Privacy policy

Information you give us

We collect your email when you join the waitlist. Contact messages also include your name and message. Free-website applications include your contact details, store or social link, what you sell, your store's stage and any explanation you provide.

If you request an audit, we process the store URL, public storefront information and any questionnaire answers you provide, including business goals, traffic or revenue ranges. We store the resulting report. If you ask for an emailed report or join from one, we can associate your email with that store and report. Reports have shareable links and can be viewed by people who have the link; a recent report may also be offered to someone who submits the same store URL.

How we use it

We use your information to hold your place on the waitlist and send beta updates, answer messages, review applications and deliver audit reports. Contacting us or applying for a website does not by itself subscribe you to marketing emails.

We also measure which pages and campaigns lead to useful actions, improve the site and protect forms against abuse. Technical information can include your browser, device, IP address, approximate location and request details. Our form security logs use a hashed IP address; hosting and security providers may process the IP address itself.

Analytics and session recordings

Vercel Analytics and Speed Insights measure site usage and loading performance. When enabled, PostHog collects pageviews and interactions such as clicks, scrolling, form outcomes and progress through the audit. Events can include page URLs and their query parameters, referring pages, campaign tags, timestamps, device details and browser identifiers that connect visits. This lets us understand journeys and where visitors stop, rather than only count totals.

PostHog can also provide heatmaps and session replay. Replays reconstruct activity within our website, including page content, clicks and scrolling; they do not record your camera, microphone or activity in other apps. We configure replay to mask form inputs and page text marked as private. Other visible page content and URLs may still appear in analytics or replays.

Our custom analytics events do not intentionally include names, email addresses or message text, and we do not use submitted emails to identify visitors in PostHog. Browser identifiers can still distinguish returning visitors, so this measurement is not limited to anonymous aggregate counts. We do not use advertising pixels for retargeting or sell personal information.

Cookies and browser storage

PostHog can use cookies and local storage to recognize a browser and connect activity across visits. We also remember referral and campaign information in local storage and attach it to form submissions so we know how people found us. When page experiments run, our own cookies keep a visitor in the same version and help measure its results. Session storage supports this measurement and other site interactions.

You can block or clear cookies and site storage using your browser settings. Clearing storage resets remembered information; it does not delete records already sent to us, and a later visit can create new identifiers. Our PostHog integration is configured to respect the browser's Do Not Track setting. That setting does not disable all other site measurement or essential security processing.

Services that process information

We use Vercel for hosting, logs, usage measurement and performance monitoring, and PostHog for behavioral analytics and session replay when enabled. Loops stores waitlist and contact-form records and supports email updates. Resend delivers service emails, including contact confirmations and audit reports. Our Melbora CRM can also hold submissions and their referral information, with database storage provided by Neon.

Cloudflare Turnstile helps check form submissions for abuse. Store audits can send public store addresses to Google's PageSpeed Insights and Chrome UX Report services. Audit findings and selected store context or questionnaire answers can be sent through OpenRouter to the model provider used to prepare the report's wording.

These providers process information to support the functions described here. Their processing locations can include countries outside your own. The applicable provider settings and terms govern their storage and processing; choosing a region for one provider does not determine where every service processes data.

Retention and your choices

Retention varies by record type and provider settings. Contact records, messages, applications and audit records can remain after a visit ends. Analytics events, recordings, security logs and backups may have different retention periods.

You can unsubscribe from marketing emails using their unsubscribe link. Unsubscribing stops those emails; it does not automatically delete your contact record, messages or audit records. You can separately request deletion by contacting us below. Some information may need to remain for security, legal obligations or to honor your unsubscribe choice.

Depending on where you live, you may have rights to access, correct, delete or obtain a copy of your personal information, restrict or object to processing, or withdraw consent where processing relies on it. Contact us to make a request. We may need to verify it, and information tied only to a browser identifier may be difficult to locate using an email address alone. You may also have the right to complain to your local data protection authority.

Contact and changes

For privacy questions or requests, email us using the address below. Include enough information to help us find the relevant record, such as the email you used or an audit link, but do not send passwords or payment details.

We will post updates to this policy here and change the date above when our practices change.