How the scores work

Every listing is scored from what its own documents say: the privacy policy, the terms, the cookie policy, the subprocessor list. A bot reads them, names the facts it can quote, and the score is arithmetic over the facts that survive a check against the crawled text. Nothing here is an impression.

Why the model never gives a score

The problem with asking a model “how private is this service, 1 to 10” is that it answers. It gives a different answer to the same documents on a different day, and no reader can tell which run they are looking at. So the model is never asked for a number. It is asked which clauses exist, and made to quote each one. Every quote is then checked against the crawled text, and anything that cannot be found is thrown away. The score is arithmetic over what survives, so the same clauses always produce the same number.

• A claim about a service always has a clause behind it, and the clause links to the page it was found on.
• A service cannot argue its way out of a detected change: change detection is a text diff with no model involved.
• Points can change without re-reading anything. Evidence and arithmetic are kept apart.
• A bad model run costs findings, never correctness. The worst case is a service scored on less evidence than it deserved.

Privacy, 0–100

What using the service costs someone who does not want to be identified. The scale is kycnot.me’s, to the point.

50  baseline
  + KYC level                 0..4 → +25, +10, −5, −15, −25
  + Monero accepted           +5
  + onion or I2P address      +5
  + privacy points of every attribute
  clamped to 0–100

Trust, 0–100

How far the listing can be relied on: what the site knows about the service, and what its terms establish.

50  baseline
  + the listing’s standing    verified +10, approved +5, a scam −50
  − recently approved         −10 for the first 15 days
  − terms cannot be read      −3
  ± age                       under a year −4, under three months −10 more, two years or more +5
  + registered company        +2
  + trust points of every attribute
  clamped to 0–100

Overall, 0–10

(privacy × 0.6 + trust × 0.4) / 10, rounded to the nearest whole number as kycnot.me rounds it, with a letter grade from the same blend: A from 85, B from 70, C from 55, D from 40, F below. A service marked as a scam is capped at 3 however the rest adds up.

Confidence

Every scan carries a confidence of low, medium or high, from how many documents were read and how many claims were quotable. It is not a measure of whether the score is right, but of how much document there was to be right about.

Where the attributes come from

The bot reads a service’s terms and names the attributes their clauses establish, quoting each; a quote that is not in the crawled text is thrown away. Moderators assign attributes too, from what a suggestion said or what they know, and both count once. A moderator can also decline a finding until the documents change.

Reviews and suggestions

Anyone can post a review or suggest a service, without an account. Both are held until a moderator has read them. A suggestion becomes a listing only after the bot has read the service’s documents; the level and the scores come from those documents, never from the form.

An account, if you want one, is a login key we generate and you keep: no email, no password, nothing to recover. It lets you post reviews under a name and follow what became of your suggestions. Verified accounts publish reviews without waiting for a moderator. The only cookie this site ever sets is the session of someone who logged in.

The catalog

Every attribute, with what it is worth: kycnot.me’s catalog and kycnot.me’s points. The model never sees these numbers, so it cannot optimise a total instead of reading the document.

Limits

• Readings are machine-generated. They are a starting point, not legal advice.
• A service is scored on what it writes down. A policy can be honest and alarming or dishonest and reassuring, and this reads only the text.
• Documents behind a login, in a PDF, or rendered by JavaScript the crawler cannot get past are not read.
• The point weights are a judgement call, one number each, published above.

The site

This site is HTML and CSS first. Filters, sorting, the menu, the review form and every other part work with JavaScript switched off; a small script, when allowed to run, keeps the address bar in step with the filters and searches as you type. There is no tracker, no account required, and no cookie unless you log in. Fonts are served from here, not from a third party. The full dataset is published as JSON.