Privacy Policy

The short version, before the detail.

What we collect

• Your email address — the one you use to buy, the one you want alerts sent to, and the one you sign in with (they can all be different).
• The web addresses you ask us to scan or watch.
• The results of our checks on those websites: whether the site responded, certificate and domain expiry dates, DNS records, broken links, response times.
• A small set of product events (for example “a scan finished”) tied to a random id that lasts for one browsing session.
• Which version of a page we showed you. We run split tests of our own wording, and your assignment is kept in a cookie on your device for 90 days and attached to those product events.
• Visit measurement through several analytics services, including PostHog and Google Analytics, under random visitor ids that carry no name or email. Section 6 lists exactly what they set, and has a switch that turns them off.
• If you have an account: your sign-in sessions. There is no password to collect — signing in is a one-time link we email you.
• When you buy protection: that you ticked the box agreeing to our Terms and to this policy — the time, and which version of each document it was.
• If you install our WordPress plugin: facts about that installation — the WordPress, PHP and plugin versions, the theme, and the contact forms it found.
• Technical records of scan requests, including the IP address they came from, so we can stop abuse of the free scanner.
• Anything you write to us for support.

What we never collect

• Nothing about your website’s visitors. We look at your site from the outside, like any visitor. We never receive your visitor logs or analytics.
• No card or payment details. Ever. Lemon Squeezy takes the payment; those details never touch our servers.
• No retargeting pixels and no cross-site ad tracking. The two measurement services above count visits and campaigns for us; they are listed in section 6 with an off switch, and neither receives your email address.
• No logins for your website. We never ask for your hosting, CMS, FTP or email passwords, and would refuse them if offered.

We also do not sell your personal information, and we do not share it for advertising.

SiteQuiet is operated by ShabSand. For data-protection law, ShabSand is the controller of the personal data described in this policy — meaning we decide why and how it is used, and we are the ones you can hold to this document.

This policy covers the SiteQuiet website, the free scanner, your SiteQuiet account, paid website protection, and our WordPress plugin.

Your email addresses

Your account email, which you enter before checkout, identifies your subscription, receives service messages, and is the address you sign in with. Your alert email is where monitoring alerts go — it can be a different address, such as the person who looks after your website.

The websites you ask us to check

Every address you enter, in a form we tidy up so that “www.Example.com/” and “example.com” are treated as one website. For a paid subscription we store which website occupies each of your protected-website slots.

What our checks observe

When we check a website we keep the results, not a copy of the site. In practice that means: whether it responded and with what status, the final address after redirects, response and connection timings, SSL certificate facts (issuer, validity dates), DNS records, the domain’s registration expiry date, and any dead links found — recorded as the link address, the page it was found on and its link text. When protection is active we also keep the history of these observations and any incidents they led to.

Your account and how you sign in

There is no password, so there is no password to store. When you ask for a sign-in link we record the email address you asked for it with, a one-way hash of the link itself (the usable link exists only inside the email, so a copy of our database cannot sign anyone in), when it expires, whether it has been used, and a short one-way hash of the IP address the request came from.

When you use the link we create a session record: your account id and email, when the session started, when it was last seen, when it expires, and the first 200 characters of the identification string your browser sends. Your browser holds only an opaque reference to that record — see section 6.

Your agreement to our terms

The checkout form has a box confirming you agree to the Terms of Service and to this policy. It is never ticked for you. When you tick it and continue, we record your email address, the time, the version of each document that was in force (their “Last updated” dates), which form it was, and the reference number of the purchase you were making. That record is our evidence of the agreement — including that you agreed to a subscription that renews until you cancel it — and section 8 says how long it lasts.

Product events

We record a small, fixed list of first-party product events — for example “landing page viewed”, “scan finished”, “checkout started”. Each event carries its name, a timestamp, a random session id that lives only for the current browser session, the version of the page you were shown (below), and a little context such as the website address scanned, the health score, or the plan chosen. No email address is ever sent to this collector. Only names on our fixed list are accepted; anything else is discarded. Your IP address is used to limit how often the collector can be called and is not written down with the event.

Which version of a page you were shown

We test our own wording, and we assign every visitor to one version on their first visit to a public page. That assignment is a short list of names, such as “hero:a|cta:scan|pricing_default:annual”. It is stored in a cookie on your device for 90 days, it is attached to every product event above, and it is saved with a purchase you start. That is what lets us tell whether a change actually helped rather than guessing. It says nothing about you. Section 6 describes the cookie itself.

Visit measurement (analytics services)

Alongside our own product events, we collect analytics data through several measurement services — among them PostHog for product analytics and Google Analytics for visitor counts and campaign attribution, plus an analytics service of our own that matches visits to purchases. Each works under a random visitor id and receives pages visited and actions taken — never your email address. Section 6 lists exactly what they store on your device, what each receives, and the switch that turns them off.

Scan telemetry (abuse prevention)

Separately from product events, the free scanner keeps an operational log of its own decisions — “scan requested”, “rate limited”, “served from cache”, “scan finished”. Every entry carries a timestamp and the name of what happened.

Beyond that, entries differ. “Scan requested”, “rate limited” and a failed human-verification step record the IP address the request came from — plus, for a failed human-verification step, a short note of why it failed — and nothing about the website. The entries about the scan itself record the website address, or for a per-domain limit only its domain, and no IP address; a scan that goes wrong also records a short technical note about the failure. Entries such as “too busy right now” record neither. No single entry holds both an IP address and a website address — but they are written to one time-ordered log, so we will not pretend the two could never be connected.

We keep this for one reason: the free scanner is an obvious target for abuse, and without it we cannot tell a customer from an attacker.

Proving that you control a website

Before we do anything to a website beyond reading it, you prove you control it. We generate a random token for you to publish — as a DNS record, a file, a meta tag, or via our WordPress plugin — and we record that token, when it expires, how many times we have looked for it, which method finally worked and when, and, if a check did not succeed, a plain-English note of why.

If you install our WordPress plugin

The plugin is optional and you install it yourself. When it connects, it sends us your website address, its WordPress and plugin versions, the connect code you pasted in, and the WordPress administrator email address — which our connect endpoint does not save.

After that it checks in periodically, and each check-in carries: your website address, the plugin, WordPress and PHP versions, the active theme, whether the install is a multisite, the address alerts should go to, whether you have switched contact-form testing on, and a list of the contact forms it found — for each form, the form plugin, its id, its title and the page it appears on. We keep only the most recent check-in from each installation; a new one replaces the last. Its requests also identify themselves in their user-agent header with your site address.

The plugin never reports anything about your visitors. It looks at the installation, not at the people using it.

Billing records

From Lemon Squeezy we read and store your email address, which plan you bought, your subscription status, the date your subscription is paid through, and Lemon Squeezy’s own reference ids — its customer, subscription and order ids. We never read or store any card details — not even the card brand or the last four digits.

The emails we send you

We keep a record of each email we sent: the address, what kind of message it was, the subject line, when it was sent, whether the provider accepted it and any error it gave back. That record is how we can tell whether an alert actually went out — which matters most on the day it did not. We also record when you unsubscribe from the weekly summary or from product email, and when an attempt to email an address fails.

Support correspondence

If you email us, we keep the message and our reply so we can help you and remember the context next time.

Waiting lists

If you join an early-access or waiting list, we store the email address you gave, the website address if you provided one, and where on the site you signed up.

• Personal data about your website’s visitors. We request your pages the way an ordinary anonymous visitor does. We receive no data from your visitors, and we have no access to your analytics or server logs. We never place any code of ours on your website; the only thing that runs on your site is our WordPress plugin, if you choose to install it, and it reports on the installation — never on the people using it.
• Copies of your pages. Page content is read only for as long as a check needs it — to find the links on a page, or to confirm the page loaded — and then discarded. Responses are size-capped as they are read. What we keep is the conclusion, not the content.
• Payment card data. Card and payment details are entered on Lemon Squeezy’s checkout, on their own domain, and are never sent to, seen by, or stored by SiteQuiet.
• Retargeting or cross-site advertising data. There are no ad pixels and no retargeting tags on this site. Our two measurement services (section 6) count visits and campaigns for us under random ids; they never receive your email address, and you can switch them off.
• Credentials for your website. Our checks never sign in, never submit forms without your explicit consent, and never need a password from you.
• Special-category data. We have no reason to collect anything about health, beliefs, politics or similar, and we ask you not to send it to us.

Our web fonts are served from our own domain, so simply reading this page does not send a request to any font or advertising network.

We do not use your data to make automated decisions with legal or similarly significant effects, and we do not profile you.

SiteQuiet sets two cookies of its own and uses two pieces of browser storage. We also use several analytics services — including PostHog and Google Analytics — which keep ids of their own on your device to tell one visit from another. They are listed below, and you can switch them off at the bottom of this section.

Two different things are called sq_session. If you open your browser’s storage panel you will see the name twice, and they are unrelated. Under Cookies, sq_session is your sign-in session: it exists only if you have an account and have signed in, it lasts 30 days, and your browser will not show you its value because it is HttpOnly. Under Session storage, sq_session is a random id used to group one visit’s product events: it exists whether or not you have an account, it is readable, and it disappears when you close the tab. Deleting the session-storage one signs nobody out. Deleting the cookie signs you out.

The sign-in cookie and the unfinished-purchase entry exist to do things you asked for: stay signed in, and finish a purchase you started. The split-test cookie and the session-storage id are not needed to deliver the site — they are how we measure our own wording. The scanner, the reports and every public page work with all four cleared; only staying signed in needs the sign-in cookie. Clearing browser storage removes them, though a later visit will be assigned a fresh split-test arm.

When the human-verification step is enabled on the scanner, it is Cloudflare Turnstile, loaded from Cloudflare. It exists to tell people from bots and is not an advertising tool; it may use its own browser storage to do that job, under Cloudflare’s privacy terms.

Turning measurement off

If you would rather not be counted, use the switch below. It stops PostHog and Google Analytics for this browser straight away, and our own analytics service from the next page you open, and it keeps working on later visits. Nothing about the product changes: the scanner, the reports, your alerts and your dashboard all behave exactly the same either way. Your browser’s own “Do Not Track” or tracking protection, and any content blocker, will also stop them, and we do not attempt to work around either.

We keep the list of companies involved deliberately short. Each one is bound by a contract to process data only for the service we buy from it.

Public internet lookups

Checking a website necessarily involves asking the internet about it: DNS resolvers are queried for its records, and the domain-registration (RDAP) service for its extension is asked when the domain expires. Those services receive the website address being checked. They do not receive your email address or anything else about you.

Things you choose to publish

A status page is off unless you switch it on. When you do, anyone with the link can see the website address; whether it is currently working, including how many smaller things are worth a look when there are any; when we last checked; the percentage of our availability checks over the last 30 days that found the website up, once enough have run to state a figure; and the problems we confirmed in that period — for each one, its headline, the date we confirmed it, whether it is still going on, and roughly how long it lasted once it is over. A confirmed problem that is still open can appear even if it began before that 30-day window. The page does not show your alert address, your account, your plan, the technical detail behind a check, or a problem we have not confirmed. Switching the page off takes it down.

A “Share results” link you create works the same way: anyone holding the link can see that frozen snapshot of the report until the link expires or you turn it off.

We keep this list current. We do not sell personal data, and we do not pass it to anyone else except where the law requires it, or where it is necessary to establish or defend a legal claim.

We keep data only as long as it is doing a job. Some of that is enforced by a scheduled deletion job, and some of it is not yet — this section says which is which, because a period nobody enforces is not a promise.

Deleted automatically

These are deleted on exactly these periods — by a scheduled job, or, for the two log files at the end of the table, by the service itself as it writes them.

Kept while they are doing a job

Nothing deletes these on a timer today. They are kept while the reason for holding them lasts, and you can ask us to delete them sooner — see section 9.

When we delete, the data is deleted or irreversibly aggregated so it no longer identifies anyone. You can ask us to delete your data sooner — see section 9.

If you are in the UK or the EU

Under the UK GDPR and EU GDPR you have the right to:

• get a copy of the personal data we hold about you (access);
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• receive your data in a portable, machine-readable format;
• restrict how we use your data while a concern is being resolved;
• object to processing we base on legitimate interests, including any direct marketing; and
• withdraw consent at any time, where consent is what we relied on.

If you are a California resident

Under the CCPA/CPRA you have the right to know what personal information we collect and why, to request its deletion, to request correction, and not to be discriminated against for exercising these rights. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics about you. Because we do not sell or share, there is no opt-out link to give you.

If you are in Israel

Under Israel’s Privacy Protection Law you have rights of access to, and correction of, data about you held in our databases. The same email route below applies.

How to exercise them

Email [email protected] from the address we hold for you, and tell us what you want. We will not charge you, and we will not ask for more identifying information than we need to be sure it is you — for a passwordless product, control of that inbox is usually enough.

We respond within one month (UK/EU) or 45 days (California). If a request is unusually complex we may extend that, and we will tell you why before the original deadline passes. You may also use an authorised agent.

What deleting your account removes, and what it keeps

When you ask us to delete your account, we run one deletion procedure that removes your customer and account records, your subscriptions and the website slots they held, every website we were watching for you together with its check history, incidents, alerts and any share links, your sign-in sessions and links, the purchases you started, our log of the emails we sent you, and the activity entries linked to your account. Deleting your account does not cancel a subscription at Lemon Squeezy: cancel it there first, or we will do it with you before deleting, so you are not charged for a service that no longer exists.

A few things remain, and here is each one and why:

• Billing and tax records, held by Lemon Squeezy as merchant of record, for as long as tax law requires.
• Our record that you agreed to our terms — your email address, the time, and the document versions — for three years after deletion (section 8), so a later question about a charge or a renewal can still be answered.
• If you unsubscribed from any of our email, the note of that address and that choice, so we keep honouring it.
• Payment-provider event references (identifiers and a checksum, no personal data) and our internal audit trail of operator actions, which may contain your account identifier.
• Abuse records where deleting them would defeat their purpose — we will say so if that applies to you.

A service whose whole job is fetching web addresses strangers give it has to be careful. Concretely:

• Every outbound request is checked before it is made. We refuse to connect to private, internal, loopback or cloud-metadata addresses, only allow ordinary web addresses and ports, and re-check every redirect hop against the same rules — so our service cannot be used as a way into someone else’s network.
• We never hold credentials for your website. There is nothing to steal, because we never ask for a password, and our checks never sign in.
• There is no SiteQuiet password either. Signing in is a one-time link that expires in fifteen minutes, and we store only a one-way hash of it — so a stolen copy of our database cannot sign anyone in. Keys held by our WordPress plugin are stored the same way, with only a short prefix kept readable so you can tell one key from another.
• Payment data is out of scope by design. Card details go to Lemon Squeezy directly; there is no card data in our systems to protect.
• Email addresses are kept out of analytics. Our own event collector accepts only a fixed list of event names and never receives an email address, and neither measurement vendor is sent one either.
• Billing messages from Lemon Squeezy are cryptographically verified before we act on them, so a forged “subscription cancelled” message cannot turn off your monitoring.
• Scan requests are individually authorised with short-lived signed tokens that are tied to the one address being scanned, so the scanning endpoint cannot be driven with arbitrary addresses.
• Traffic between you and SiteQuiet is encrypted in transit (HTTPS).

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data we will tell the relevant supervisory authority within the timescale the law requires — 72 hours where the GDPR applies, and immediately for severe incidents where Israeli law requires it — and tell you directly without undue delay where there is a high risk to you.

SiteQuiet is a business tool. It is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, tell us and we will delete it.

Our company is established in Israel; our hosting, database and the other providers in section 7 operate in the United States; your data moves accordingly.

• If you are in the EU/EEA or the UK: Israel holds an adequacy decision from the European Commission and equivalent recognition under UK adequacy regulations, so transfers to us in Israel do not need additional safeguards. Data of EEA origin that we hold is additionally handled under Israel’s Privacy Protection (EEA Data) Regulations.
• Onward transfers to our US providers are protected, provider by provider, by the EU–US Data Privacy Framework (and its UK extension) where the provider is certified, and otherwise by the European Commission’s Standard Contractual Clauses with the UK Addendum, entered into as part of each provider’s data-processing agreement.

You can ask us for details of the safeguards that apply to a particular transfer, and we will provide them.

We will update this policy when what we do changes — in particular if we add a cookie, an analytics provider, or a new processor. The “Last updated” date at the top always shows the current version.

If a change materially affects how we use your data, we will email subscribers before it takes effect rather than relying on you to re-read this page.

For anything in this policy — a question, a data request, or a complaint — email [email protected]. A person reads it, and we aim to reply within two business days. The operator of SiteQuiet is ShabSand, reachable directly at [email protected].

If you are not satisfied with how we have handled your data, you have the right to complain to a data-protection supervisory authority — in Israel, the Privacy Protection Authority; in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority in the country where you live or work. We would rather you came to us first, but you do not have to.