you are in the EEA, UK, or Switzerland, you additionally have the rights to restrict or object to processing, to data portability, and to withdraw consent at any time where consent is the basis, and you may lodge a complaint with your local data protection authority. If you are a California resident, you have the right to know, delete, and correct, and the right to opt out of sale or sharing of personal information. **We do not sell or share personal information as the CCPA defines those terms**, and we do not use sensitive personal information beyond providing the service. We will not discriminate against you for exercising any right. Deleting your account does not unpublish Receipts or erase the retained payment, consent, security and pseudonymous usage records described here and on the deletion page. Public text may still contain personal information. To request removal of a specific Receipt, use the dispute or removal process above.

Security

Everything moves over HTTPS. Passwords are stored only as salted scrypt hashes. Payment webhooks are signature-verified. Access to production data is limited to the operator. If a breach ever affects your personal data, we will notify you and the relevant authorities as the law requires, within 72 hours to authorities where GDPR applies.

Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from them. If we learn we have, we will delete it. If you are 13 to 17, use the Service with a parent or guardian's consent.

Changes to this policy

We date every version. If we change our data practices materially, we will give notice in the extension and on the site before the change takes effect, including the notice the Chrome Web Store requires when an extension's data practices change after install. Questions? [email protected]. We read everything.