How we score
Next to each account in the guide you will see a letter, A to E. We call it the clarity band. It answers one question: how clearly does this service let you leave, back up your data and say no to things?
It is not a safety rating and not an opinion. Every point comes from a fact you can check yourself, with a link to where we read it.
The facts
| What we look at | How it earns points |
|---|---|
| Closing the account | You can do it yourself on the web: 15. Through support, or only in the app: 8. |
| Where your settings live | On the web, or web and app: 5. Only in the app, or a phone menu (USSD): 0. Not known: 3. |
| Backing up your data | A download exists: 10. |
| A deletion page is linked | 5. |
| A privacy policy is linked | 5. |
| Your content and their AI | Not used for training by default: 10. Used unless you opt out: 0. Not known: 5. |
| Personalised ads | Off by default: 10. On unless you turn them off: 0. Not known: 5. |
| How readable the terms are | School grade 10 or below: 10. Up to grade 14: 5. Harder: 0. Not measured: 5. |
| How long the terms are | Up to 5 000 words: 5. Up to 12 000: 2. Longer: 0. Not measured: 2. |
| How many other documents they link to | Up to 5: 5. Up to 15: 3. More: 0. Not measured: 3. |
| Global Privacy Control | The site publishes that it honours the signal: 10. Publishes that it does not: 0. Says nothing: 5. |
| Breaches in the last three years | None: 10. One or two: 5. Three or more: 0. |
That adds up to 100. When we do not know a fact, the service gets half the points for it. Missing data should not make a service look better or worse than its neighbours.
| Band | Points |
|---|---|
| A | 85 to 100 |
| B | 70 to 84 |
| C | 55 to 69 |
| D | 40 to 54 |
| E | 0 to 39 |
Two labels appear beside the band and do not score: whether the service is a very large online platform under the EU Digital Services Act, and whether its owner is a gatekeeper under the EU Digital Markets Act. Both come from the European Commission's published lists.
Where the numbers come from
Once a week we fetch each service's terms and privacy pages once, the way a browser would. We keep a fingerprint of the text, its word count, a readability grade and how many other documents it links to. We do not keep the text, and we never summarise or compare versions. We also ask the site whether it honours Global Privacy Control, a browser signal that means "do not sell or share my data", by reading a small file sites publish for that purpose.
Breach counts come from the Have I Been Pwned breach catalog (CC BY 4.0).
Use the data
The scorecard is published as JSON at secbird.io/scorecard.json under CC BY 4.0. Credit "SecBird scorecard, secbird.io". If you think a fact is wrong, the guide has a "Suggest a correction" link under every step, and disputes are public.