Security
An honest account of how your data is protected today, and what's still in progress.
Why we're writing this the way we are
A service built to protect your privacy should be straightforward about its own security posture, including the parts that aren't finished yet. This page describes what's actually true about how Delist My Data handles data today, not an aspirational checklist. We'll update it as things change — additions and removals both.
In transit
- All traffic to Delist My Data is served over HTTPS/TLS; plain-HTTP requests are redirected.
At rest
- Removal-search data — the name, address, date of birth, and phone number you submit — and the matches and screenshots we generate from it are currently stored as ordinary database rows and files, without field-level encryption. Encrypting this data at rest is planned and will be turned on before it holds real user submissions at any meaningful scale.
- Screenshots of matched broker listings are currently stored on our application server's disk rather than a separate managed store.
Access control
- There is no customer-facing account system today, so there's no login-based path for a user to view another user's data.
- Internal access to removal-search data is limited to the engineering team operating the service, via direct server/database access rather than a general-purpose admin panel. We don't yet have an access-audit log for this — it's on our list before an admin interface is built, so that any future internal access to your data is both gated and logged rather than open-ended.
What we don't do
- We don't sell your personal information — and we don't share it for cross-context behavioural advertising.
- We don't run advertising, remarketing, or cross-site tracking tags. We removed the Google Ads tag this site briefly carried.
- We do run Google Analytics 4 for traffic measurement, with ads-personalisation signals switched off. It receives site-usage data only — never the names, dates of birth, addresses, ID documents, matches, or screenshots behind a removal request. See the Privacy Policy for the full disclosure and how to opt out.
Reporting a security issue
If you believe you've found a security vulnerability affecting Delist My Data, please email contact@delistmydata.com with details. We ask that you give us a reasonable window to investigate and address the issue before any public disclosure.
For how we handle your data more broadly, see our Privacy Policy.