Legal
Privacy Policy
Last updated September 5, 2026
This explains what Prop65Shield collects, why we collect it, how long we keep it, who we share it with, and what you can ask us to do about it.
Effective date: September 5, 2026.
Two kinds of information
This policy covers two categories of information. The first is information about you: your name, work email, firm or company, and how you use the product. The second is information about other people that already appears inside the public enforcement records the product organizes, meaning the names of attorneys, enforcers, and company contacts named in public California Attorney General filings. We did not collect that from those people directly. We extracted it from records that were already public. The section on public record data below describes what a person named in those records can ask us to do.
Notice at collection
This is the notice California law requires us to give you at or before the point we collect your personal information. It lists each category we collect, where it comes from, what we use it for, how long we keep it, and who receives it.
| Category | Source | Purpose | Retention | Recipients |
|---|---|---|---|---|
| Identifiers: name, work email address, account identifier, invite or referral tag | You, when you request access, claim an invite, or sign in | Creating and securing your account, sending sign-in links, answering your requests, and understanding which invite brought you | For as long as your account exists, then 24 months after you close it or we close it, unless you ask us to delete it sooner | Cloudflare, Supabase, Resend, PostHog |
| Professional or employment information: company or firm, role, seniority, practice focus | You, when you request access or claim an invite | Deciding whether to grant access, setting what you can see, and shaping the product for the kind of work you do | Same as your account: for as long as the account exists, then 24 months | Cloudflare, Supabase, PostHog |
| Commercial information: searches, AG numbers looked up, reports opened, saved interests, assessment and concierge requests, feedback and notes you write | You, through the product's search boxes and forms | Running the product, delivering what you asked for, and improving what we build next | For as long as your account exists, then 24 months, unless you ask us to delete it sooner | Cloudflare, Supabase |
| Internet or network activity: pages viewed, links and buttons clicked, referring page, browser and device type | Automatically, from your browser, through our analytics tool | Seeing which parts of the product get used, finding where people get stuck, and diagnosing errors | Event and page-view records: 12 months | PostHog, Cloudflare |
| Internet or network activity: IP address | Automatically, from your network connection | Rate limiting, abuse prevention, and security logging | Security and request logs: 90 days | Cloudflare, Supabase, PostHog |
| Approximate location, at the level of city or region, inferred from your IP address | Automatically, derived by our hosting and analytics providers from your IP address | Security, and understanding roughly where our users are | Held only as part of the analytics and log records above, and deleted with them | Cloudflare, PostHog |
| Email delivery records: which messages we sent you, and whether they were accepted for delivery | Our email provider, when we send you a sign-in link or a notification | Confirming that a sign-in link or notification actually reached you, and troubleshooting when it did not | 12 months | Resend, Supabase |
We do not collect Social Security numbers, government identification numbers, financial account numbers, precise geolocation, biometric information, health information, or information about your race, religion, union membership, sexual orientation, or the contents of your private communications. California law calls these sensitive personal information. We do not collect them, and so we do not use or disclose them for any purpose.
We do not sell personal information, and we do not share it for cross-context behavioral advertising, as California law defines those terms. We have not done so in the twelve months before the date at the top of this page. We do not run advertising and we do not use ad-tracking technology.
If we start collecting a new category, or start using a category for a purpose that is not listed above, we will update this notice before we do it.
Cookies and tracking technologies
Our own code sets no cookies. What the product stores, it stores in your browser's local storage or session storage, which stays on your device and is cleared when you clear your browser data. Here is everything we store and what each item is for.
| Name | Type | Set by | Purpose | Lifetime |
|---|---|---|---|---|
| sb-<project>-auth-token | Local storage | Supabase, our authentication provider | Keeps you signed in between page loads. Strictly necessary: without it you would sign in again on every page. | Until you sign out or the token expires |
| prop65.privacy.analytics | Local storage | Prop65Shield | Remembers whether you accepted analytics, so we do not ask again and do not load anything you declined. Strictly necessary: your choice cannot be honored without recording it. | Until you clear browser data |
| prop65.beta.firstSeen | Local storage | Prop65Shield | Records the first time you opened the product, so we can tell a first visit from a return visit. | Until you clear browser data |
| prop65.beta.returnVisitCounted | Session storage | Prop65Shield | Stops one browsing session from being counted as several return visits. | Until you close the tab |
| prop65.beta.intentAnswered, prop65.beta.intentTs, prop65.beta.intentValue | Session and local storage | Prop65Shield | Remembers that you answered the short in-product question about what you came to do, so we do not ask you again. | Session storage until you close the tab, local storage until you clear browser data |
| prop65.compFeedback.v1 | Local storage | Prop65Shield | Keeps your thumbs-up and thumbs-down marks on comparable cases in a report on your own device. It is not sent to us. | Until you clear browser data |
| Scroll position and layout preferences | Session and local storage | Prop65Shield | Puts you back where you were when you return to a list, and remembers whether you left a panel open or closed. | Session storage until you close the tab, local storage until you clear browser data |
| PostHog analytics identifiers | Local storage | PostHog, our analytics provider | Ties the pages and actions in one visit together so we can see how the product is used. Not used for advertising and not shared with advertisers. | 12 months |
Pages on this site load web fonts from Google Fonts. Loading a font from Google means your browser contacts Google and Google receives your IP address and the page you are on. Google states that it does not use Google Fonts requests for advertising. We are working to serve these fonts from our own servers instead, and we will remove this paragraph when we do.
We use no advertising pixels, no cross-site trackers, no chat widget, and no third-party script other than the analytics and font loads described here.
Product analytics
We use PostHog, a product-analytics tool, tied to your account: your member identifier, role, firm, persona, and the pages and actions you take. We do not run session replay: PostHog records no video or reconstruction of your screen, clicks, or typing. The searches, case lookups, feedback, and other form submissions you make are stored in our own database, as described in the notice above.
Analytics runs only after you consent to it. Until you consent, no analytics script loads. If you have an account, you make the choice when you set it up, and it is off unless you turn it on there. Everyone else is asked on the page. You can change the choice at any time from the Privacy choices link in the footer. Strictly necessary storage, meaning the items marked as such in the table above, is not covered by that choice, because the product cannot keep you signed in without it.
Global Privacy Control and Do Not Track
We treat a Global Privacy Control signal from your browser as a valid request to opt out of any sale or sharing of your personal information, and as a request to stop analytics. When we see the signal, we do not load analytics for that visit. This applies from the effective date at the top of this page. We do not need to know who you are to honor the signal, and honoring it does not require you to create an account.
Do Not Track is a separate and older browser setting, and there is still no common standard for how sites should answer it. We do not respond to Do Not Track signals. We do honor Global Privacy Control, as described above.
Sharing and disclosure
We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not run advertising or ad-tracking technology. We disclose information to vendors who act on our behalf, under written contracts that limit them to providing the service and forbid them from using your information for their own purposes: Cloudflare for hosting and content delivery, Supabase for our database and authentication, Resend for email delivery, and PostHog for analytics. California law calls these vendors service providers.
We may also disclose information if required by subpoena, court order, or other legal process, to protect the security of the product or our users, to our professional advisers, or as part of a merger, acquisition, or other business transfer. If we are ever compelled to disclose your information by legal process, we will tell you unless the law forbids it.
Public record data and corrections
If you are named in the public enforcement records the product displays, you may request correction or suppression of the contact details we display about you. Send the request to the address below and we will review it. We do not control the underlying government record and cannot alter it. A request can only affect how we display it.
Do not submit privileged information
Do not submit privileged, client-confidential, or other sensitive material. Prop65Shield is not a law firm, using it does not create an attorney-client relationship, and we do not promise that a submission will remain privileged. We handle submitted information as described in this policy.
Your California privacy rights
If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.
- Know. Ask what categories of personal information we have collected about you, where we got it, why we collected it, who we disclosed it to, and what specific pieces we hold.
- Delete. Ask us to delete the personal information we hold about you, subject to the narrow exceptions the statute allows, such as information we need to keep to comply with a legal obligation.
- Correct. Ask us to fix personal information about you that is inaccurate.
- Opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. We honor Global Privacy Control regardless, as described above.
- Limit the use of sensitive personal information. We do not collect sensitive personal information, so there is nothing to limit.
- Non-discrimination. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised any of these rights.
- Appeal. If we deny your request, you may ask us to reconsider by replying to our decision, and we will respond in writing.
You do not need to be a California resident to ask us these things. We answer the same requests from anyone.
How to make a request
California law requires us to offer at least two ways to reach us with a request. You may use either of these:
- By email to team@prop65shield.com, with "Privacy request" in the subject line.
- By mail to Prop65Shield, Attn: Privacy Request, [POSTAL ADDRESS].
We will acknowledge your request within 10 business days and respond within 45 calendar days, and we will tell you if we need the further 45 days the statute allows. We verify your identity before we act on a request, usually by confirming that you control the email address on the account. An authorized agent may submit a request on your behalf if they give us written permission signed by you, and we may still ask you to confirm it directly.
Children
Prop65Shield is a professional research tool. It is not directed to children, and it is not intended for anyone under 18. We do not knowingly collect personal information from anyone under 18, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has given us personal information, write to us at the address above and we will delete it.
Security and retention
We take reasonable steps to protect your information, including encryption in transit, access controls on our database, and authentication through a managed provider. No system is perfectly secure, and we cannot promise that yours will never be exposed.
We keep each category of information for the period stated in the notice at collection above. When a period ends, or when you ask us to delete your information, we delete it from our live systems. Copies can persist for a limited period in routine backups after deletion, and are deleted when those backups roll over.
Changes to this policy
We may update this policy. The version posted here is the current one, and the date at the top tells you when it last changed. If we make a material change, we will email account holders and update that date. We review this policy at least once every twelve months, as California law requires.
Who we are, and how to reach us
Prop65Shield is operated by Ian Malone, an individual doing business as Prop65Shield, who is the business responsible for the personal information described here. Prop65Shield is independent and is not affiliated with, endorsed by, or acting on behalf of the California Attorney General's office, the Office of Environmental Health Hazard Assessment, or any other government body. Questions and privacy requests may be sent to team@prop65shield.com.