Privacy policy

Summary

• Free scans stay in your browser. The page you scan is not sent to us.
• Pro scans send that page to us and to the AI providers that analyse it, but only when you run one.
• We do not sell your data, and we use settings that keep AI providers from training on what we send them.
• We do not keep the page content we analyse. We keep the results, and only the ones you save.
• Ask us and we will delete your account and its data.

What this covers

This policy covers everything OctoCheck does: the website, the Chrome extension, your account, and the Pro checks that run on our servers. Those parts handle your data differently, so here is the short version.

Data we collect

Account. You sign in with Google or GitHub, so we never see a password. From your provider we receive your name, email address, picture and account id. We do not keep the tokens they issue.

Session. So you stay signed in. A session record includes your IP address and browser details.

Billing. Stripe processes payments, so we never see card numbers. We store your Stripe customer id, your plan and its status, your remaining quota, and a log of billing events from Stripe: ids, amounts and dates, no card or address data. We may email you about your account, your subscription and OctoCheck itself. You can opt out of anything that is not about your account.

Feedback. If you write to us from the extension, we keep your message, your email address and basic context about the scan.

Analytics. Google Analytics measures traffic on the website and in your account area.

Scans

Free scans run inside your browser. They read the page you are on and fetch a few public files from that same site, the way your browser would if you opened them yourself. Nothing about the page reaches us, and the extension carries no analytics or telemetry.

Pro scans are a separate action you turn on yourself. When you run one, the extension sends us the page you chose along with related material from the same site, and we pass it to AI providers to analyse. Our servers also make a few requests of their own, checking the page's outbound links and how the site answers AI crawlers. Those come from our servers, not from your address.

We do not store the content we analyse. It exists for the length of the request and is then discarded. What we keep is the result and a record of what the scan cost to run.

Worth knowing. A Pro scan works on any page you can open, including drafts and internal pages. If you run one there, that content follows the same path as any other. Decide before you turn it on.

Saved and shared reports

Saving a report is always something you choose to do.

On Pro, saved reports are stored with us. That is what makes them survive a new browser, a reinstall or a new computer, and what lets you open them from anywhere. They are private to your account unless you share them.

On Free, saved reports stay in your browser only. Nothing is uploaded, but nothing is backed up either, so clearing your browser data or changing machines will lose them.

Sharing turns a report into a link that anyone holding it can open, without signing in. The link is long and unguessable and we ask search engines to ignore it, but treat it as public. You can make it private again, or delete it, at any time. Deleting a report deletes what we stored for it.

Who we work with

A small number of services help us run OctoCheck. Each handles only what it needs to.

Cloudflare. Hosting, database, storage and protection against abuse.

Stripe. Payments and tax.

Google and GitHub. Sign-in.

AI providers such as OpenAI, Google and Anthropic. These run the Pro checks. We may reach them directly or through a routing service, and the mix changes as models change.

Google Analytics. Website traffic.

We use settings that exclude any provider that would retain or train on the content we send.

Cookies and analytics

Essential. A session cookie keeps you signed in. The account area cannot work without it.

Analytics. Google Analytics sets cookies to measure traffic and how the site performs. We use it to decide what to build next, not for advertising, and we have turned off Google's advertising features.

You can block cookies in your browser, or install Google's opt-out extension. Blocking the essential cookie will break sign-in.

What the extension keeps on your device

Your account token, any reports you saved locally, and a note of which messages you have dismissed. None of it syncs to your Chrome profile or to another device, and scan results are not kept at all unless you save them.

How long we keep things

We keep data for as long as we need it for the purpose it was collected, or for as long as the law requires.

Account and session data. Until you ask us to delete it.

Saved reports. Until you delete them. We may also remove reports stored with us once a subscription has been over for a long time.

Billing records. As long as tax and accounting rules require.

Analytics and server logs. Under each provider's own retention.

Backups. Our systems keep a short recovery window, which is why deletion takes up to 30 days to become final.

Your rights

You can ask us to show you the data we hold, correct it, or delete it. Write to the address at the end of this page.

Deletion is handled by hand rather than by a button. It removes your profile, sessions, saved reports, feedback and usage records, and completes within 30 days once the backup window has passed. Stripe keeps its own billing records under its rules, and we keep anything the law requires.

If you are in the EU or the UK, you also have the rights GDPR gives you, including the right to object and to complain to your data protection authority.

Children

OctoCheck is for users 18 and older. We do not knowingly collect data from anyone younger.

Security

Everything travels over TLS, payments go through Stripe so we never hold card numbers, and access to production data is limited to us. An administrator can sign in as your account to investigate a problem you have reported. Those sessions are short and recorded as such.

No system is perfectly secure. If we become aware of a breach that affects your data, we will tell you.

International users

We are based in the United States. If you use OctoCheck from elsewhere, your data is transferred to and processed in the United States and wherever our providers operate.

Changes

We may update this policy. Material changes will be announced in the app or by email, and the date at the top always reflects the current version.

Who we are

OctoCheck is operated by Efrox LLC, a company registered in the State of Florida, United States.

support@octocheck.ai