TOS & Privacy Cheat Sheet
Plain-English summaries of what major tech companies collect from you. Know your data rights before you agree.
Privacy Score Guide
Gmail • YouTube • Search • Chrome • ...
What They Collect
- • Name
- • Phone
- +2 more
- • GPS
- • IP address
- • Wi-Fi networks
- +1 more
- • Search history
- • Watch history
- • Voice recordings
- +1 more
- • Emails
- • Documents
- • Photos
- +1 more
- • Device IDs
- • Browser type
- • OS version
- +1 more
- • Payment info
- • Purchase history
- • Billing address
Data Retention
Varies: 18 months for some data, indefinite for account data. Users can auto-delete after 3, 18, or 36 months.
Who They Share With
Shares with affiliates, service providers. May share with advertisers (aggregated). Complies with legal requests.
Positives
- +Extensive user controls
- +Data portability
- +Transparency reports
Concerns
- −Extensive tracking by default
- −Cross-service data linking
- −Ad-based business model
Your Controls
Meta (Facebook)
Facebook • Instagram • WhatsApp • Messenger • ...
What They Collect
- • Name
- • Phone
- +2 more
- • GPS
- • Check-ins
- • IP address
- +1 more
- • Posts
- • Likes
- • Comments
- +3 more
- • Photos
- • Videos
- • Messages
- +1 more
- • Friends list
- • Contacts uploaded
- • Group memberships
- +1 more
- • Websites visited (via Pixel)
- • App usage
- • Purchases
Data Retention
Data retained until account deletion. Some data retained for legal compliance. "Shadow profiles" for non-users.
Who They Share With
Shares across Meta companies. Partners with advertisers. Third-party apps. Legal requests.
Positives
- +Some transparency tools
- +End-to-end encryption on WhatsApp/Messenger (optional)
Concerns
- −Extensive cross-platform tracking
- −Shadow profiles
- −Multiple privacy scandals
- −Default settings favor data collection
Your Controls
Apple
iCloud • iMessage • App Store • Apple Pay • ...
What They Collect
- • Name
- • Phone
- +2 more
- • Device IDs
- • Usage statistics
- • Crash data
- +1 more
- • iCloud data (encrypted)
- • Photos
- • Backups
- +1 more
- • GPS (with permission)
- • Location history (on device)
- • Find My data
- • Health app data (encrypted on device)
- • Fitness data
Data Retention
Minimized collection. Most data processed on-device. iCloud data retained until deletion.
Who They Share With
Limited sharing with service providers. No ad-based business model. Complies with legal requests.
Positives
- +Privacy-focused design
- +On-device processing
- +End-to-end encryption
- +App tracking controls
- +No ad business
Concerns
- −iCloud data accessible to Apple (except Advanced Data Protection)
- −Siri recordings reviewed (opt-in)
Your Controls
Microsoft
Outlook • Teams • OneDrive • Windows • ...
What They Collect
- • Name
- • Phone
- +1 more
- • Search queries
- • Browsing history (Edge)
- • App usage
- +1 more
- • Emails
- • Documents
- • Chat messages
- +1 more
- • Device IDs
- • Diagnostic data
- • Error reports
- +1 more
- • Cortana/Copilot queries
- • Voice recordings (if enabled)
Data Retention
Varies by service. Bing search: 6-18 months. Diagnostic data: up to 30 days. Account data until deletion.
Who They Share With
Affiliates, service providers. LinkedIn data for advertising. Complies with legal requests.
Positives
- +Privacy Dashboard
- +GDPR compliant tools
- +Enterprise privacy options
Concerns
- −Windows telemetry by default
- −LinkedIn data integration
- −Bing search tracking
Your Controls
Amazon
Amazon.com • Prime Video • Alexa • AWS • ...
What They Collect
- • Name
- • Phone
- +2 more
- • Order history
- • Browsing history
- • Wishlists
- +1 more
- • Alexa recordings
- • Voice commands
- • Wake word detection
- • Ring doorbell footage
- • Prime Video watch history
- • Delivery addresses
- • Device location
- • Sidewalk network data
Data Retention
Purchase history retained indefinitely. Alexa recordings until deleted. Varies by service.
Who They Share With
Third-party sellers, service providers. Alexa skills developers. Ring/law enforcement (with warrant). Advertising partners.
Positives
- +Alexa deletion controls
- +Some transparency
Concerns
- −Extensive purchase tracking
- −Voice always listening (wake word)
- −Ring law enforcement partnerships
- −Sidewalk network opt-out
Your Controls
OpenAI
ChatGPT • GPT API • DALL-E • Whisper • ...
What They Collect
- • Name
- • Phone (optional)
- +1 more
- • Chat history
- • Prompts
- • Generated responses
- +1 more
- • Features used
- • Time spent
- • Device info
- +1 more
- • API calls
- • Input/output data (API users control retention)
Data Retention
Consumer: Conversations retained for 30 days (can opt out of training). API: Not used for training by default.
Who They Share With
Service providers. May share aggregated data. Complies with legal requests. API data not shared.
Positives
- +Training opt-out available
- +Temporary chat mode
- +API data not used for training
- +Clear documentation
Concerns
- −Default uses conversations for training
- −Conversations reviewed by humans (safety)
- −30-day retention
Your Controls
TikTok
TikTok • TikTok Shop • CapCut • TikTok LIVE
What They Collect
- • Name
- • Phone
- +2 more
- • Face and voice data
- • Faceprints
- • Voiceprints
- • Videos watched
- • Watch time
- • Searches
- +2 more
- • Videos created
- • Drafts
- • Messages
- +1 more
- • Device IDs
- • Keystroke patterns
- • Battery state
- +1 more
- • GPS
- • SIM card info
- • IP address
Data Retention
Data retained until account deletion. May retain for legal compliance. US data in Oracle cloud (USDS).
Who They Share With
ByteDance affiliates. Advertisers. Business partners. "As required by law" (China national security concerns).
Positives
- +Some privacy controls
- +US data storage initiative (Project Texas)
Concerns
- −Extensive biometric collection
- −China data access concerns
- −Clipboard access
- −Keystroke monitoring
- −Algorithm opacity
Your Controls
X (Twitter)
X/Twitter • Spaces • Communities • X Premium
What They Collect
- • Name
- • Phone
- +2 more
- • Posts
- • Likes
- • Retweets
- +3 more
- • GPS (if enabled)
- • IP address
- • Tweet location
- • Device IDs
- • Browser info
- • Cookies
- +1 more
- • Contacts uploaded
- • Following/followers
- • Interactions
Data Retention
Active account data retained indefinitely. Deleted tweets may persist in backups. DMs retained on servers.
Who They Share With
Advertisers (aggregated). Third-party apps. Service providers. Legal requests. Data may train xAI (Grok).
Positives
- +Data download available
- +Some privacy controls
Concerns
- −Data used for xAI training
- −Limited deletion controls
- −History of data breaches
- −Reduced content moderation
Your Controls
Snap
Snapchat • Snap Map • Spotlight • My AI • ...
What They Collect
- • Name
- • Phone
- +2 more
- • Snaps
- • Stories
- • Chats
- +2 more
- • Precise GPS (Snap Map)
- • IP address
- • Location tags
- • Face data (Lenses)
- • Voice (if recorded)
- • Usage patterns
- • Friend interactions
- • Content viewed
Data Retention
Snaps deleted after viewing (unless saved). Stories: 24 hours. Memories: until deleted. Chat: 24 hours or after viewing.
Who They Share With
Advertisers. Third-party apps. Service providers. Legal requests. Snap Map visibility (friends or public).
Positives
- +Ephemeral by design
- +Ghost Mode
- +Messages auto-delete
Concerns
- −Location sharing risks (Snap Map)
- −Face data for Lenses
- −My AI data collection
- −Screenshots possible
Your Controls
Yahoo (AOL)
Yahoo Mail • AOL Mail • Yahoo News • Yahoo Finance • ...
What They Collect
- • Name
- • Phone
- +2 more
- • Emails
- • Attachments
- • Calendar
- +1 more
- • Search queries
- • News read
- • Ad interactions
- +1 more
- • Device IDs
- • Browser info
- • IP address
- +1 more
Data Retention
Account data until deletion. Emails retained until deleted. Search history: 18 months.
Who They Share With
Verizon affiliates. Advertisers. Third parties for personalization. Legal requests.
Positives
- +Privacy Dashboard
- +Some ad controls
Concerns
- −Email scanning for ads
- −Verizon data sharing
- −Legacy security issues
Your Controls
Important Disclaimer
This cheat sheet provides simplified summaries for educational purposes. Privacy policies and terms of service change frequently. Always read the official documents (linked above) for complete and current information. Privacy scores are subjective assessments based on publicly available information. Last updated: January 2026.
What is ECPA?
The Electronic Communications Privacy Act (ECPA) is a 1986 U.S. federal law that governs wiretapping and electronic eavesdropping. It establishes when the government can access your electronic communications and what protections providers must offer.
Under ECPA, communications providers (like email and messaging services) must comply with government requests for data under certain circumstances, including warrants, subpoenas, and court orders. Understanding what each provider collects helps you know what data could potentially be disclosed.
Learn more about ECPA