What is true today, and what is not

• Stored only as a bcrypt hashWe cannot read your password
• Changing your password asks for the current one
• Changing or resetting your password signs out every other browser

• Email address and password
• Sign in with GoogleBuilt · needs key
• One sign-in cookie, which page scripts cannot readIt lasts 14 days, or until you sign out

Card payments are not switched on yet. Until they are, nothing on the site or in the app can charge a card, and a plan is paid by an invoice we send you ourselves. Invoices come only from marvin@bungad.com. When card payments are switched on, Stripe takes the payment and card details go to Stripe, never to us.

• A PostgreSQL database on Amazon Web Services, in SingaporeWith storage encryption switched on, as the owner confirmed on 8 October 2026. We did not read this from the system ourselves
• Reached over an encrypted connection that checks the database’s certificate
• bungad.com and the app are hosted on Vercel

The brand names, domains, descriptions and questions you enter stay yours. We use your data to run your service. We do not sell it, and we do not publish anything identifying your account without asking you first.

• PerplexityThe questions we ask it for you
• Amazon Web Services and VercelThey run the database and the sites
• StripePayment and subscription details
• Google FontsYour IP address and browser details, when a page loads its fonts

This site carries no analytics, advertising or tracking scripts. Every cookie is listed in the privacy policy.

• Each brand’s history, and each check’s results, download as CSV files
• A download of your whole accountNot switched on yet. Until it is, email marvin@bungad.com from the address on your account and we will send you a copyPlanned

Delete this account, on the Account page, removes your organisation and everything in our database tied to it, at once. It asks for your password and for you to type DELETE. If the account has a subscription at Stripe, deleting cancels it there first, with no refund. You can also email marvin@bungad.com and we will do it for you, once you confirm from the email address on the account.

Apart from the free check’s daily counters and Google sign-in history, which a daily job clears, nothing deletes data on a schedule, so until you ask, we keep it.

• A check run today stores the domain, what the site does, the questions, the counts, the sites cited and the homepage readingNot the answer text
• Does not store your IP addressThe daily limit counts a one-way keyed hash of it instead
• Reads your homepage only at public internet addressesIt checks again at every redirect, so a site cannot point it at a private network

• A security certificationWe hold none, such as SOC 2 or ISO 27001, and show no badge
• An outside security audit or penetration testWe have not had one
• Single sign-on
• Team rolesAn account has one login

Security questions, or something you think we should know: marvin@bungad.com.