Privacy Policy
Effective: May 2026 · NORM Analytics
1. Who we are
NORM Analytics operates trynorm.co. We are the data controller for information collected through the NORM service. For questions: support@trynorm.co.
2. What we collect
| Data | When | Why |
|---|---|---|
| Email address | Account creation, waitlist signup | Authentication, account recovery, service communications |
| Brand searches | When you search or request a scan | To improve coverage and understand which brands matter to users |
| Saved brands & alerts | When you add to your watchlist | To deliver score-change alerts you request |
| Subscription data | If you purchase a paid plan | Billing, access management, receipts |
| Auth token (local storage) | On login | Keeps you signed in across sessions |
| Basic usage data | During site use | Bug fixes and performance monitoring; not behavioural advertising |
We do not collect precise location data. We do not build advertising profiles. We do not read your health records, fitness data, or any data beyond what you directly provide to NORM.
3. How we use your data
- Account management — authentication, subscription access, support
- Score-change alerts — notifying you when brands on your watchlist are re-scored
- Coverage decisions — aggregated, anonymised brand search demand helps us decide which brands to score next
- Service communications — onboarding, significant product changes, billing events. Not marketing newsletters unless you opt in.
- Security — detecting abuse, fraud, and unauthorised access
We do not use your data for advertising and do not sell it to data brokers. Brand search demand is held strictly in aggregated, non-identifiable form and never shared with the brands you are researching.
4. Third parties we use
| Service | Purpose | Data shared |
|---|---|---|
| Google Cloud | Authentication, database (Cloud SQL), API hosting (Cloud Run) | Email, account data, saved brands, request logs (IP, endpoint, timestamp) — retained 30 days |
| Stripe | Payment processing (paid plans) | Payment details (handled entirely by Stripe; we see billing status only) |
These services are bound by their own privacy policies and by contractual data processing agreements. We select sub-processors that maintain industry-standard security practices.
5. Cookies and local storage
NORM uses browser local storage to keep you signed in between sessions (auth token). We do not use third-party tracking cookies or advertising pixels. Clearing your browser's local storage will sign you out.
6. Data retention
Account data is retained while your account is active and for up to 90 days after deletion (to allow recovery in case of error). Anonymised, aggregated demand signals (which brands were searched) are retained indefinitely — these cannot be linked back to individual users. Server request logs are deleted after 30 days.
7. Your rights
Depending on your location, you may have rights to:
- Access — request a copy of your personal data
- Correction — update inaccurate data
- Deletion — request erasure of your account and associated personal data
- Portability — receive your data in a machine-readable format
- Object — opt out of any processing you do not consider necessary
To exercise any of these rights, email support@trynorm.co with the subject "Privacy Request". We will respond within 30 days.
You can delete your account at any time from your account page.
8. Children
NORM is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us personal information, contact us and we will delete it promptly.
9. Security
We use industry-standard practices: encrypted connections (HTTPS/TLS), access controls, and separation of production and non-production systems. No system is perfectly secure — if you suspect unauthorised access to your account, contact us immediately.
10. Changes to this policy
We may update this policy. Material changes will be communicated by email to registered users at least 14 days before taking effect. The effective date at the top of this page reflects the most recent revision.
11. Contact
Privacy questions and requests: support@trynorm.co
Legal inquiries or disputes: legal@trynorm.co
General contact: NORM Analytics, support@trynorm.co
12. Brand data
Brand-level data analyzed by NORM is publicly available marketing content. No private or personal brand data is collected without consent. All scoring data is aggregated and non-identifiable at the individual consumer level. NORM does not collect personal information from brand employees or representatives unless voluntarily submitted through account creation or evidence submission.
13. NORM Browser Extension
The NORM browser extension operates under a strict "privacy-first" architecture in full compliance with Chrome Web Store User Data policies:
- Data Collection: The extension collects only the URL of the active tab (using the activeTab and tabs permissions) and an authentication token (if you are signed in). It does not collect browsing history, personal identifiable information (PII), health records, or form data.
- Data Handling: The collected URL is temporarily processed in real-time to query our database for a brand transparency score. It is never logged or attached to your user profile. We use the 'storage' permission solely to securely maintain your authentication session locally on your device.
- Data Storage: Authentication tokens are stored locally on your device using Chrome's secure storage APIs. We do not store any browsing data, URLs, or extension-related search queries on our servers.
- Data Sharing: We do not share, sell, or transfer any data collected by the extension to third parties, advertisers, or data brokers. Data is processed strictly for the sole purpose of providing the extension's core functionality.
For more details on how the extension uses specific Chrome permissions, see our Technical Transparency page.