CCPA §1798.110
The apps you use
DoorDash, Netflix, Uber, your grocery app. Order history, your precise location at every purchase, and the audience segments they sold about you. Sent as legal letters.
your data · their servers · one request away
They have your file. Open a pull request.
DoorDash knows your address history. Uber has every trip you have ever taken. A company you have never heard of holds your prescription record. Under law they have to hand it over when you ask — most people just never ask. We ask. Formally, in writing, as your authorized agent.
Cal. Civ. Code §1798.110 · 11 C.C.R. §7063 (authorized agent) · 15 U.S.C. §1681g
Scroll
How it works
Like a pull request. The repo is you.
You could send every one of these yourself — the law lets anyone, and our templates are public. It also lets you appoint an authorized agent to run the whole thing for you. That is the entire service.
- 01 Sign once One e-signed designation. Under 11 C.C.R. §7063 that makes us your agent — no notary, no power of attorney, no lawyer. Revoke it in a click.
- 02 Pick a bundle One click queues a whole set: the companies that actually answer, your shadow files, your government file, the brokers who sell you.
- 03 We send · you watch Legal letters go where a letter works, guided walkthroughs where the company's own export tool is faster. Every deadline tracked, publicly.
What the signature actually does
It authorizes us to submit requests in your name and receive the response — nothing
else. Companies can verify your designation themselves at a public link included in
every request we send, which is why we do not need a notary and neither do they.
What we pull
Layer 01
Layer 02
Layer 03
Layer 04
Layer 05
Layer 00
Your life is filed in five different places.
Most privacy tools only touch the first one. Your rights are different at every layer, and the deepest files are the ones nobody thinks to ask for.
FCRA §1681g
Your shadow files
The dossiers you never signed up for: payroll history at The Work Number, your prescription history at Milliman, claims at LexisNexis, your banking record, even your retail returns. Federal law, all fifty states, usually free.
Privacy Act · FOIA
Your government file
Every border crossing, every dollar ever reported under your SSN, your FBI file. Mostly free — and a few of them come back within days.
Data broker registry
Who sells you
Acxiom, LiveRamp, Epsilon and the bureaus' marketing arms. This is where the inferences live: the income band, the health guesses, the identity graph tying all your devices to one person.
Platform export
Big tech's archive
Apple, Google, Meta and Amazon hold the most by volume — recordings of your voice, your location timeline, every site that quietly reported you back. Their own export tools beat a legal letter, so we walk you through them click by click.
the honest part
What we can't reach
Data plumbers like Tealium and Palantir are processors — the law routes your rights through the company you actually dealt with, so our Layer 01 letters reach into their pipes. Anyone promising to "delete you from Palantir" is selling something.
The statutory clock
Ten days to answer. Forty-five to comply.
The moment a request lands in a privacy inbox, a legal timer starts. It is not a customer-service ticket and it does not expire quietly. We watch every one of them.
- Day 0Request delivered. Statutory clock starts.
- Day 10Acknowledgment due. Silence is already a violation.
- Day ~31Where honest companies actually land, in our data.
- Day 45Full response due. One 45-day extension exists, with notice.
- Day 46Non-compliance recorded on the public scoreboard.
When they blow it
We draft the escalation letter free, log the miss on the public scoreboard, and hand you
a filled-out complaint packet for the California Attorney General and the Privacy
Protection Agency. The agencies have fined companies for exactly this.
See the record ›
What comes back
Sixteen inboxes of mess, parsed into one file.
Companies answer in whatever shape annoys them least: a zip of CSVs, a PDF of screenshots, a link that expires in 72 hours. We collect all of it, normalize what is normalizable, and keep the raw original attached so nothing is taken on our word.
- Yours to export One click, JSON and CSV, no retention hostage-taking.
- Deletion is the sequel, never the opener Once you can see who holds what, the delete requests write themselves — same designation, no new signature. We never delete first: a company that has wiped your file can no longer be asked what was in it.
- Nothing inferred If a company sends a shrug, your file says they sent a shrug. We do not pad the report to look impressive.
The price
The trial
The year
Add a person
Ten dollars to try it. Forty-nine fifty a year to keep it.
One pull tells you who has you. A year keeps the pressure on — because the file refills. Brokers re-acquire you, companies collect more, and the deadlines only work if somebody is actually counting them.
$10once
See what one pull turns up.
- Requests to every company in one bundle
- 45 days of deadline-chasing
- Responses parsed into your file
- The file is yours — export it and walk away
$4950a year
$39.50 for your first year if you come from the trial.
- Every layer, pulled as often as you like
- We file your California DROP deletion and read the results back
- Quarterly re-pulls and new-broker sweeps
- Escalation letters and complaint packets drafted free
- Every deadline tracked on the public scoreboard
+$25each, a year
A couple is $74.50. Households share an address history — so they share a file.
- Their own signed designation, their own file
- One desk, one renewal, one dashboard
- Remove anyone at any time
What we don't charge you for
California's DROP deletion tool is free, and from 1 August 2026 every registered
data broker has to check it at least every 45 days, delete what matches, push that deletion
down to their own service providers, and report back what they did. We will file it for you
as your agent and pull the results into your file — but you should know you can file it
yourself, for nothing, at privacy.ca.gov.
We charge for the four layers DROP does not touch, and for finding out what they were holding
before it disappears.
Open playbooks
The playbooks are public. PRs welcome — obviously.
Every company's privacy contact, request template, verification quirk and actual response behaviour, maintained in the open. Self-hosters: take the templates and send your own requests, genuinely. Pay us only if you want the desk, the tracking and the parsing.
| Contacts | Community-verified (a privacy inbox someone confirmed last week beats any scraper list) |
|---|---|
| Templates | Full request letters, statute citations included |
| Behaviour | Who answers in full, who sends a shrug PDF, who ignores the law |
| Live now | 48 playbooks · no account needed |
| Licence | Open — fork them, send them yourself |
merge when ready
Your data has been upstream long enough.
Sign the designation, pick a bundle, and we start sending today. Ten dollars to find out what one pull turns up — and the playbooks stay free whether you ever pay us or not.