Privacy notice

Anoma Radar is a competitor-research service at console.anomaradar.com. It helps a founder or product lead see what changed on public websites of companies they add, then read a short in-app brief.

Until the contracting-party block names a legal entity, the operator of the service is the person or company that publishes this page under the trade name Anoma Radar. Other companies also use the word “Anoma.” This notice is only about Anoma Radar.

This notice explains how we process personal data when you visit the console, create an account, use the service, complete checkout, or email us. It does not apply to third-party sites we link to or fetch, including competitor websites, Google, Paddle, or pages inside a brief.

Related terms are in the Terms of use. We do not currently offer a signed data-processing addendum.

You sign in with Google. We do not set a password for you.

• From Google: your email address, the name Google sends if any, and a provider subject that ties the Google account to your Anoma Radar user.
• Workspace data you or your teammates set: workspace name, the competitor websites you add, pause and remove actions, and plan choice.
• Billing identifiers we keep so Paddle can charge the workspace: Paddle customer, subscription, and price identifiers. We do not store card numbers.
• Optional workspace API keys issued for that workspace. We store a hash of the secret, not the secret itself.
• Optional company context you enter under Settings → About your company (product, customers, pricing, positioning, and priorities). We store that with the workspace report schedule so briefs can explain why a competitor move matters to you. Fields you leave blank are not used.

We use essential cookies so you can sign in and stay in the right workspace. They are httpOnly, use the Lax SameSite policy, and are marked Secure in production.

• session: opaque session token. About 30 days.
• workspace: which workspace you last used. About 30 days.
• oauth_binding: short-lived binding for the Google sign-in round trip. About 10 minutes.
• auth_flash_error: a one-time sign-in error so the login page can show it. About 60 seconds.

Appearance (light, dark, or system) is stored on your account and copied into this browser’s local storage when you sign in so the interface can match your preference. Google may set its own cookies when you sign in on Google’s site.

Analytics cookies are optional. On the marketing site (www.anomaradar.com) and this console we load Mixpanel only after you accept analytics cookies. Until then we do not initialize Mixpanel and we do not set mp_* cookies. If you accept, those cookies remember an anonymous visitor so we can measure campaigns and which product screens people use. After you sign in, later events are tied to your account id, not your email or name. We do not use Mixpanel for advertising or retargeting. You can change this choice from Cookie preferences on the marketing site, or from Settings → Analytics in the console.

When you add a company website, we fetch public pages for product, pricing, go-to-market, hiring, news, and public financial signals. For each fetch we may store the requested and final URL, time, HTTP status, page title, content hashes, the full HTML, and a cleaned text version. We use those captures to write company briefs, a competitive landscape, monitoring findings, and in-app reports.

We do not store only a small before-and-after snippet. We keep the page capture so later scans and other customers who monitor the same domain can reuse it. We do not currently run an automatic purge of old captures.

Our own fetcher sends a crawler user-agent, refuses private-network addresses, and does not keep retrying when a site returns 401, 403, or 429. We do not sign in, complete CAPTCHAs, or bypass paywalls. We do not currently treat robots.txt as a hard block. Google Gemini may also search or open public pages during research.

Careers pages, news, and similar public sources often name real people. If a page we fetch includes a name, job title, photo, or other personal data, we may store that as part of the capture and show it in evidence. Those people are not our customers.

We use that data only to produce competitive research. We do not contact those people, add them to a marketing list, or treat a careers page as a candidate or employment file.

A company is stored once per public website domain. Background text, page captures, monitoring sources, and landscape research for that domain may be reused for any customer who monitors it.

Your account, workspace membership, the list of competitors you chose, your workspace reports, and billing stay on your workspace. We do not show those to another customer.

Closing a workspace or removing a competitor from it does not erase the shared company record if we still need it for the service or for another customer.

We use personal data to provide the service you asked for, keep it secure, bill through Paddle, and meet legal duties such as tax and accounting. Where a privacy law asks for a legal basis, those purposes rest on contract, legitimate interests in running a secure product, or a legal obligation.

We do not sell personal data. We do not share it for cross-context behavioral advertising. We do not send marketing email today. We do not currently send a weekly brief by email.

We do not train our own models on your account data. To produce briefs we send page text and prompts to Google Gemini. We have not configured a training opt-out for that processing, and we do not claim one.

We share data with the vendors that run the service:

• Google, for sign-in and for Gemini research. See Google’s privacy policy.
• Paddle, which is the merchant of record for paid plans. See Paddle’s privacy policy.
• Google Cloud, which hosts the application and database.
• Mixpanel, for optional product analytics after you consent. Events use an anonymous or account id, not your email or name. See Mixpanel’s privacy policy.

Authorized operators may read account, workspace, and research data to operate, secure, and support the service. We may also disclose data if the law requires it or to protect the service or other people.

Those vendors and our hosts may process data outside the country where you live.

Our hosts keep security and troubleshooting logs. Those logs can include IP address, user agent, time, and error codes. We keep them for a limited time to run and secure the service.

• Account and workspace data: for the life of the account, then as long as we must keep a record after closure.
• Billing records: as Paddle and tax law require.
• Shared page captures and company research: while the company record exists, because later scans and other customers reuse them.
• Security logs: for troubleshooting and abuse prevention.

Depending on where you live, you may have the right to access, correct, export, or delete personal data we hold about you, or to object to some processing. There is no in-product button for these requests. Email support@anomaradar.com from the address on your account.

We may refuse a request that would delete another customer’s shared public-source research, that would break a record we must keep for law or billing, or that we cannot verify. Deleting your account removes your user and workspace association. It does not necessarily erase a company record other customers still use.

The service is for people 18 or older. We do not knowingly collect personal data from children.

If this notice changes, we will post the new version on this page and update the effective date. If a change is material, we will also say so in the product or by email when we have a working way to reach you.

Privacy questions and rights requests: support@anomaradar.com.