Last updated: 2026-11-08
numbi is a privacy service. This policy explains what personal information we collect, why we collect it, who we disclose it to, how long we keep it, and the choices and rights you have. It covers numbi.app, the numbi web app, and the emails and text messages we send. It also serves as our notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA").
numbi is operated by mjonesone LLC ("numbi", "we", "us"). mjonesone LLC is the business responsible for your personal information under this policy.
When you sign the in-app Authorized Agent Form, you appoint numbi as your authorized agent. numbi then emails a deletion request under the CCPA and the California Delete Act to the data brokers on the California data broker registry. Each request goes from our mail system with your identifying details and a reference to your signed authorization. We re-send requests to brokers that haven't confirmed, about every 45 days. Brokers reply to a numbi address, and we record what they say.
numbi does not file complaints with the California Privacy Protection Agency (CPPA, also called CalPrivacy) or any other regulator. If a broker ignores a verified request past the legal deadline, numbi drafts a complaint with your request history. You decide whether to file it, and you file it yourself.
Our "exposure score" and scan results are estimates. We base them on your ZIP code or answers and on the kinds of data registered brokers say they collect. They are not a lookup of records about you.
California's Delete Act created DROP. It is a free, state-run platform from the California Privacy Protection Agency. California residents can use it to send one deletion request to every registered data broker. Registered brokers must process DROP requests on a recurring schedule (starting August 1, 2026).
numbi is an independent private company. It is not affiliated with, endorsed by, or acting for CalPrivacy, DROP, or the State of California. numbi does not currently submit requests through DROP. It sends its own authorized-agent requests directly to brokers by email. You can use DROP yourself, for free, instead of numbi or alongside it. Using numbi doesn't prevent you from using DROP.
Information you give us
Information created when you use numbi
Payment information
Information collected automatically
utm_ parameters and ad click IDs).t.js): which steps of a form you reached, scroll depth, and whether a field was filled in. We do not record what you type in those events.Sources. You; your browser or device; brokers (their replies to our requests); Stripe (billing status); and Meta (aggregate ad reporting, which is not tied to your account).
We do not use your information to train AI models. We do not build advertising profiles of you to sell to anyone.
Data brokers, as your agent. We send each broker a request with your name, email, phone, mailing address, state of residence, any extra identifiers you've added (date of birth, prior names, aliases, employers, additional emails, phones, and addresses), and a reference to your signed authorization. We give a copy of the signed form when a broker asks for one. This is the purpose of the service. It is not a "sale" or "sharing".
Meta, for advertising ("sharing"). Our web pages load the Meta Pixel, and our servers send events to Meta's Conversions API when someone views a page, enters an email (Lead), creates an account (CompleteRegistration), or starts a subscription (Purchase). These can include your IP address, browser user agent, the page and event, and a purchase value. They can also include a one-way SHA-256 hash of your email address and phone number, which Meta can match to its own users. Meta may use this data for its own purposes, such as ad measurement and targeting. Under the CCPA this is "sharing" for cross-context behavioral advertising, and you can opt out:
Sec-GPC: 1 signal, or you have opted out, we don't load the Meta Pixel and don't send your data to the Conversions API. When we can tie the opt-out to your account or email, it also applies on your other devices and to server-side events.Service providers that process information for us under contract:
| Provider | What they do for us | Information involved |
|---|---|---|
| Amazon Web Services | Hosts our servers and database (United States) | All information we hold |
| Stripe | Payments, subscriptions, billing portal | Billing details, email, name, subscription |
| Twilio | Sends sign-in codes by text message | Phone number |
| Resend | Sends our email, including the deletion requests to brokers | Email address; email content (which, for broker requests, includes your identifiers) |
| Google (Gmail / Google Workspace) | Receives privacy@numbi.app mail and broker replies, which we read to record responses | Broker correspondence about you; messages you send us |
| Google Fonts | Serves the fonts on our pages | IP address and browser details (when your browser loads a font) |
We don't currently use any third-party AI model provider to process your information.
Our own tools. We measure ad performance with Relay, an attribution tool operated by mjonesone LLC (the company that runs numbi). Relay receives page-view, sign-up, and purchase events, ad click IDs, and, for purchases, your email. Relay is part of our own business, not a third party.
Other disclosures. We may disclose information when the law requires it (for example, in response to a valid subpoena), to protect the rights, safety, and security of users, numbi, or others, or as part of a merger, acquisition, or sale of assets. In a sale of assets, this policy would continue to apply to your information.
| Category | Examples | Collected | Disclosed for a business purpose to | Sold or shared |
|---|---|---|---|---|
| Identifiers | Name, email, phone, postal address, IP address, online identifiers, aliases, prior names | Yes | Data brokers (as your agent), service providers | Shared with Meta (IP address, hashed email and phone). Not sold. |
| Customer records (Cal. Civ. Code §1798.80(e)) | Name, address, phone, employment history, last 4 of SSN | Yes | Data brokers (as your agent, except SSN last 4), service providers | Not sold or shared |
| Characteristics of protected classifications | Age (from date of birth, if you add it) | Only if you provide it | Data brokers (as your agent) | Not sold or shared |
| Commercial information | Plan, subscription and payment history | Yes | Stripe | Shared with Meta (the fact and value of a purchase). Not sold. |
| Internet or other electronic network activity | Pages viewed, referrer, funnel events, ad click IDs | Yes | Service providers | Shared with Meta (page views and events). Not sold. |
| Geolocation | Approximate location from your IP address and ZIP (not precise geolocation) | Yes | Service providers | Shared with Meta (IP address). Not sold. |
| Professional or employment information | Employers you add as identifiers | Only if you provide it | Data brokers (as your agent) | Not sold or shared |
| Sensitive personal information | Last 4 of SSN (optional) | Only if you provide it | Not disclosed | Not sold or shared |
| Inferences | Exposure estimate | Yes | Not disclosed | Not sold or shared |
| Biometric, health, precise geolocation | None | No | Not disclosed | Not sold or shared |
We use sensitive personal information only to provide the service you asked for and for security, as the CCPA allows. We don't use it to infer characteristics about you. We have no actual knowledge that we sell or share personal information of consumers under 16.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
numbi_session | numbi | Keeps you signed in (HttpOnly) | 30 days |
numbi_pending_email | numbi | Carries the email you entered into sign-up | Up to 1 hour |
numbi_marketing_ok | numbi | Remembers your marketing-email choice before you have an account | Up to 30 days |
numbi_zip | numbi | Pre-fills the ZIP you entered at the scan | 7 days |
numbi_ref | numbi | Remembers who referred you | Up to 30 days |
relay_cid | numbi | Ad click ID, so we can attribute a sign-up to an ad | Up to 30 days |
numbi_home, numbi_variant, numbi_optv, numbi_offer, numbi_capexp | numbi | Keeps you on the same page or offer version during tests | Up to 90 days |
numbi_dns | numbi | Remembers your Do Not Sell or Share opt-out | 2 years |
numbi_anon (local storage) | numbi | Random ID that groups funnel events from one browser | Until cleared |
numbi_email (local storage), numbi_exit (session storage) | numbi | Remembers you already entered an email, so we don't ask again | Until cleared / end of session |
es_sid, es_s, es_bot (session storage) | numbi | Random ID for one browser tab's masked usage session (see Section 3) | End of session |
numbi_es_paid | numbi | Notes a completed checkout for the next page's usage session | 5 minutes |
_fbp, _fbc and other Meta cookies | Meta | Meta Pixel ad measurement. Not set if you opt out or send GPC | Set by Meta (typically up to 90 days) |
You can block or delete cookies in your browser. Blocking numbi_session prevents sign-in. Deleting numbi_dns removes the browser-level opt-out, but an opt-out saved to your account stays in place.
Visit counts: our web server logs each page request (the time, the page, your IP address and browser type). To show a live count of people on the site we use only a one-way hash of those details that changes daily. No cookie or script is used for this. Raw server logs are deleted after 14 days.
| Information | How long |
|---|---|
| Account profile, identifiers, request history, exposure estimates | While your account is open |
| Pre-signup email (if you never create an account) | Until you ask us to delete it, or 24 months after capture |
| Page-view logs, funnel events, sign-in code records | About 13 months |
| Masked usage sessions | 14 days (counts per page without session detail: 90 days) |
| Sign-in sessions | Until they expire (30 days) |
| Billing records (in our database and at Stripe) | As long as tax and accounting law requires (generally 7 years) |
| After you delete your account: your signed Authorized Agent Form and the log of requests sent and broker responses | 24 months, then deleted |
| After you delete or unsubscribe: your email on our do-not-email list | Indefinitely, only to make sure we never email you again |
| Backups | Backup copies may contain your information until they are deleted or overwritten |
What happens when you delete your account. Use Account & billing → Delete my account, or email privacy@numbi.app. Any active subscription is canceled immediately. We then delete: your name, email, phone, mailing address, SSN last 4, extra identifiers, exposure estimates, sessions and sign-in codes, your pre-signup email record, our email-send logs for you, and your entries on our marketing lists. We also remove your name, email, and phone from our internal activity log and remove IP and browser data from your funnel events. We keep, for the reasons below:
Deleting your account stops all new and repeat requests. It does not undo deletions brokers have already completed, and a broker that already received a request may still complete it. Information already sent to Meta under Section 6 is held by Meta under Meta's own policies.
If you're a California resident, you have the right to:
How to make a request. Email privacy@numbi.app from the email on your account, or use the in-app controls. Deletion is under Account & billing, and your identifiers are under Your data. To protect you, we verify requests to know, delete, or correct. Usually we ask you to confirm from the email or phone on your account, and we may ask for more information if a request is sensitive. Opt-out requests don't need verification. We'll confirm receipt within 10 business days and respond within 45 days. If we need more time, we'll tell you, and we may take up to 45 more days.
Authorized agents. You can have someone else make a request for you. We'll ask for your signed permission, and we may ask you to verify your identity with us directly, unless the agent has a valid power of attorney under California Probate Code §§4121 to 4130.
Other US states. Residents of other states with privacy laws (for example Colorado, Connecticut, Virginia, Texas, and Oregon) can make the same requests the same way. If we deny your request, you can appeal by replying to our decision with "Appeal" in the subject. If we deny the appeal, you can contact your state attorney general.
If you're outside the United States, you can make the same requests. numbi is built for California residents and is hosted in the United States.
When numbi sends a request for you, it acts as your authorized agent, as the CCPA permits (Cal. Civ. Code §1798.135(e) and the CCPA regulations). That means:
numbi is for adults 18 and older. We don't knowingly collect personal information from anyone under 16. If you believe a child has given us information, email privacy@numbi.app and we'll delete it.
We use TLS (HTTPS) for all traffic to numbi.app, encrypt SSN last 4 at the application level with AES-256-GCM, limit access to the production systems that hold your data, and use one-time text-message codes instead of passwords. No system is perfectly secure. If a breach affects your information, we'll notify you as the law requires.
When our practices change, we update this page and the "Last updated" date. If we make a material change, we'll email account holders before it takes effect.