Privacy Policy

The short version

You give us an email and your monitored URLs. We store run evidence so you can see what your customers would see, and we delete that evidence automatically after 30 days. There are no tracking cookies and no ads. You can export or erase everything yourself, right now, from Settings — no ticket required.

What we collect

• Account: email, optional name, and a password stored only as a bcrypt hash.
• Monitoring configuration: project names, the base URLs you point us at, and the flow steps you build (pages, selectors, credentials you choose to store for logins).
• Run results: status, duration, logs, and evidence — screenshots, video, and console/network captures of the pages your flows visit. Logs can contain text from pages behind your logins, so treat them as confidential; they are visible only inside your account.
• Billing: plan state and Stripe customer identifiers. Card data never touches our servers — Stripe handles it.
• Cookieless landing analytics: when an outreach campaign sends someone to this site, we store the campaign parameters and a truncated user-agent. No cookies, no cross-site identifiers, no session linkage, no profiles.

What we never do

• No advertising or third-party tracking cookies.
• No selling of data, and no training AI models on your data.
• No reading the evidence or run logs of one account from another account — tenancy is enforced server-side and covered by dedicated tests.

How your data is processed

To produce the plain-English failure report, the technical details of a failed run are sent to an AI provider (OpenAI, gpt-4o-mini) and discarded after the report is generated. If the AI provider is unavailable, your alert still ships — with a fixed template summary instead, so a provider outage never delays the notification.

We run on a deliberately short list of infrastructure providers: a hosting provider for the app, database, and evidence volume; Stripe for payments; an email provider for transactional email (alerts, receipts, onboarding); an error-tracking service for crash reports; and GitHub, whose CI deploys via narrowly-scoped deploy keys. Each one processes only what its job requires.

Retention

• Evidence media (screenshots and videos) is deleted automatically 30 days after capture — the sweep deletes the files and the database rows in the same pass, and that guarantee has an automated proof that runs against a live stack.
• Run logs stay with the run until you delete the flow's project or your account — they are part of the history you are paying to see.
• Account deletion removes your data from the active database immediately (cascading delete) and deletes stored evidence files one-by-one. If you have a Stripe subscription, cancellation happens as part of the same flow — data protection comes before billing.

Your rights — self-service, today

In Settings → Data & account you can:

• Export: download everything associated with your account as JSON (your password hash is excluded), rate-limited per hour to protect the service.
• Delete: erase your account and all associated data by typing your email exactly — the flow cancels an active Stripe subscription, cascades the delete, and removes stored artifacts. Automated end-to-end tests cover both actions, including verifying nothing is left behind.

For anything else — correction, questions about processing, complaints — email founder@getsitecheckin.com. You also have the rights your local consumer/data-protection law gives you; nothing here asks you to give them up.

Cookies

Exactly one kind: the httpOnly session cookie that keeps you logged in. No analytics cookies, no consent banners because there is nothing to consent to beyond the session itself.

Changes to this policy

Material changes are announced on this page before they take effect, and by email to account owners when the change affects how personal data is handled. New purposes for existing data get a fresh legal basis or fresh consent — not a quiet edit.

Contact

SiteCheckIn is operated by Everton S. Andrade. Questions, requests, and complaints: founder@getsitecheckin.com.