Apple Watch / Apple Health app (Apple Inc.)
Apple's Health app and Watch are, on paper, the strongest of the mainstream options for reproductive and fitness data after Dobbs…
Unassigned
Companies
Every company record in the dataset, worst first. Rows marked unverified have not been checked against a primary source.
Results
Apple iCloud Mail
Apple's structural position is worth recording accurately rather than flattering: iCloud Mail is encrypted in transit and at rest, but Apple holds the keys…
Unassigned
Aramark
Nothing consumer-facing confirmed this pass.
Unassigned
Arlo
No breach or regulator action against Arlo was found this pass.
Unassigned
Asbury Automotive
One of the dealership groups that flagged CDK-related disruption.
Unassigned
Assurant
Nothing confirmed
Unassigned
Astound Broadband (fmr. RCN)
Astound uses standard 'business records' retention framing and provides an explicit California Notice at Collection - the latter being the more interesting…
Unassigned
Atlantic Union Bank
If you banked with Sandy Spring Bank, you didn't choose to leave — Sandy Spring was merged into Atlantic Union on April 1, 2025, and its branches and…
Unassigned
Audible (Amazon)
Nothing confirmed
Unassigned
Auto-Owners Insurance
Mutual insurer distributing through independent agencies (Auto-Owners describes itself as dedicated to the independent agency system), which means…
Unassigned
AutoZone
AutoZone was caught in the MOVEit vulnerability - the 2023 file-transfer flaw documented across this tracker that produced breaches at dozens of entirely…
Unassigned
BGE (Baltimore Gas & Electric)
BGE is an Exelon company, sharing a corporate parent with Pepco and Delmarva Power, which means the smart-meter data-handling policies that matter to a…
Unassigned
BJ's Wholesale Club
Nothing confirmed
Unassigned
BMW (My BMW App / ConnectedDrive)
Reading BMW's own app/connected-services terms may not tell you your full legal exposure at all.
Unassigned
Balance
Nothing confirmed
Unassigned
Bank of America
According to policy-monitoring site ConductAtlas, Bank of America updated its Deposit Agreement in spring 2026 (effective mid-May 2026) to add mandatory…
Unassigned
Baxter International
Nothing confirmed
Unassigned
BeReal
BeReal's entire premise — a simultaneous front-and-back camera capture at a random moment each day…
Unassigned
BeenVerified
Nothing confirmed
Unassigned
Bend
A simple stretching-routine app discloses that your data 'may be used to track you across apps and websites owned by other companies'…
Unassigned
Berkshire Hathaway
Nothing confirmed
Unassigned
Biogen
Biogen's neurology portfolio means its patient support programmes and trial data touch cognitive and neurodegenerative diagnoses…
Unassigned
Bird
Bird filed for Chapter 11 in December 2023 and its assets were acquired, which makes this the tracker's cleanest illustration of what happens to your data…
Unassigned
BlackRock
The world's largest asset manager, whose consumer relationship runs almost entirely through retirement plans and fund platforms rather than directly…
Unassigned
Blackstone
Nothing confirmed this pass at the parent level, and the finding is what Blackstone owns: it is the parent of Rover, documented in the Gig Economy tab, and…
Unassigned
Blue Apron (Wonder Group)
Nothing confirmed
Unassigned
Bob Evans (Post Holdings)
Nothing confirmed
Unassigned
Bolt (ride-hailing)
Bolt has faced data-protection rulings in Ghana and Kenya (no EU GDPR enforcement action against it was located this pass), and the structural note for all…
Unassigned
Booz Allen Hamilton
Nothing consumer-facing confirmed this pass.
Unassigned
Bristol-Myers Squibb
Nothing confirmed
Unassigned
Broadcom
Nothing consumer-facing confirmed this pass.
Unassigned
Burke & Herbert Bank
Burke & Herbert (which describes itself as the oldest continuously operating bank under its original name headquartered in the Greater Washington, D.C. area)…
Unassigned
Burlington Stores
Off-price retail with a large share of non-loyalty transactions, which is an incidental data-minimisation advantage rather than a deliberate one.
Unassigned
CAVA
Nothing confirmed
Unassigned
CHANI
Nothing confirmed
Unassigned
CMS Energy
Nothing confirmed
Unassigned
CNA Financial
Nothing confirmed
Unassigned
Caesars Entertainment
Caesars was breached in 2023 through social engineering of an outsourced IT support vendor, and reporting indicates Caesars paid a substantial ransom while…
Unassigned
Calm
Two separate problems. First, Calm's privacy policy does not specify how long it retains your data or cookies…
Unassigned
Campbell's
Packaged food sold through retailers. Campbell's acquired Sovos Brands (Rao's) and Snyder's-Lance, so several brands consumers think of as independent sit…
Unassigned
CapCut (ByteDance)
Rodriguez v. ByteDance alleges CapCut collected biometric identifiers - facial geometry and voiceprints - from users editing their own videos, without the…
Unassigned
Capital Bikeshare (CaBi)
Capital Bikeshare is publicly branded and operated under contract by Lyft/Motivate, which is the finding…
Unassigned
Capital One
Capital One lets you turn on a 'Datasharing' feature to connect your account to third-party apps…
Unassigned
CarMax
An early-2026 leak of roughly 431,000 email addresses with names, phone numbers and physical addresses was published as data allegedly sourced from CarMax…
Unassigned
Carrier Global
HVAC and building systems, increasingly connected.
Unassigned
Carta
Carta manages cap tables, which means it holds equity positions for startup employees - people who are not Carta's customers.
Unassigned
Casey's General Stores
Convenience and fuel across the Midwest with a substantial rural footprint where it is frequently the only fuel and grocery option in a small town…
Unassigned
Centene
Nothing confirmed
Unassigned
CenturyLink / Quantum Fiber / Brightspeed
Nothing confirmed
Unassigned
Charles Schwab (incl. legacy TD Ameritrade)
Schwab's own required arbitration disclosure admits, in writing, that 'a MINORITY OF ARBITRATORS MAY BE AFFILIATED WITH THE SECURITIES INDUSTRY'…
Unassigned
Try fewer filters, or clear them all.