Privacy policy

1. The short version

• You can run a basic check without an account. We keep the address you check and its results for 24 hours, then delete them automatically.
• If you create an account, we store the details you give us at sign-up so you can sign in and use your plan.
• Payments are handled by Stripe or Razorpay. We never see or store your card number.
• We don't use advertising or analytics trackers, and we don't sell your information.

2. When you run a check

• The address you enter and the results of the check: scores, issues found, measured values and, for the mobile check, screenshots of the page.
• A private access key for checks run without an account, so only someone with the report link can open it.
• Your IP address, used to apply rate limits to checks, sign-in attempts and the contact form. Rate-limit counters are kept briefly in server memory and aren't linked to your account.
• API tester requests (signed-in users): the endpoint URL, method, status code, response time and any error message, saved with your account. The headers and body you enter are sent to the endpoint but not saved.

To run a check, our servers visit the address you entered. The owner of that website will see those visits in their logs, coming from our servers rather than from you.

3. When you create an account

• Sign-up details: first and last name, username, email address, country and how you plan to use the service. Optionally: company, job title, phone number and website.
• Password: stored only as a salted hash, never in readable form.
• Email codes: the 6-digit codes we send to verify your email and to sign in are stored only as a keyed hash and expire after 10 minutes.
• Preferences: whether you want an email when a report is ready.
• Websites on your account: the domain names you've scanned, used to apply your plan's website limit. This record is kept even after the analyses themselves are deleted.
• Social sign-in: if you choose to sign in with Google, GitHub or LinkedIn, that provider sends us your name, email address and account ID. We never receive your password for those services.

4. When you pay for a plan

You enter your card or bank details directly with Stripe or Razorpay, on their pages or in their checkout window. We store your plan, its status and renewal date, the customer and subscription IDs the payment provider gives us, payment references, amounts and currency. We don't receive or store card numbers.

5. When you contact us

The contact form sends your name, email address, subject and message to our team inbox by email, so we can reply. We don't keep contact messages in our database.

6. What we store in your browser

We don't use advertising or analytics cookies. The site stores a few things in your browser's local storage so it works:

• rwa_access and rwa_refresh: your sign-in tokens, when you're signed in (the access token lasts 30 minutes, the refresh token 7 days). Signing out removes them.
• rwa_last_active: when you were last active, used to sign you out after inactivity.
• rwa_free_checks: up to 20 checks you ran in this browser without an account (the address, report number and access key), so you can reopen them and move them into an account later.
• theme: whether you chose the light or dark theme.
• Short-lived session storage: the page to return to after signing in, and flags that stop one-time messages repeating.

If you switch languages, a cookie may remember your choice. You can clear all of this at any time in your browser settings.

7. How we use information

• To run checks and show you the reports.
• To create and secure your account and sign you in.
• To send emails you need: verification and sign-in codes, password resets, “report ready” notifications and replies to your messages.
• To process subscriptions and apply your plan's limits.
• To apply rate limits, prevent abuse and keep the service running.

We don't sell your information, use it for advertising or share it with data brokers.

8. AI-written recommendations

When it's switched on, we send the scanned address, the category scores and the issues found to Anthropic's Claude API, which rewrites them into a short list of next steps. We don't send your name, email or other account details. When AI isn't used, reports use a templated summary instead. Our methodology explains how this works.

9. Who we share information with

We use a small number of service providers, who process information on our behalf only to provide their service:

• Hosting and database: Vercel (this website and parts of the backend), Render (the scanning backend) and Supabase (the database).
• Email: Mailgun, to send emails.
• Payments: Stripe and Razorpay.
• AI recommendations: Anthropic, when AI recommendations are switched on.
• Social sign-in: Google, GitHub or LinkedIn, only if you choose to sign in with them.

We may also disclose information if the law requires it, or to protect the service and its users from abuse. These providers may process information in countries other than yours.

10. How long we keep information

• Analyses — scans, site scans and layout tests, with their results, reports and screenshots: deleted automatically 24 hours after their last activity. Download the PDF if you want to keep a report.
• Account details, API test results and the websites on your account: kept while your account exists.
• Payment records: kept as long as we need them for accounting and legal obligations.
• Email codes: expire after 10 minutes.

11. Security

The site is served over HTTPS, passwords and email codes are stored only as hashes, and payment notifications are signature-checked. No system is perfectly secure, so please use a strong, unique password — and sign out on shared computers, because sign-in tokens are kept in the browser.

12. Your choices and rights

• You can view and correct most of your profile, and turn report emails off, in Settings.
• You can ask us for a copy of your information, or to delete your account and its data, by emailing rudratechnopvtltd@gmail.com.
• You can use the free checks without creating an account at all.

Depending on where you live, data-protection law may give you further rights, such as objecting to certain uses or complaining to a regulator. Contact us and we'll help.

13. Children

The service is meant for people who run or work on websites. It isn't aimed at children, and we don't knowingly collect information from them.

14. Changes to this policy

If we change how we handle information, we'll update this page and the date at the top. For significant changes affecting account holders, we'll also let you know by email.

15. Contact

Questions or requests about your information: rudratechnopvtltd@gmail.com, or use our contact form.