Privacy policy

Last updated October 7, 2026

BureauGap is a product of TBG Strategic Consulting LLC ("we", "us"). This page says what we collect, and what we never see. Questions go to hello@bureaugap.com.

Your credit reports never reach us

The console reads your reports inside your browser, on your own computer. They are not uploaded. The console page carries a security policy (connect-src 'none') that tells the browser to refuse every outgoing connection from it. So the page cannot send a report anywhere, even by mistake. You can check that policy in your browser's developer tools.

If you choose to keep your reports for next time, a copy is stored in your browser's storage (IndexedDB), on this computer. It is not encrypted, and we cannot see it. "Forget these reports" in the console erases it. If you say no, nothing is kept after you close the tab.

In the bankruptcy forms module, your Social Security number is typed in only to fill in the forms that ask for it. It is used inside the page, it is not kept in the console's storage, and it is never sent to us. The filled forms you download contain it, because the court forms ask for it.

What we do collect

• When you buy: Stripe takes your payment on its own page. Stripe sends us your email address, the name you gave it, what you bought and a payment reference. We never see your card number.
• Your email address is used to send your licence key, to resend it if you ask at bureaugap.com/recover, and to answer you if you write to us. We do not send marketing email unless you ask for it.
• The free-report reminder, only if you sign up. At bureaugap.com/remind you can ask for a short email that says your credit reports are free. We first send one email to check the address is yours. Only after you click the link in it is your address added to the list. The list is kept by Resend, our email service. Every reminder has a link to stop, and stopping takes you off it.
• Basic request records. Like any website, the servers that deliver these pages record things such as IP address, the page asked for and the time. We use them to keep the site running and to limit abuse.

Cookies, tracking and ads

The console has no analytics, no ad pixels and no tracking scripts, and it never shows ads. It sets one cookie. That cookie holds your licence key, so your browser stays signed in to the console. It is set only when you enter a key.

Ads on the home page. The home page, bureaugap.com, can show ads from Google AdSense. Ads are shown only to visitors in the United States. It asks you first. A banner offers Accept and Decline, and nothing from Google loads unless you tap Accept. If you accept, Google's ad code runs on the home page. Google and its partners may then set cookies, or read cookies they set before, to pick which ads you see and to count them. Google also gets the details any website gets from your browser, such as your IP address and the page you are on. Google explains how it uses this data at policies.google.com/technologies/partner-sites. You can turn off ads based on your interests at adssettings.google.com.

Your answer is kept in your browser's storage, on this computer, so the banner does not ask on every visit. To change it, use "Cookie settings" at the bottom of the home page. If you decline after you accepted, no new ads are requested, and the next time the page loads, Google's code is not loaded at all.

Ads never appear in the console or the demo, and Google's code never runs there. Your credit reports are never on the home page, so the ad code cannot see them.

Who else handles your data

• Stripe processes payments and keeps the record of your purchase.
• Resend delivers the licence key email, and keeps the reminder list if you sign up for it.
• Railway hosts the website.
• Cloudflare runs the domain and the network in front of it.
• Google shows ads on the home page, and only if you accept them there. See "Cookies, tracking and ads" above.

We do not sell the personal information we collect, such as your email address and purchase record. We do not give it to Google or anyone else for advertising. If you accept ads on the home page, Google collects its own data through its cookies, as described above.

How long we keep it

Your purchase record stays with Stripe. We need it to resend a lost key and to keep tax and accounting records. If you sign up for the reminder, your address stays on the list until you use the link to stop, or ask us to delete it. Request records are kept only as long as our hosting providers keep their logs.

Your choices

You can ask what we hold about you, or ask us to delete it. Write to hello@bureaugap.com. Some purchase records must be kept by law. Once your purchase record is gone, your key can no longer be sent again.

Children

BureauGap is not meant for children under 13, and we do not knowingly collect their information.

Changes

If this policy changes, the date at the top changes with it. If we ever add anything that sends data from the console, this page and the claim on the home page change first.