Stories by Its Not Nicole on Medium

I Read The Policies So You Don’t Have To; Bambu Lab (3D Printing Software & Equipment)

Its Not Nicole — Wed, 21 Oct 2026 15:11:17 GMT

Bambu Lab designs and manufactures cloud-connected desktop 3D printers, along with the filament, accessories, software and online services which let users create, share and print 3D models.

A company registered in China with operations globally, surpassing an estimated $1.5 billion in revenue through 2025, and a total of more than 1.2 million units shipped globally since their debut printer drop in May 2022.

By accessing, visiting or using their Products and Services users confirm they have read and understood the practices at play. “If you are not comfortable with any part of this Privacy Notice, please immediately discontinue access or use of our Products and Services”.

This article consists of a review of Bambu Lab’s;

Bambu Lab state that their privacy policy applies to all personal data collected through; interactions with their website, make a purchase from their store, use their software or applications, interact with MakerWorld, or engage with their products or services — whether engaging with such in a personal or professional capacity, with Bambu Lab acting as data controller.

WHAT INFORMATION IS COLLECTED BY BAMBU LAB

Bambu Lab state that they may collect the following information;

Account and profile details
Name
Username
Display name
Email address
Postal Address
Contact information
Shipping and billing details
Country, region, city, state, ZIP code
Payment and transaction information
Creator verification
Tax and payout information
Support materials
Diagnostic logs
User generated content (UGC) (which may include print model files, details, photos, videos, posts, comments and other content or written materials the user submits or makes available through their services.
Drivers licence or ID number
Credit/Debit card number
Chat messages
Products purchased
Order history
Payment and tax information (for creators)
Browsing and search activity on Bambu Lab sites
App and software usage
Search history
Interactions with websites, apps, ads and services
Model views
Downloads
Favourites
Print history
Where supported and enabled, printer camera features may capture images, videos or time laps recordings.
Account ID

Additionally, Bambu Lab automatically collect “Information about your device, network and activity” which may include;

Technical identifiers
Device and browser details
App and firmware information
Usage data
Interactions with Bambu Lab platforms
Diagnostic or performance information from connected Bambu Lab devices.
Inferred location
IP Address
Device system settings
SIM Card region
Device ID

There is an additional “Printing Task-Specific Privacy Notice” buried in the privacy policy, under which they explain what data is processed when sending a print task to the printer under either LAN-only mode or cloud-connected mode.

Under that supplementary notice they state they they may collect;

Process printing task-related data
Printing history records
G-Code files
Device operation logs

When LAN Only mode is enabled, the printer works within the local area network and communicates with the slicer for sending files and monitoring, in that mode all printing task-related data stays within the local network.

Device operation logs are stored locally on the device by default.

For printing related tasks where there is concern for privacy, including printing history records and G-code files, the user can enable “Private Printing Mode”. In that mode the users printing history records and G-code files are removed from the Bambu Lab cloud in 72 hours.

Under the “MakerLab-Specific Supplemental Notice” they state they may collect;

Content the user submits
Content generated in response to user input
Text prompts
Uploaded images
Reference files
Parameter selections
Generated 2D images
Generated 3D model files
Associated metadata

Bambu Lab may receive information from third party sources and combine it with information collected directly from the user or their user of Bambu Lab products and/or services.

Third parties are described as;

Single sign-on providers
Social login providers
Marketplaces and retailers
Payment and logistics partners
Advertising and analytics partners
Publicly available sources

DATA RETENTION

Bambu Lab’s retains personal data “for as long as necessary to provide our Products and Services” — they do not provide any specific retention periods, which strongly suggests data is retained indefinitely.

WHAT IS DISCLOSED & WITH WHO

Visual data collected through a supported and enabled printer camera is processed locally on the device unless the user enables cloud based features, requests support or chooses to upload or share the content.

Personal data collected by Bambu Lab may be disclosed with;

Bambu Lab corporate group
Service providers and processors
MakerWorld marketplace and related transaction participants
Business partners, sponsors and other third parties
Analytics and interest-based advertising partners
General public (profiles, ratings, reviews etc are public)
Authorities, Courts, Regulators and other third parties for legal or safety reasons

Bambu Lab is a globally operating country with servers and service providers located in various counties, thus personal data may be stored, accessed or processed in countries or regions other than where the user resides.

TERMS OF SERVICE

“You acknowledge that we may use your personal data and any user content, input, uploads, or feedback that you provide to us to analyze your interactions with us and develop, improve, and enhance machine learning models that power such AI technology”

Bambu Lab does not knowingly collect the data of individuals under the age of 13.

Users must be at least 18 years of age (or have reached the age of majority as per the laws of their local jurisdiction) to use the Store and Services.

Users are required to create an account to place an order with Bambu Lab.

Users agree to not, and not allow any other person to misappropriate, intrude or make other inappropriate use of Bambu Lab products, including use of such products being limited to the reproduction of non-copyrighted materials, materials the user owns the copyright of, or materials the user is legally permitted to reproduce.

Bambu Lab guarantees a five-year provision of software updates following the launch of a product including updates to further enhance the user experience and solving bugs which may be present, following which they may bring less frequent updates if at all.

Bambu Lab commits to a minimum of seven years of security updates.

Breach of obligations with any terms of conditions may result in the deactivation of the users account and loss or restriction of access to the content associated wit the product (including software).

COOKIES

Bambu Lab deploys 115 cookies, which can be viewed here

These include their own cookies, in addition to cookies from;

Stripe
Paypal
TrustArc
GeeTest
Cloudflare
Airwallex
Google Analytics
Microsoft Clarity
Hotjar
Microsoft Ads
Meta Pixel
Reddit Pixel
Google Ads

Any questions? Reach out! https://x.com/Alph4betSoup

Read other articles in this ‘I Read The Policies So You Don’t Have To’ series;

If you find my research or other articles useful, entertaining, or insightful, you can buy me a drink or a lil treat to say thanks or simply spoil me bc I am worth it

buymeacoffee.com/alph4betsoup

https://throne.com/alph4betsoup

I Read The Policies So You Don’t Have To: McDonalds (Fast Food Restaurant & App)

Its Not Nicole — Tue, 13 Oct 2026 15:37:40 GMT

This article consists of a review of McDonalds;

Many McDonalds restaurants are owned and operated by franchisees who are independent business owners, thus McDonald's make clear that much information is subject to the individual policies of franchise owners, but that they may remain to collect personal information when a person visits a restaurant, uses their website or apps, or otherwise interacts with them as a company.

WHAT INFORMATION IS COLLECTED BY MCDONALDS

McDonald’s collect the following information, which is freely given by users in order to engage with some of their services (particularly their app);

Name
Postal address
Email address
Phone number
Birthday information
Age
Gender
Transaction information (including about the products you buy, prices, method of payment)
Username
Password
Preferred times of visit/purchase
Payment information (card details)
Location Data (if using the order ahead feature of the app

They describe the information they collect through automated technology as;

IP address
Computer or mobile device operating system
Browser type
Type of mobile device and its settings
Unique device identifier (UDID) or mobile equipment identifier (MEID) of device
Device and component serial numbers
Advertising identifiers
Referring webpage or application
Online activity on other websites, applications or social media
Visits to restaurants
GPS
Wi-Fi
Bluetooth
Cell tower proximity

McDonalds state that they may combine information collected from users with information that they collect through automated methods and from other sources.

They describe the other sources as;

McDonald’s Corporation
McDonalds Global Markets LLC
Affiliates
Subsidiaries
Franchisees
Business partners
Vendors (food delivery platforms, data providers, payment processors)
Public sources

Unlike many corporations which state they do not actively collect the data of children, McDonalds state “We do not intend to process personal information about any child unless data is needed for a specific activity of which their parent or legal guardian is fully aware…”.

They state that Body Worn Cameras (BWCs) may be used in some McDonald’s restaurants, noting that they may capture audio and video but are switched off by default, only capturing recordings is activated by a crew member.

Images of customers head and shoulders are also captured on using a drive through facility captured at the time of the customer placing the order. They state that the image is not permanently saved to any device, that it is only displayed on the cashiers till and deleted within 30 minutes of the sale being completed.

DATA RETENTION

The statement on data retention is brief, and doesn’t really provide any real clarity

WHAT IS DISCLOSED AND WITH WHO

Personal information may be shared with;

Other McDonald’s companies within The McDonalds Family
Suppliers
Franchisees
IT service providers
Marketing agencies
Public authorities and Courts
Business partners (e.g. food delivery platforms i.e. if ordering through the McDonalds App, personal information is shared with Uber Eats to facilitate the delivery)
Advertising partners (including customer match advertising services)
Meta
Snap
Twitter
Google
AI

Due to the global nature of the corporation and international locations of franchisees, data may be shared throughout the global network including being located on servers outside of the jurisdiction of the user.

Polite reminder, that data shared becomes subject to the privacy policies and terms of the receiver of the data (and in turn, their third parties etc etc).

With regard to sharing with AI, they do not disclose much beyond “we use AI to assist us in providing you with effective customer service. For more information about how we use AI, please contact us…”

TERMS OF SERVICE

When a user signs up for McDonalds Rewards, they consent through those terms for their information to be used for their experience to be personalised.

Orders cannot be cancelled once paid. The legal right to change your mind and cancel a contract during the “cooling off” period according to the McDonalds Terms, does not apply.

However, Consumer Rights still apply;

If a user engages with the App to place an order, whether for collection or delivery, the user is entering into a legal contract, thus users of the App must be aged 18+.

If a person makes an order through the app where the delivery is fulfilled by Uber Eats, that person is entering into around four different legal contracts in order to receive that service.

100% of tips go to the delivery driver (where that service is used)

COOKIES

McDonalds deploy a number of their own cookies, in addition to some of the third party kind;

Any questions? Reach out! https://x.com/Alph4betSoup

Read other articles in this ‘I Read The Policies So You Don’t Have To’ series;

If you find my research or other articles useful, entertaining, or insightful, you can buy me a drink or a lil treat to say thanks or simply spoil me bc I am worth it

buymeacoffee.com/alph4betsoup

https://throne.com/alph4betsoup

I Read The Policies So You Don’t Have To; Reddit (Social Media Discussion Platform)

Its Not Nicole — Fri, 02 Oct 2026 12:08:42 GMT

Claiming around 500 million active weekly users enabling them a revenue of $2.2 billion in 2025, a remarkable estimated $2.06 billion of which stemmed from advertising to their users, they describe themselves as “the place for people to gather for conversations about the things they care about”, which is a funny way of saying they’re basically an advertising company.

This article consists of a review of Reddit’s;

WHAT INFORMATION IS COLLECTED BY REDDIT

Reddit emphasise that a user does not need an account to use Reddit, but that choosing to use Reddit without an account will limit the experience.

Reddit seek to emphasise that due to the nature of not needing an account to view the service, that any data collected through a created account is voluntarily provided.

If a user chooses to create an account, Reddit will collect;

Username
Password (if not using Single Sign-On (SSO)) feature
Mobile number (particularly if using SSO)
Interests
User account preferences

The following information Reddit collects, leaning on the “this is all provided voluntarily” basis.

Bio
Gender
Birthday
Location
Language (being used and settings on device)
Profile picture
Social Links
Public content (including posts, comments, chat messages, usernames and some of the users profile information as well as related metadata. May also include; text, links, images, gifs, audio, videos etc).
Saved drafts of posts or comments
Non-public messages with other users (including private messages, private chats and modmail)
Reports
Forms/Feedback provided
Actions the user takes (including voting, saving, hiding and reporting, interactions with user users.
If purchasing products from or through Reddit; payment information, the product and/or service being purchased, purchase date(s), amount(s) paid or received.
Public blockchain data and addresses; such as when a user purchases or creates a Collectible Avatar, receive or mint an NFT or create a Reddit Vault (Reddit Vault private key information is “never stored”

Reddit state they automatically collect some information as the user interacts with and uses their services, which may include;

IP address
User agent string
Browser type
Operating system
Referring URLs
Device ID
Device settings
Mobile carrier name
Pages visited
How the user interacts with content, ads and communities
Upvotes/downvotes
Links clicked
The requesting URL
Search terms used
Information collected through Cookies
Approximate location

Reddit state they may also collect information of/about users from other sources such as;

Linked Services (third-party services)
Advertising partners
From Integrations (including embeds, advertising technology or app store APIs)
Unofficial mobile app client (where used by the user)

There are some additional sections of policy which apply if a user engages with certain offerings from Reddit, under which Reddit collects the following data;

Reddit Ad Users

Name
Email address
Information about the users company
Documentation to verify identity (where requested/provided)
“When using Reddit Ads, we may record a session replay of your visit for customer service, trouble shooting, and usability research purposes”.

Reddit Pro Users

Profile type
Name
Industry category
Website
Organisation size
Documentation to verify identity (where requested/provided)

Reddit Program Participants (Contributor Program etc) (& Potential Participants)

Name
Date of birth
Address
Email
Tax ID
Government ID
Payment Information

DATA RETENTION

Except for the IP address used to create an account, which is retained indefinitely, any other collected IP addresses are deleted after 100 days.

Reddit is a public platform, and is subject to much scraping, they note that they “cannot guarantee that third parties have deleted copies of Reddit public content they’ve made without your of our permission” — including a small paragraph about the rise of AI misusing public data in said scraping fashion has become more prominent.

Information Reddit collects, they store for “as long as necessary for the purpose(s) for which we originally collected it” which they cite as being “legitimate business purposes”.

WHAT IS DISCLOSED AND WITH WHO

Reddit does not control how third party services collect personal data when they serve their content via embeds, data collected through embeds are subject to the controller of the embeds policies.

As a global platform with international operations, servers are based in the US, but data is transferred to affiliates, service providers and third parties located in various other countries.

They also state that they may share data;

With the users consent (its in the terms that the user consents)
With linked services
With service providers
To comply with the law
With affiliates

Reddit Program Participants (Contributor Program etc) (& Potential Participants)

Data is shared with Reddit’s third-party payment and compliance providers to determine eligibility in the program and facilitate payments and is subject to the third-party providers privacy policies and terms.

TERMS OF SERVICE

Persons under 13 are not permitted to use Reddit services, and users must be at least 18 years old to view mature content.

User is responsible for their Content, which could expose them to liability if the user posts or shares Content without all of the necessary rights to post or share said content.

User retains ownership rights in their content, but grant to Reddit a “worldwide, royalty-free, perpetual, irrevocable, non-exclusive, transferable, and sublicensable license to use, copy, modify, adapt, prepare derivative works of, distribute, store, perform, and display Your Content and any name, username, voice, or likeness provided in connection with Your Content in all media formats and channels now known or later developed anywhere in the world. This license includes the right for us to make Your Content available for syndication, broadcast, distribution, or publication by other companies, organizations, or individuals who partner with Reddit”.

Reddit claim to have “no obligation to screen, edit or monitor your Content, we may, in our sole discretion, delete, deem your Content ineligible for monetization or remove your Content, at any time and for any reason…”

Moderators are required to follow a code of conduct. Reddit reserves the right (but has no obligation to) overturn any action or decision of a moderator if Reddit believes that such action or decision is not in the interest of Reddit or the Reddit community.

Any claims against Reddit must be made within the State of California, however users waive many of their legal rights and Reddit have capped their liability at $100.

AGE VERIFICATION

Reddit’s age verification partner is Persona, you can find the link to their privacy policy and terms review further down this page.

COOKIES

Reddit services do not respond to “do not track” requests.

Reddit does not disclose its third party cookie partners, only its own two cookies

Any questions? Reach out! https://x.com/Alph4betSoup

Read other articles in this ‘I Read The Policies So You Don’t Have To’ series;

If you find my research or other articles useful, entertaining, or insightful, you can buy me a drink or a lil treat to say thanks or simply spoil me bc I am worth it

buymeacoffee.com/alph4betsoup

https://throne.com/alph4betsoup

I Read The Policies So You Don’t Have to; Costco (Membership Only Retail Wholesaler)

Its Not Nicole — Tue, 29 Sep 2026 11:13:35 GMT

Costco operate 924 warehouse locations across 14 countries worldwide, serving over 145 million cardholders globally through around 82 million member accounts.

In fiscal year ending 2025 they amassed a global net revenue of $269.8 billion.

Not bad for a members only retailer of traditionally good value merchandise at discounted prices.

This article consists of a review of Costco’s;

WHAT INFORMATION IS COLLECTED BY COSTCO

The information Costco collects depends on how the user interacts with their services (i.e. online only or in store only, or a mix of both), not all instances of data collection apply to all people.

Costco state they may collect the following information;

Name
Username
Email Address
Physical address
Phone number
Membership account number
Identity document information (drivers license or passport) and details within the document
Date of Birth
Photograph
Online account credentials
Employer name (if the user signs up for membership via their employer)
Age
Gender
Veteran status or membership in organisations that offer discounted Costco memberships
Payment card information
Delivery information
Billing address
Travel documentation (if using Costco Travel)
Facial images and measurements
Purchases and transaction information
Product details
Purchase price
Date of purchase
Tender type
Location of transaction
Usage and interactions of Costco online services
Referring URL
Pages viewed
How long spent on a page
Access times
“We capture images of screens you view and collect information about how you interact with particular screens”
Device information
IP Address
“Other unique device identifiers”
Device type
Device operating system
Operating System version
Browser type
Language
Software settings and configurations
Mobile network information
Geolocation (when connecting to a Costco provided Wi-fi at a warehouse or use a location based feature)
Call recordings and transcripts (if the user interacts with Costco by phone or chat)
Video and digital images (in stores/parking lots, when using virtual try-on features or when retrieving products from lockers)
Biometrics (through video and digital image capture)
Images of licence plate (licence plate number, state and “other vehicle information, if you park on or near our facilities”)

Costco state they may also obtain information from other sources;

Commercial data brokers
Other companies with which the person engages

Some information collected falls under the category of “health data” (i.e. prescriptions, health related purchases).

DATA RETENTION

Costco state in a very waffly way that they retain data in an ongoing fashion, providing no indication of retention periods and state in no capacity that data is ever deleted

We are operating on a trust me bro basis with this one.

Automatic License Plate Recognition data is retained for “approximately 180 days” unless a reason warrants longer retention (incident investigation etc)

WHAT IS DISCLOSED AND TO WHO

Costco state they may disclose personal information to;

Other account members and account administrators (“if your employer purchased your membership, we may disclose your name, address, purchase history and membership level or status to your employer”)
Household or business affiliate members
Other companies the person engages with
Businesses offering co-branded products or services
Affiliates
Service providers (including vendors, corporate affiliates and related companies)
Service providers
Citi (where a member applies for a Citi/Costco Anywhere Visa Card)
Suppliers
Shipping vendors
Advertising, marketing and analytics providers (including advertisers, publishers, social media platforms, advertising technology providers and measurement and analytics vendors)
To meet legal or regulatory requirements

Additionally, Costco discloses to tobacco manufacturers the name, address, brand(s) purchased and amount of product purchased by business members who acquire tobacco products through Costco.

You can view the 28 A4 page long list of third parties Costco has shared personal information with during at least the last six months here

TERMS OF SERVICE

Shirts and shoes must be worn on Costco property at all times (that’s actually a clause in the terms, lol)

COOKIES

The list of cookies that Costco deploy can be found here

OTHER CONSIDERATIONS

If using mobile methods of payment, the facilitator of the payments receive information about the transaction(s) in order to facilitate them (i.e. using apple pay etc) — at least just using your debit/credit card and/or cash there is no additional layer of third parties having access to said personal information.

Any questions? Reach out! https://x.com/Alph4betSoup

Read other articles in this ‘I Read The Policies So You Don’t Have To’ series;

If you find my research or other articles useful, entertaining, or insightful, you can buy me a drink or a lil treat to say thanks or simply spoil me bc I am worth it

buymeacoffee.com/alph4betsoup

https://throne.com/alph4betsoup

Introducing; ‘Privacy Paradox’ -Courtesy of Perkins Fund

Its Not Nicole — Sun, 20 Sep 2026 16:00:14 GMT

Hello, small update from me;

The ‘I Read The Policies So You Don’t Have To’ series, has a new home!

https://privacy.perkinsfund.org/

This isn’t an ad, or a sponsored post.

It is only a post of gratitude. Perkins Fund very kindly offered to host the existing articles (and future ones) on a new privacy themed subdomain of Perkins Fund, to feed into the wider collective of resources they offer to those with a thirst for understanding.

Perkins Fund (PCEF) is a 501(c)(3) non-profit with the mission of expanding access to practical cyber security education.

They do this through providing access of the free kind to tools, labs, resources and courses in malware analysis, reverse engineering, threat detection, secure programming, privacy-first software and defensive security.

The tools they offer include; Traceix, Cortex Agents, Secure Legion, Veilance, Ransom Note Comparison, YARA Rule Builder, & more!

If you’re active on Twitter you should definitely be following; @PerkinsFund, @usetraceix, @SecureLegion and @veilanceapp.

I have personally been letting @veilanceapp run on one of my devices for the last week or so as I go about basic browsing, it is has been somewhat interesting to see in real time what is going on in a data collecting and sending sense, the researcher in me also enjoys contributing data sets to a wider project that has a purpose other than making someone else advertising revenue from said data sets.

Having read so many policies at this point, its interesting for sure seeing how the policies actually align with what is happening in the browser, that’s something I’ll be trying to formulate into article form soon.

I’ll still be uploading articles to here (and Medium) of course, to get them straight to your inbox you know what to do;

Subscribe!

I posted the first article in this series back in late March 2026. We’re now in late September, and are 28 articles posted deep into this utter madness.

I’ve another dozen articles on standby in the bank to post including; Amazon, Microsoft, Bambu Labs, Windscribe, GitHub, Klarna, Dyson, McDonalds, Reddit, Costco (Membership), Intigriti & Tesco Clubcard.

From there, we’ll have fun finding out.

“Alphabet Soup” has reached a point of internet fame (for reading privacy policies…mental) where accounts now regularly reach out with an iteration of “would you do ____”, the answer is usually yes.

The dozen articles coming products and services mainly requested for review by readers and some OG nerds.

If you have any thoughts, feedback or suggestions, reach out! Alphabet Soup

I Read The Policies So You Don’t Have To; Bugcrowd (Vulnerability Reporting Platform)

Its Not Nicole — Sat, 19 Sep 2026 20:48:50 GMT

A privately owned company formed in 2012, Bugcrowd don’t post their financial information publicly, and any estimates for annual recurring revenue (ARR) are sitting between $200m-$328m.

They carry an estimated $1bn in valuation, nine funding rounds deep.

This is a review of Bugcrowds;

It is worth noting that individual programs through Bugcrowd are subject to their own additional terms and policies, this is just an overview of the services as a whole, not individual programs within the platform.

WHAT INFORMATION IS COLLECTED BY BUGCROWD

Bugcrowd state that they my collect;

Name
Contact details
Photographs
Examples of your work
Information on work previously performed via the service and outside of the service
Skills and “other information”
Information the user discloses in any postings on the service “You should be aware that when you disclose information about yourself on Bugcrowds pages, blogs, private messages and community forums, [we] will collect the information you provide in such submissions, including personal information”.

Bugcrowd state that there may be some automatic data collection through use of their services or other methods of web analysis including;

IP address
Cookie identifiers
Mobile carrier
Mobile advertising identifiers
MAC address
IMEI
Advertising ID
“Other device identifiers that are automatically assigned to your computer or device when you access the internet”
Browser type
Language setting(s)
Geo location information
Hardware type
Operating system
Internet Service Provider
Pages the user visits before and after using the Services
Date and time of the users visit
The amount of time the user spends on each page
Information about the links clicked and pages viewed within the Service

If a user undertakes identity verification Bugcrowd may require;

Full name
Email address
Telephone number
Residential address
Identification documents (passport, drivers licence or other government issued documentation)
Government issued ID numbers
Age
Gender
Place of birth
Nationality
Place of residence
Selfie or image
Biometric information; including facial image extracted from photos within identification information and any selfies submitted
Identity verification outcome (and related profile which is generated)

DATA RETENTION

Bugcrowd retain information pretty much indefinitely, “for as long as you use our Services or as necessary to fulfil the purpose(s) for which it was collected, provide our Services, resolve disputes, establish legal defences, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws”

Where required by law, biometric information is stored for no more than one year.

WHAT IS DISCLOSED AND WITH WHO

“We may share any information we receive, including biometric information with vendors and service providers”.

This may include;

Providers of IT and related services
Payment processors
Jumio (biometric verification partner)
Business partners
Advertising partners
Bugcrowd customers (when a user makes a submission some information is shared with the customer)
Legal and similar disclosures (e.g. to comply with law enforcement or national security requests and legal processes including court orders and subpoenas)

Data collected via or by Bugcrowd may be transferred, processed and stored anywhere in the world due to international reach and use of cloud servers globally.

TERMS OF SERVICE

Researchers are independent contractors of Bugcrowd.

Each submission is evaluated by the Program Owner on the basis of first-to-find. Bugcrowd may assist in the evaluation process.

Bugcrowd are committed to protecting the interests of Security Researchers, “the more closely your behaviour follows these rules the more we’ll be able to protect you if a difficult situation escalates”

Valid submissions to Bugcrowd can count towards ISC2 Continuing Professional Experience (CPE) credits, where the user provides their ISC2 ID into the Bugcrowd Portal.

Taxes to be paid on monetary rewards are the sole responsibility of the user.

Any monetary rewards which remain unclaimed or undeliverable for a period of six (6) months will be forfeited.

There are a number of common “non-qualifying” submission types, users are discouraged from reporting these issues unless they can demonstrate a chained attack with high impact;

Descriptive error messages (e.g. Stack Traces, application or server errors).
HTTP 404 codes/pages or other HTTP non-200 codes/pages.
Banner disclosure on common/public services.
Disclosure of known public files or directories, (e.g. robots.txt).
Clickjacking and issues only exploitable through clickjacking.
CSRF on forms that are available to anonymous users (e.g. the contact form).
Logout Cross-Site Request Forgery (logout CSRF).
Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
Lack of Secure and HTTPOnly cookie flags.
Lack of Security Speedbump when leaving the site.
Weak Captcha / Captcha Bypass
Username enumeration via Login Page error message
Username enumeration via Forgot Password error message
Login or Forgot Password page brute force and account lockout not enforced.
OPTIONS / TRACE HTTP method enabled
SSL Attacks such as BEAST, BREACH, Renegotiation attack
SSL Forward secrecy not enabled
SSL Insecure cipher suites
The Anti-MIME-Sniffing header X-Content-Type-Options
Missing HTTP security headers, specifically (https://blog.veracode.com/2014/03/guidelines-for-setting-security-headers/)

Users may qualify for a reward if they were the first eligible person to alert the Program Owner to a previously unknown issue AND the issue triggers a code or configuration change. Rewards can take the form of USD, Bugcrowd Points, CPE points, or Swag.

The user agrees that they have obtained the necessary approvals and consents from all third parties including their employer for the purpose of participating as a Researcher.

The user agrees to assign to Bugcrowd any and all of their Testing Results and rights thereto; to the extent any rights are not assignable, the user shall grant and agrees to grant to Bugcrowd “an irrevocable, paid-up, royalty free, perpetual, exclusive, sub-licensable (directly or indirectly through multiple tiers), transferable, and worldwide license to use and permit others to use such Testing Results in any manner desired by us (and/or our customers and sponsors, without restriction or accounting to you”.

The user agrees to waive in favour of Bugcrowd any moral right or other claim that is contrary to the intent of a complete transfer of rights to Bugcrowd in the users Testing Results.

All submissions are confidential information of the Program Owner unless otherwise stated in the Bounty Brief, no submissions may be publicly disclosed at any time unless the Program Owner has consented to disclosure.

All findings must be submitted with a full description, proof of concept and complete replication steps in the original report. Where the initial report lacks any of those reports will be automatically closed.

COOKIES

Bugcrowd deploy cookies, pixel tags/web beacons and analytics trackers and partner with;

Google Analytics
LinkedIn Analytics
Facebook Connect.

OTHER CONSIDERATIONS

Personal information may be de-identified and/or aggregated, in that instance it is no longer considered by Bugcrowd as Personal Information and may be shared within Bugcrowd and with third parties.

Bugcrowd do not respond to or honour Do Not Track (DNT) signals or mechanisms transmitted by web browsers.

Researchers are required under the code of conduct to not use GenAI tools in a manner which discloses any confidential information.

Any questions? Reach out! https://x.com/Alph4betSoup

Read other articles in this ‘I Read The Policies So You Don’t Have To’ series;

If you find my research or other articles useful, entertaining, or insightful, you can buy me a drink or a lil treat to say thanks or simply spoil me bc I am worth it

buymeacoffee.com/alph4betsoup

https://throne.com/alph4betsoup

I Read The Policies So You Don’t Have To; Facewatch (Facial Recognition Software)

Its Not Nicole — Thu, 17 Sep 2026 14:34:49 GMT

Facewatch are a facial recognition crime prevention tool currently being rolled out to retailers across the UK, existing clients being the likes of; Sainsbury’s, Budgens, Spar, Home Bargains, Sports Direct, B&M, Southern Co-Op, Farm Foods, Frasers, Flanners, River Island and many many more.

Their technology is scanning millions of faces each week, describing themselves as “the only crime prevention tool that proactively identifies known criminals, allowing staff to act before a crime has been committed”.

Facewatch cameras screen every person who walks into a store where they are deployed.

“If your staff subsequently notice that someone who has entered your premises has committed a crime, they can log into the Facewatch system and add them to the database”.

When a person is added to the Facewatch database they become a ‘Subject of Interest’.

When a Subject of Interest returns to that store, or goes to another store with the Facewatch system installed, an alert is issued.

Prior to an alert being issued a process happens.

Retailers deploying the Facewatch system are required to display signage outside of the property to inform customers of the technology.

This article consists of a review of Facewatch’s;

Facewatch works by converting the facial images captured by Facewatch cameras of persons entering a Subscriber premises using facial recognition algorithm templates which are then used to compare the facial recognition templates within their database of Subjects of Interest, creating alerts if there is a potential match.

WHAT INFORMATION IS COLLECTED BY FACEWATCH

The information collected depends on whether you are a customer of Facewatch or a customer of a business which utilises the services of Facewatch.

If you are a customer of Facewatch (i.e. deploying their systems) they collect;

Name
Email address
Contact details
User account activity
Audit logs
IP address
Approximate location

If you are a person walking into a retail store or business premises the following data is collected;

Facial images
Subject of Interest information added by the Subscriber (Facewatch customer)

DATA RETENTION

Personal data is only retained for so long as it is considered necessary and proportionate to do so for legal purposes.

Where a customer of Facewatch closes their account the personal data associated with that account is deleted from Facewatch systems within 30 days unless it is needed to be retained for audit purposes (e.g. they raised an incident report), in which instance that data is deleted a maximum of one year.

Recorded Incidents are retained for one year.

Alert data (excluding images and biometric data) is retained for 7 days.

Alert time and location data is retained for 48 hours.

Detected faces from the camera feed an alert are trained for 7 days

Biometric data is deleted at the point of being converted into facial biometric measurements.

Where a person under 18 is added to the Subject of Interest database data is retained for six months.

Other Subject of Interest data is retained for a period of up to 12 months from their last recorded incident, apart from where the incident involves a weapon or threat, in which case it is retained for two years.

Findings of no crime, not guilty or cessation of proceedings will lead to removal of that incident report against the Subject of Interest database.

WHAT IS DISCLOSED AND WITH WHO

Facewatch use AWS UK servers, which includes use of AWS facial recognition software as a secondary check for accuracy of their own systems.

Data is shared with AWS, UK becomes subject to AWS privacy policies.

Facewatch state that data is not shared with third parties except;

Where required by law, or
Where necessary to maintain the security and integrity of the system (e.g. incident investigation.

TERMS OF SERVICE

There are no Terms of Service available for customers of businesses where Facewatch is deployed, the Terms of Service apply to customers of Facewatch.

Equipment (‘The Edge Equipment’) is supplied and owned by Facewatch and includes third-party facial recognition software.

Facewatch acts as data controller. Images of SOIs may be uploaded by the Subscribers, any information provided may be used to create alerts for the benefit of other subscribers where appropriate.

The services may only be used by persons over the age of 18 and must be an employee, director, partner or otherwise authorised to do so by a current subscriber (Facewatch customer).

All rights in Intellectual Property in the Services are owned by Facewatch.

All Subject of Interest information supplied must be true to the best of the knowledge of the retailer. Making a false or malicious report may itself be a crime.

Customers of Facewatch must only use the technology in any way that breaches any applicable local, national or international law or regulation (including the DPA) or is in any way unlawful or fraudulent or has any unlawful or fraudulent purpose or effect.

All customers of Facewatch must display appropriate signage as recommended by Facewatch at all times at Properties which use the Services.

Customers are not to upload to the Services any data that contains personal data of any individual under 18 years of age.

Facewatch must be used in a Confidential manner. Customers will not disclose Facewatch Confidential Information during the term of the contract or at any time during the five year period following the end of Term.

OTHER CONSIDERATIONS

Facewatch own the hardware installed into retail premises and provide access to the system and data which Facewatch are sole data controller of.

The customer (retailer) is data controller only of the Subject of Interest information they add to the database (name, reason flags, images of suspected crime or disorder and the statements and information supplied).

Anyone has the right of access to submit a Subject Access Request to Facewatch to obtain confirmation as to whether or not they are processing your personal data. To respond to a Subject Access Request, Facewatch will need to obtain proof of identity.

Facewatch do not record SOI’s nor generate alerts for children under 18 or adults aged over 80 unless by their recorded actions they pose a threat to the safety or others or themselves.

Any questions? Reach out! https://x.com/Alph4betSoup

Read other articles in this ‘I Read The Policies So You Don’t Have To’ series;

If you find my research or other articles useful, entertaining, or insightful, you can buy me a drink or a lil treat to say thanks or simply spoil me bc I am worth it

buymeacoffee.com/alph4betsoup

https://throne.com/alph4betsoup

Consent or Pay: Online Services Disclose The Advertising Value of Their Users

Its Not Nicole — Sat, 12 Sep 2026 11:10:22 GMT

Its becoming more common place for social media sites, streaming services and other web based services to offer its users an option to pay and subscription fee, monthly or annually, to be shown no advertising whilst using the services.

Or, similar to what the online news industry is adopting swiftly, users can pay to reject cookies. Testing in that area however has demonstrated that even where a user subscribes to an online news service to reject cookies, cookies are still embedded on the users device when accessing the services.

Wording on such models is often (mis)leading, it provides the illusion that any user data collected through the users use of the services won’t still be used for advertising reasons, it will, just not on their platform.

Services offering a no-advertising paid subscription model are providing an insight into the advertising value of their users.

At their core they are profit driven businesses offering a range of products and services. They are not offering this service to customers to genuinely do them a favour, its another revenue stream, which to be profitable will need to outweigh slightly what they would on average receive from advertisers.

For the purpose of this consistency in this article, we’ll look at some examples of what it costs to take out an ad free subscription for a 12 months for a range of popular online services.

(pricing correct as of September 2026)

AD FREE EXPERIENCE

Twitter / X : £365.16 per year

Facebook : £47.88 per year

Instagram : £47.88 per year

Snapchat : £53.88 per year

Channel 4 / 4OD : £39.99 per year

YouTube : £155.88 per year

TikTok : £47.88 per year

Disney+ : £99.90 per year

Netflix : £155.88 per year

Hulu : £95.88 per year

The Times : £83.88 per year

The Sun : £59.88 per year

The Guardian : £144 per year

This is a strong indicator of the advertising value of a consumer to each of the services.

They will not be offering this service at a loss.

The UK Information Commissioners Office (ICO) brands this emergence of new approach approach as “consent or pay” models.

The term “consent or pay” in itself can be misleading to consumers, it infers on the average consumer that data may not be collected when a consumer subscribes to to the model, which is not the case.

Data collection still ensues, much of which is shared with various “business partners” including advertisers. Consumers are merely not shown advertisements during the use of the service they have subscribed to.

The ICO states that “the right to the protection of personal data needs to be balanced against other rights, such as the right to conduct a business”.

The recent Royal Assent of the new The Data (Use and Access) Act on the 19th June 2026 has made significant changes to sections of existing data protection laws, namely; legitimate interests, automated decision making, uses for scientific research and data transfers, loosening the reins with much slack granting businesses more rights over personal data, at cost to personal data and privacy rights, widening the power imbalance further and entrenching further challenges for tax paying citizens.

The ICO is presently taking nearly twelve months to allocate a complaint to a case handler, and a further 3–6 months to process any complaint once allocated.

I could have become pregnant, created a whole human and birthed it out in the time it will have taken the ICO to review and respond to a complaint I lodged with them in November 2025, still awaiting a case handler.

Any questions? Reach out! https://x.com/Alph4betSoup

If you find my research or other articles useful, entertaining, or insightful, you can buy me a drink or a lil treat to say thanks or simply spoil me bc I am worth it

buymeacoffee.com/alph4betsoup

https://throne.com/alph4betsoup

I Read The Policies So You Don’t Have To: Oura Ring (Health Tracking Wearable Technology)

Its Not Nicole — Fri, 11 Sep 2026 12:52:23 GMT

Oura rings are wearable tech designed “to track important aspects of your health like your daily habits, reproductive health, and quality of your sleep”.

For a company which generates a lot of revenue and collects the health data of millions of customers, they don’t have many policies or terms available for users to review.

The company claims revenues of $1 billion in 2025 having impressively increased revenue 100% year on year, Oura have sold 5.5 million rings since 2015.

Oura are lining themselves up for IPO where they seeking to raise $3 billion through US markets taking the company valuation to circa $16 billion.

Most of the insights from the data collected through the ring are only available to paid members, with subscription prices starting at $5.99 per month. Oura “anticipates having more than five million subscribers this quarter”.

The policies written by Oura apply to the processing of personal data by Oura Inc, Oura Health Oy, Oura ring Inc, its subsidiaries, when a person visits their website, uses the Oura Ring within the Oura App, Membership Hub or uses other Oura services.

This article consists of a review of Oura’s;

WHAT INFORMATION IS COLLECTED BY OURA

Oura collects the following personal data;

Email address
Residential address address
Gender
Birth date and year
Height
Weight
User ID
Time of visit (to website or app)
Any information the user provides about themself or their account
IP address
Location data (estimated or accurate, settings dependent)
Heart rate
Movement data
Temperature data
Respiration data
Sleep phases (deep, light, REM, awake)
Heigh-level location
Activity levels
Readiness level
Body mass index
Card number, expiration date, security code
Card merchant
Billing address
Network ID
“Wifi data”
Automatically generated tags
Metadata regarding service use
Browsing patterns

As well as any user provided information such as;

Activities
Notes
Photos
Comments
User feedback
Tags
Text submitted to the AI Assistant
Uploaded Electronic Health Records (which may include visit summaries, clinical notes, diagnoses, medications, allergies, immunisations, lab results, vital signs, care plans, etc).

Oura state they may also receive personal data about users from third parties and partners, but do not state what data that is or from whom.

DATA RETENTION

“The retention period for your personal data generally depends on the duration of your Oura account lifecycle”

Personal data is deleted when it is no longer needed for the purpose for which it was originally collected, unless Oura have a legal obligation to retain data for a longer period of time.

WHAT IS DISCLOSED AND WITH WHO

Data is shared with Oura’s AI assistant “Oura Advisor” to support development, testing and improvements to the large language model-powered features.

Where a user integrates Oura with a third party service, data is shared with that third party service.

The Oura Enterprise Platform enables users to share data with their doctor, coach, trainer, employer, researchers and/or any other person or entity after receiving an invitation to do so — information is only shared with the users consent.

Where that consent is provided the recipient of the users health record becomes data controller of that personal data and the data is subject to their policies and terms. Consent to view further ongoing data can be revoked at any time by the user.

Removing consent does not affect the processing of data which has already been extracted, only ceases to share further data.

Oura is a global company with servers based around the world, they state that data may be across servers including at locations outside of the country the user resides.

Data is shared with subprocessors and partners where their service is required to deliver Oura services to the user.

Oura do not state who their subprocessors or partners are.

Where a user engages with the Oura Research App to participate in research studies conducted by or on behalf or Oura or an independent research sponsor, data is shared with the Research sponsor.

TERMS OF SERVICE

Oura state that they are not responsible for the processing of a users personal data by any recipient through the Oura Enterprise Platform which enables data sharing with a users doctor, coach, trainer, employer, researcher or and/or any other person or entity the data is shared with by the user.

By accessing or using the services the user expressly agrees to be bound by all the terms and conditions and privacy policy.

Oura grants to the user a limited licence to access and use the services, subject to the users compliance with the terms.

Users of Oura must be at least 18 years of age.

Users are responsible for ensuring that Oura has accurate and current information within the account.

In the event that the user does not log in or use the services for six (6) months or longer following purchase or receipt of a product, Oura reserve the right to terminate the subscription.

Services are provided to users “as it with all faults” and “as available” without warranty of any kind, but to comply with local jurisdiction laws relating to consumer rights will consider replacement of defective products for between 90 days and 1 year from date of purchase.

Oura rings are not a medical device, users expressly agree that the services provided by Oura do not involve the provision of medical services or advice. The services are not intended to diagnose, treat, track, cure or prevent any disease or medical condition.

The services are for information purposes only.

Oura is not responsible for any health problems that may result from information the user learn through the Services.

COOKIES

Oura do not disclose which cookies and pixels they deploy.

OTHER CONSIDERATIONS

Oura is not a Covered Entity under HIPAA for direct-to-consumer services. When a user directs a HIPAA Covered Entity or Business Associate to share their health records with Oura through patient-directed disclosure or HIPAA Authorisation, the records received by Oura no longer fall under HIPAA whilst in Oura’s possession.

Oura offer special pricing and/or discounts to certain groups including; students, educators, first responders and healthcare professionals, to prove edibility for those discounts, the user is required to undergo ID verification through ID.me — data provided to ID.me during the identity verification process is subject to ID.me’s policies and terms, some of which may be shared with Oura.

Any questions? Reach out! https://x.com/Alph4betSoup

Read other articles in this ‘I Read The Policies So You Don’t Have To’ series;

If you find my research or other articles useful, entertaining, or insightful, you can buy me a drink or a lil treat to say thanks or simply spoil me bc I am worth it

buymeacoffee.com/alph4betsoup

https://throne.com/alph4betsoup

I Read The Policies So You Don’t Have To: LG (Smart TV’s, Apps, Smart Media Products)

Its Not Nicole — Wed, 09 Sep 2026 12:10:25 GMT

LG achieved a turnover of $60.5 billion in 2025. Despite their recent attention in online media following some updates to their Smart TV privacy policies, LG have been selling smart TV’s since 2007, or at least that’s when they first started selling their first internet connected TV’s.

They dominate around 50% of the European market, whilst accounting for an estimated 16–20% of the global market share, meaning around 1 in 5 homes globally with a TV, its likely to be an LG device, and likely to be “smart”.

Over ten million OLED units have been sold in Europe alone.

This article consists of a review of LG’s;

WHAT INFORMATION IS COLLECTED BY LG

The following information may be collected by LG as a result of a persons use of a Smart Media Product (smart TV or similar);

Name
“Basic contact details”
IP address
MAC address
Device ID
Device Name
IMEI
UUID
OS version
Advertising ID (Ad ID)
Device model
Device type
SW version
Manufacturer
Screen resolution
Language
Network & location information (country code, zip or postal code)
“Connected modem information”
“Internet router information”
“Settings of devices”
Ad block information
Information about what features, menu items, apps or services and general activity within apps or functions, content accessed, URLs requested or visited through the device browser
Interactions with LG channels including device information, name of channel or program watched, requests to view content, details of actions taken whilst viewing (play, stop, pause, click etc), duration of content watched, whether the user clicked or dismissed a notification.
Search keywords
Clicking frequency
“We may collect audio, electronic, visual or similar information such as video recordings”

LG also collect information about other devices linked to the Smart Media Product including;

Type of device (set-top box, DVD player, game console, mobile phone etc)
Device details (model number, manufacturer)
Device connection method (HDMI, Wi-Fi, Bluetooth, Network)
How the user uses external devices connected to the Smart Media product including how long it was used, what was access or interacted with

They note that this may include information relating to smart bulbs, smart switches, smart appliances etc which share the same network as the Smart Media Product.

LG state they do not collect information about activity within Third-Party Apps (however the third party apps themselves do).

Use of many of the features requires the user to agree to and additional separate corresponding Additional User Agreement. The user can either agree to the Additional User Agreement, or be locked out from using that feature.

If the user make any payments through the Smart Media Product, that data will also be captured (payment information, billing address, voucher information (if used), purchase history, 3D Secure authentication tokens).

LG state that they may use and combine information collected with other information collected through a users use of other LG services such as LG SmartHome services, ThinQ App, SmartWorld App and SmartWorld website.

LG state they may receive information about users from third parties;

Facebook
Google
Amazon
Line
Marketing companies
Data brokers

VOICE COMMAND SOFTWARE IN LG SMART TV’s

LG state that the microphone is turned off by default and is not enabled unless the user agrees to the Voice Information Agreement, thus will not have access to certain features which require voice commands.

The Voice Information Agreement states the service provider for providing Voice Command Services as being Nuance Communications Inc.

Nuance Communications Inc was acquired by Microsoft Corporation in March 2022 for circa $19.7 billion.

Data collected through Voice Commands is shared with Nuance Communications Inc and becomes subject to their policies and terms.

Nuance Communications converts voice commands into text to access, use and analyse in addition to providing the services (returning search results, providing a recommendation etc).

DATA RETENTION

Voice data collected through the utilisation of the Voice Command features is retained for six (6) months, after that period it is deleted or anonymised. If it is anonymised it is retained indefinitely.

Other data collected is retained for as “long as necessary to protect us from possible legal claims”, advising this to be “for the lifetime of the contract and up to ten (10) years after” following which it will either be deleted or anonymised and retained indefinitely.

WHAT IS DISCLOSED AND WITH WHO

In order to provide LG channels content (including video on-demand services, live digital channels and advertisements) data is shared with the third-party partners who provide the LG channels streaming content and services.

Where a user engages with the “Live Plus” services, LG share the users viewing information and device information with their affiliates, third-party partners and service providers.

Where a user has agreed to the Interest-Based and Cross-Device Advertising Agreement, viewing information may be shared with third parties so they may provide targeted advertising to the user.

Where a user engages with the Voice Commands function, data is shared with LG’s service partner to improve and develop new Smart Media Product functions.

If using the Voice Command functionality within a third-party app, that data becomes subject to the third-party apps terms and policies.

LG may also share information with;

Companies within their corporate umbrella (including corporate parent, subsidiaries and affiliates) or with outside entities
Payment processors
IT service providers
Security partners
Hosting services
Website maintenance support
Data maintenance and analytics partners
Customer service providers
Security and quality assurance vendors
Market research companies
Data analytics providers
Alphonso Inc (provider of the ACR software)
Nuance Communications Inc (Voice Command software provider)
Other business partners
Government authorities, judicial authorities, regulators or similar where required

Being a global organisation, LG state that data may be transferred outside of the country where the user and their Smart Media Product is located.

TERMS OF SERVICE

“If you know this device will be used by more than one person, you represent that you have obtained consent from all others who will use this Smart Media Product..”

Users have the option to opt out of the Arbitration Agreement within 30 days of creating their account, where the user does not opt out following the stated process under subsection 21(k) of the terms they will only be permitted to pursue any disputes or claims through binding arbitration and waive the right to participate in a class action lawsuit, waive the right to pursue disputes in a court of law and waive the right to a jury trial.

Accessing or using the Services is confirmation of acceptance of the Terms of Use and the users agreement to comply with them (including policies).

COOKIES

LG deploy Cookies and Beacons across their apps within Smart Media Products.

They name their third party analytics partners who have cookies embedded in their services as;

Google
Adobe
Meta
Criteo
Salesforce
Microsoft
Mixpanel

These are in addition to the over 50 tracking cookies that LG deploy themselves

OTHER CONSIDERATIONS

LG uses “Automatic Content Recognition” (ACR) to identify the content watched or listened to on a device, regardless of the source of information (e.g. set-top box, gaming console, media player, over the air broadcast or other sources connected to the smart device).

They state “the ACR software identifies content by continuously analysing audio signals it receives directly from the soundboard integrated with the Smart Media Products speakers, it does not receive any information directly from the microphone on the Smart Media Product or remote(s)”.

That said, the Smart Media Products remain to have voice capable remote control enabling the user to control aspects of the Smart Media Product with voice commands. Users must accept the Voice Information Agreement before being able to use that feature.

The likelihood of the average user installing an app on the device which enables it to act as a residential proxy for the grey market is high.

Any questions? Reach out! https://x.com/Alph4betSoup

Read other articles in this ‘I Read The Policies So You Don’t Have To’ series;

If you find my research or other articles useful, entertaining, or insightful, you can buy me a drink or a lil treat to say thanks or simply spoil me bc I am worth it

buymeacoffee.com/alph4betsoup

https://throne.com/alph4betsoup