Your privacy choices

What “sale” and “share” mean here

Under the CCPA as amended by the CPRA, a “sale” is broader than an exchange of cash — it includes disclosing personal information to a third party for any valuable consideration. “Share” is a separate, CPRA-specific category covering disclosure for cross-context behavioral advertising, again whether or not money is involved. We are not going to hide behind the fact that Credit Defense Hub never sells a mailing list or takes payment for your data. The honest answer is narrower and more specific than “we don’t sell your data”:

What we actually share, and with whom

Google Analytics 4, if it’s enabled for a given deployment of this site. The analytics setup is optional and controlled by a single environment variable (NEXT_PUBLIC_GA_MEASUREMENT_ID) — see src/app/layout.tsx. When it’s set, we load Google’s gtag.js with IP anonymization turned on and configure no advertising features ourselves. But once your browser talks to Google’s servers at all, Google receives your IP address, device and browser information, the pages you viewed, and a handful of named interaction events we define (like “a template was viewed” — never what you typed into a calculator; see State Law Privacy Notice for the full list). We have not configured Google’s Restricted Data Processing setting or disabled Google Signals for this property, and we don’t control what Google does with data once it has it. Out of caution, we treat this as a “share” under CPRA’s broad definition, even though we run no advertising ourselves and receive no payment from Google for it.

That is the entire list. No ad networks, no data brokers, no social media pixels, no “we may share with our partners” catch-all. If that ever changes, this page changes with it.

Cookies, plainly

Our own code never sets a cookie — check for yourself, there is no document.cookie anywhere in this site’s public pages. If analytics is enabled, Google’s script sets its own first-party cookies in your browser (typically named _ga and _ga_<container-id>) to tell repeat visits apart. We add no advertising, cross-site, or fingerprinting cookies of our own, and we never will without rewriting this page to say so.

Turn it off — a control that actually works

This is a real toggle, not a decorative one. Clicking it writes your choice to this browser’s local storage, immediately tells Google’s analytics script to stop sending data for the rest of this visit using Google’s own documented opt-out signal, and silences this site’s own event tracking too. It also checks whether your browser is already sending a Global Privacy Control (GPC) signal and treats that the same as switching this off, automatically, with no click required.

What this control can and can’t guarantee — honestly

This site is a fully static export with no server that remembers you between visits (see Security), so this switch works entirely inside your browser:

• It takes effect immediately, for the rest of this browsing session — including if you click through to other pages, since your choice stays applied for as long as this browser tab stays open.
• It cannot retroactively erase a page-view hit that already fired earlier in this same visit, before you made a choice.
• A saved “off” choice does not, by itself, reach forward in time to block analytics the instant a brand-new tab loads tomorrow — this page has to run once per browser to reapply it, the same way any single page on a static site can only affect what happens after it loads. A live Global Privacy Control signal does not have that limitation, which is exactly why we check for it automatically above.

For a permanent, whole-browser opt-out that works from the very first request to every site you visit, not just this one, turn on Global Privacy Control — it ships built into Firefox, Brave, and DuckDuckGo, and is available as a free extension for Chrome, Edge, and Safari — or install Google’s own Analytics Opt-out Browser Add-on. We treat both as authoritative, and a fake-looking toggle that couldn’t back any of this up would be worse than no toggle at all — which is why we’re telling you exactly what it does instead of just asking you to trust it.

“Do Not Sell or Share My Personal Information”

This page is that link. We do not sell personal information for money, full stop. The control above is how you opt out of the one category of sharing described above (optional analytics). If we ever add anything else that would count as a sale or share under CPRA, Virginia’s VCDPA, Colorado’s CPA, or Connecticut’s CTDPA, it will be disclosed here first and covered by this same control or a clearly linked one.

Questions or a request we haven’t covered

For anything not handled by the control above — access, deletion, or correction requests under your state’s privacy law — see the State Law Privacy Notice for your rights and how to reach us. We don’t run a separate request portal; every privacy request comes through the same contact page a correction or a question would.