Privacy policy

The privacy of your data, and it is your data, not ours, matters to us. This policy lays out what we collect and why, how it is handled, and your rights. We never sell your data: never have, never will.

This policy applies to curbcuthq.com and everything it offers (the "Services") and to the people who use them: visitors, people who run a free scan, customers and account holders. The Services are operated by Braedan Campbell, trading as Curbcut, in San Rafael, California, United States. Where UK or EU data protection law applies, he is the data controller. Contact: privacy@curbcuthq.com.

What we collect and why

Our guiding principle is to collect only what we need. Here is what that means in practice.

The website address you submit

We fetch that page and other pages on the same domain, render them in a browser, and analyse what we find. For a free scan the results are shown to you and not stored afterwards. To open your home page in a real browser, the address is placed in a queue on our worker server for the few seconds that takes; the rendered result (a photograph of the top of the page and what the browser measured) is deleted the moment it has been shown to you, and in any case within an hour. For a paid report or a monitored site we keep the results, so that we can build your report, compare later scans against earlier ones, and show the history on your account page. Legal basis: legitimate interest for the free scan, since you asked for it and we cannot run it without the address; performance of a contract for anything you have paid for.

Content from the site being audited

While a paid report is being built, page text, images and screenshots from the site are held on our worker server and, for the written fixes, sent to Anthropic, whose model drafts alternative text, titles and similar. Screenshots of the problems we found are included in your report. Free scans never send anything to a model. We do not log in to the sites you scan and cannot see anything on them that a member of the public could not.

Identity and access

When you open an account we ask only for your email address. By default there is no password: we email you a one-time sign-in link, and a cookie keeps you signed in on that browser afterwards. You may optionally set a password to sign in without waiting for an email. If you do, we store a scrypt hash of it and never the password itself, so it cannot be read back by us or by anyone who obtained a copy of the database; you can remove it at any time from your account page, and the emailed link keeps working either way. We use the address to deliver what you bought, to tell you when monitoring finds something, to send the occasional message about Curbcut, and to tell you when these policies change. We will never sell your email address, and we will not use your name or company in marketing without your permission. If you leave your email to hear about a report without buying, we keep it for that purpose only; reply to any message to stop them.

Billing information

When you buy something you pay through Stripe, our payment provider and the merchant of record for the transaction. Your card details go directly to Stripe and never reach our servers. We keep a record of the order: your email address, what you bought, the amount, the site it relates to, and Stripe's identifiers for the payment, so that we can deliver it, show it on your account page, handle refunds and meet tax rules. Legal basis: performance of a contract, and a legal obligation for the tax records.

Monitoring settings

If you monitor a site, you can give us a Slack webhook to post alerts to and up to five competitor sites to compare against. We store them for that purpose only.

Request logs and rate limiting

Our hosts record ordinary request metadata, including IP addresses. We use IP addresses to enforce the rate limits that stop the scanner being used to attack other people's websites. Legal basis: legitimate interest in keeping the service secure and available.

A count of scans, by referring site

Separately from the analytics below, we keep our own tally of how the service is used: for each day, how many scans ran, how many reached checkout, how many were paid for, and which site referred the visitor (for example "reddit", "google" or "direct"). Each entry is a date, an event name, a referrer name and a number.

It holds no website address, no IP address, no email address, no session or visitor identifier and no device information. There is no way to trace an entry back to a person or to a site anyone scanned, by us or by anyone who obtained the database. Legal basis: legitimate interest in knowing which channels bring people who find Curbcut useful, which cannot be answered without counting.

Website analytics

We use Vercel Web Analytics, which is cookieless. It sets no cookies and uses no persistent identifier; visitors are counted using a hash derived from the request that is discarded after 24 hours. For each page view it records the time, the page URL and referrer, approximate location (country, region, city), and device, browser and operating system type. It cannot follow you to other websites and we cannot use it to identify you. Legal basis: legitimate interest in knowing whether the service is used and working.

Cookies

The only cookie we set is the session cookie that keeps you signed in after you use a sign-in link. We set no advertising or tracking cookies, and we do not build a profile of you or follow you across other websites.

Voluntary correspondence

When you email us with a question or for help, we keep that correspondence, including your email address, so that we have a history to refer to if you get in touch again.

When we access or disclose your information

To provide what you asked for. We use a small number of providers, each only where it is needed to run the Services:

• Vercel (United States): hosting for this website, request logs and the analytics described above.
• Hetzner (Finland, European Union): the server that crawls sites, renders pages and builds paid reports. It holds a site's content only while a job runs.
• Neon (United States): the database that stores email addresses, order records and monitoring results.
• Stripe: payment processing, as merchant of record. Stripe's own privacy notice applies to the payment.
• Resend: sends our email: sign-in links, order confirmations, monitoring alerts and notices about these policies.
• Anthropic (United States): generates the written fixes in a paid report, as described above.

We will update this list when it changes.

At your direction. If you give us a Slack webhook, we post alerts to it. If you email a report to someone from your account page, we send it to them.

With your permission, to help with support. If we need to look at your account or a report to help with a support request, we will ask first. No human looks at your data otherwise, except in the rare case where an automated process fails part-way and needs a person to fix it. When that happens we look at the minimum needed and fix the root cause.

To investigate restricted uses. If we have evidence that an account is being used for something our Use Restrictions policy forbids, such as scanning sites it has no permission to scan, we may look at what the account did and, where warranted, notify the site owner or the authorities.

Aggregated data. We may use aggregated, de-identified figures, such as how many sites fail a particular check, for any purpose, including writing about the state of web accessibility. None of it identifies you or your site.

When the law requires it. Curbcut is operated in the United States. We do not respond to government requests for user data unless compelled by legal process, and then we disclose only what the order requires. Where we are allowed to, we will tell you before we do.

If Curbcut is ever acquired by or merged into another company, we will tell you well before any of your personal information is transferred or becomes subject to a different policy.

Your rights

We aim to apply the same rights to everyone, wherever you live. You have the right to know what personal information we hold about you and why; to get a copy of it; to have it corrected; to have it deleted; to restrict or object to how we use it, including for direct marketing; to receive it in a portable form; and to withdraw consent at any time where consent is the basis we rely on. We do not make automated decisions that have legal or similarly significant effects on you, and we will never treat you differently for exercising any of these rights.

To exercise them, email privacy@curbcuthq.com. We will verify the request by replying to the address we hold and act on it within one month (45 days if you are exercising rights under California law). Some records are exempt: we have to keep order records for tax law, for example. Deleting your data may mean closing your account.

You also have the right to complain to a data protection authority: in the UK the Information Commissioner's Office at ico.org.uk, in the EU your national authority, and in California the Attorney General. We would rather you raised it with us first, but you do not have to.

If you are in California

Under the California Consumer Privacy Act, the categories of personal information we collect are those listed above, collected for the purposes and kept for the periods stated here. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We never have. There is nothing to opt out of, but if that ever changes we will say so here first and offer the opt-out before it takes effect. We do not collect sensitive personal information as the Act defines it.

How we secure your data

Everything is encrypted in transit between your browser and our servers, and between our servers and our providers. Sign-in links work once and expire after 30 minutes. Report files are stored at unguessable addresses and downloaded through your account, which checks that they are yours. Card details never reach us.

How long we keep it

• Free scan results: not kept. They exist only for the duration of the request.
• Paid reports and monitoring results: for as long as your account exists, so that you can come back to them, or until you ask us to delete them.
• Site content held while building a report: not kept once the job finishes.
• Email addresses: until you ask us to remove yours, or after two years with no interaction, whichever comes first.
• Order records: seven years, because tax law requires it.
• Request logs: for as long as our hosts retain them, currently no more than 30 days.
• Analytics: aggregate figures only; the visitor hash is discarded after 24 hours.
• Scan counts: kept indefinitely. They are counts by day and referring site, and identify nobody.

When you ask us to close your account, we delete your reports, results and email address within 30 days, keeping only the order records that tax rules require.

Where your data goes

Curbcut is operated from the United States. This website and our database are hosted in the United States; the server that crawls sites, renders pages and builds reports is in Finland, in the European Union. If you are in the UK or the European Economic Area, using Curbcut therefore involves transferring your personal data to the United States. Where that happens, it is done under the safeguards our providers have in place, such as the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or the EU-US Data Privacy Framework.

Children

Curbcut is not intended for children, and you must be 18 or over to buy anything from us. We do not knowingly collect information from anyone under 16. If you believe we have, tell us and we will delete it.

Changes and questions

We may update this policy to reflect new practices or new law. When we do, we refresh the date at the top. If a change is significant and we hold your email address, we will tell you directly before it takes effect. Questions about this policy or your data: privacy@curbcuthq.com.

Adapted from the Basecamp open-source policies, used under CC BY 4.0.