Privacy policy

This policy explains what CitableReport collects, why, and what we do with it. In short: to scan a site we need only its address; we learn your email address only if you buy a report; and we never see your card details. CitableReport is run by Deliberate Pty Ltd, Australia ("we").

What do we collect when you scan a site?

• The website address you enter, and any topic words you add.
• What we find on that site: measurements and short quotes from its public pages, used as evidence in the report. We do not keep copies of the pages.
• A scrambled form of your IP address, used only to limit free scans to 3 a day. It is a one-way code; we cannot turn it back into your address.
• One cookie of our own, which protects our forms from being submitted by other sites. It holds a random number, not anything about you, and is removed when you close your browser.

What do we collect when you buy a report?

• Your email address, which Stripe passes to us so we can send your report link.
• A record of the purchase: the amount, the date and Stripe's reference for it.

Payment is taken by Stripe on Stripe's own pages. Your card details go to Stripe and never reach us.

What do we use it for?

We use what we collect to make your report, to send you the link to it, to answer you if you write to us, to keep the service from being abused, and to keep the records the law requires of a business. We do not sell it, and we do not use it for advertising.

What emails will you get?

If you buy a report you will get the link to it, the link to your post-fix report when you run one, and one reminder before your post-fix report runs out. These are part of what you bought. We do not send marketing email.

Who else handles your information?

• Stripe takes payments.
• Resend delivers our emails.
• Our hosting provider runs the server the site is on.
• Google Analytics counts visits to our public pages, using its own cookies. It is not loaded on report pages.

To make a report we also look the scanned domain up with public services: the domain registry (for its age), the Internet Archive, Open PageRank and Wikidata. They receive the domain name only, nothing about you.

How long do we keep it?

• Free scans that are not unlocked are deleted after 30 days.
• Reports you have bought, and the purchase record, are kept so your link keeps working, until you ask us to delete them. Purchase records may be kept longer where tax law requires.
• Server logs are kept for a short period to diagnose faults.

Who can see a report?

A report lives at a long, unguessable address. Anyone you give that address to can see the report, which is how you share it with a colleague or developer. We do not list reports publicly, and search engines are told not to index them.

What are your choices?

You can ask us what we hold about you, ask us to correct it, or ask us to delete your reports and email address, by writing to team@citablereport.com. If you are unhappy with how we have handled your information you can also complain to the Office of the Australian Information Commissioner, or to your local data protection authority.

What if a site of mine was scanned by someone else?

Anyone can ask for a report on any public website, as anyone can visit it. We read only public pages. If you would rather we did not, you can block our crawler: see about CitableReportBot.

Will this policy change?

If we change this policy we will change the date at the top. If a change affects information we already hold about you in a way that matters, we will email buyers first.