Privacy Policy

The short version

What we collect

• Account details: your email address and the name you give us. Your password is hashed by our authentication provider; we never see it.
• Audit data: the website addresses you analyse, the findings, scores and reports we generate, and which of your websites they belong to.
• Billing data: your subscription status, plan, renewal dates and the identifiers our payment provider gives us. We never receive or store your card number.
• Usage counters: how many audits you have run today, so we can apply plan limits.
• Product analytics: events such as "an audit started" or "a subscription was cancelled", with a plan name, a domain and a score band.
• Product usage recordings: how pages are used — clicks, scrolling, where a cursor moves and where people get stuck — recorded through Microsoft Clarity so we can see which parts of the site do not work and fix them. Text you type is masked before it leaves your browser, and the pages that show account details are masked in full.

What we deliberately do not collect

• No advertising or cross-site tracking cookies. Our usage recordings use first-party analytics cookies to tell one visit from the next; they are not used for advertising and we do not run ads.
• No keystroke capture. Session recordings mask what you type — passwords, email addresses and every other form field — so a recording cannot show us your credentials or your message.
• No raw IP addresses. Where we need to slow down scripted abuse we store a salted one-way hash of the address, which lets us count repeat requests without being able to recover the address.
• No exact audit durations in analytics — they are bucketed, so a single audit cannot be picked out.
• No card details, ever. Those go directly to Razorpay.

Why we are allowed to hold it

• To provide the service you asked for — running audits, storing your reports, applying your plan.
• To take payment and keep an accurate record of your subscription.
• To keep the service working and to prevent abuse, such as someone scripting thousands of audits.
• To improve the product, using aggregate analytics that do not identify anyone.

Who else sees it

• Supabase — database, authentication and storage.
• Vercel — hosting and content delivery.
• Microsoft Clarity — session recordings and heatmaps, so we can see how the site is used and improve it. Receives masked page interactions, not your account details.
• Razorpay — payment and subscription processing.
• Google PageSpeed Insights — receives the public URL you asked us to analyse, in order to measure its performance.
• Google Gemini — receives a compact, structured summary of findings we have already computed, so it can write recommendations. It never receives your account details, and we never send it an entire website.

Audits of other people’s websites

How long we keep it

• Audits and reports: until you delete them or close your account.
• Account data: until you close your account.
• Billing records: as long as tax and accounting rules require, even after an account closes.
• Usage counters: used only to apply plan limits, and for nothing else.

Your choices

Security

Children

Changes