Privacy policy
Last updated 12 October 2026.
We collect what the product needs and nothing else.
Grades
When you grade a URL we store the URL, the host, the time, the stack we detected, and for each check a status and one short line of evidence. Credential-shaped strings are redacted at the source. We do not store page bodies, bundles or responses. We keep the IP address that requested an anonymous grade for 24 hours to enforce the daily limit, then discard it. Anonymous grades are deleted after thirty days.
Purchases
Your email, what you bought, the amount, and Stripe identifiers. Card details never reach us; Stripe holds them.
Library
Sign-in codes, stored hashed and expiring in 15 minutes, a session cookie, and a log of which files you downloaded.
Lists and reports
When you ask for a report, the free checklist or a place on the monitor list: your email, when you asked, which page you asked from, the grade id if there was one, which emails were sent, and the campaign parameters on the link you arrived from. Every marketing email has a one-click unsubscribe. Transactional emails (receipts, sign-in codes, delivery, alerts) are sent only when you trigger them.
Analytics
If enabled, Google Analytics 4 with IP anonymisation, used to count visits and conversions. No advertising identifiers. This page sets no analytics cookie unless you consent.
Where it lives
Email is sent through Resend. Data is stored with Supabase (Postgres, US region) and the site runs on Vercel. We do not sell or share your data with anyone else.
Your data
To see or delete what we hold, email kenny@hyder.me from the address in question. To remove a grade of a site you own, verify ownership or email the same address with the grade link.