Privacy

Claimbo is operated as a public consumer-protection platform. The platform is the controller of any personal data you submit to it. Contact: privacy@claimbo.com.

• Account data: the email you sign in with, the display name we mask from it for public attribution (e.g. "ali***@example.com"), the timestamp of each magic-link request and consume.
• Complaints + comments: the text you write, the company you direct it at, your monetary-loss figure if any, attached evidence, plus IP and User-Agent of the submission for fraud-detection and rate-limiting.
• Verification answers: your "yes / no" on the 7-day did-this-get-fixed email, and the timestamp of your reply.
• Cookies: a single HttpOnly + SameSite=Strict refresh-token cookie for authenticated sessions, plus the consent-preference cookie itself. No third-party trackers, no analytics pixels, no ad cookies. See /cookies.
• AI run logs: for every moderation / coach / composer call we keep input hash, model name, prompt version, and decision — for audit replay and cost tracking. Plain-text inputs are retained only as long as the underlying complaint/comment row exists.

• We don't sell personal data. Ever.
• We don't run third-party trackers, ad pixels, or session-replay tools.
• We don't profile you for advertisers.
• We don't take pay-to-remove. Every removal is logged on the company's page.

Attached files are scanned for PII (faces, account numbers, document numbers) by a self-hosted model on our infrastructure. Redacted output replaces the original on the public page; the raw file remains in private storage for the audit window only and is deleted on the same retention schedule as the complaint itself. We never ship raw evidence to a third-party AI.

• Published complaints + comments: kept indefinitely while public; on author request, withdrawn (still public-marker as "withdrawn" with no body).
• Magic-link tokens: 24 hours, single-use.
• Refresh tokens: 7 days from issue, revoked on logout.
• AI run logs: 12 months for audit + cost analysis.
• Server logs: 30 days; personal identifiers in logs (IPs) hashed after 7 days.

Wherever you are: you can request a full export of your data, correction of factual errors, and deletion of your account (which withdraws all your published complaints and removes your account row). Email privacy@claimbo.com and we'll respond within 30 days.

California residents: we don't sell personal information under CCPA. EU residents: see GDPR Articles 15–22 for the rights enumerated above. Filing a complaint with your local supervisory authority is always available to you and we won't retaliate for it.

Today: Anthropic (LLM moderation + composer + coach), self-hosted Postgres, self-hosted object storage, self-hosted Redis. We minimise what goes to Anthropic — input hashes, structured fields, and the user-typed prose of the complaint or comment under moderation. No email, no IP, no payment info.

Claimbo is not directed at children under 16. Don't sign up if you're under 16.