Privacy Policy
Last updated 2026-09-13
This explains what we collect and why. It also explains what we have deliberately built ourselves not to collect, which is usually the more useful half.
The short version
We collect what the product needs to work and little else. We do not sell your data, we do not run advertising trackers, and our analytics cannot record who you are.
What we collect
- Account details: your email address and the name you give us. Your password is hashed by our authentication provider; we never see it.
- Audit data: the website addresses you analyse, the findings, scores and reports we generate, and which of your websites they belong to.
- Billing data: your subscription status, plan, renewal dates and the identifiers our payment provider gives us. We never receive or store your card number.
- Usage counters: how many audits you have run today, so we can apply plan limits.
- Product analytics: events such as "an audit started" or "a subscription was cancelled", with a plan name, a domain and a score band.
What we deliberately do not collect
Our analytics is built so that it cannot carry personal data: the fields it accepts have no place to put an email address, a name, an IP address, a browser user agent or a full page URL.
- No advertising or cross-site tracking cookies.
- No raw IP addresses. To enforce the free daily limit for visitors without an account we store a salted one-way hash of the address, which lets us count repeat requests without being able to recover the address.
- No exact audit durations in analytics — they are bucketed, so a single audit cannot be picked out.
- No card details, ever. Those go directly to Razorpay.
Why we are allowed to hold it
- To provide the service you asked for — running audits, storing your reports, applying your plan.
- To take payment and keep an accurate record of your subscription.
- To keep the service working and to prevent abuse, such as someone scripting thousands of audits.
- To improve the product, using aggregate analytics that do not identify anyone.
Who else sees it
We use a small number of providers, each for a specific job. We do not sell or rent your data to anyone.
- Supabase — database, authentication and storage.
- Vercel — hosting and content delivery.
- Razorpay — payment and subscription processing.
- Google PageSpeed Insights — receives the public URL you asked us to analyse, in order to measure its performance.
- Google Gemini — receives a compact, structured summary of findings we have already computed, so it can write recommendations. It never receives your account details, and we never send it an entire website.
Audits of other people’s websites
You can analyse any public website. We only read pages that are already publicly available, exactly as a search engine or any visitor would. Our crawler identifies itself, so it may appear in that site’s server logs like any other bot.
If you run an audit without an account, the result is reachable by anyone who has the audit link. The link contains a random identifier that cannot be guessed or listed, but treat it as you would any unlisted URL.
How long we keep it
- Audits and reports: until you delete them or close your account.
- Account data: until you close your account.
- Billing records: as long as tax and accounting rules require, even after an account closes.
- Daily usage counters: they are per day and are not used for anything else.
Your choices
Email josekmani60@gmail.com to request a copy of your data, correct something, or delete your account. We will respond within two working days.
Deleting your account removes your profile, websites, audits and reports. Billing records we are legally required to keep are retained.
Security
Access to your data is enforced at the database level, not only in the application: rows are readable only by the account that owns them. Secrets are held server-side and never reach your browser. Payment status is decided by verified signed messages from our payment provider, never by anything the browser claims.
No system is perfectly secure. If a breach ever affects your data, we will tell you.
Children
This is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
Changes
If this policy changes, the date at the top of the page changes with it. Material changes will be communicated before they take effect.
Questions about this page?
Email josekmani60@gmail.com and we will reply within two working days.