Privacy policy

Last updated October 11, 2026.

What we collect

We don't ask for accounts, names or email addresses. Our server keeps standard access logs (IP address, browser type, page requested, time) for security and troubleshooting, and deletes them after 30 days.

Provider searches

When you search for a provider, the search is sent to our server in the body of a request and forwarded to the public CMS NPI Registry, and the reply comes back to you. We don't save searches. We keep results in memory for ten minutes so repeated searches don't hit CMS again. The search text isn't part of the page address, so it doesn't appear in the access logs. Pages for a specific record (the "link to this record" button) do contain the NPI in the address, and the NPI is public information.

Tax ID (EIN) searches

An EIN you enter is sent in the body of a request, checked against the public IRS list of tax-exempt organizations, and used to search the NPI registry. We don't save it and it doesn't appear in the access logs. If you type something that looks like a Social Security number, we reject it without searching.

Advertising and cookies

We use Google AdSense to show ads. Google and its partners use cookies to serve ads based on your visits to this and other websites. You can turn off personalized advertising in Google's Ad Settings, and learn more at How Google uses information from sites that use its services. Visitors in the EEA, UK and some US states see a consent choice before any personalized ads.

Contact

Questions about this policy: hello@tidylookup.com.