Privacy

Curbline loads a web page in a browser we control, tests it against WCAG 2.1 AA rules, and stores what it found. This page describes exactly what that means for the data involved.

What a scan does

When a URL is submitted, we open it in a headless Chromium browser on our own servers, wait four seconds for the page to finish rendering, and run axe-core against it. A second pass then walks the page with the Tab key, up to 150 stops, recording where keyboard focus goes.

We request the page the way any browser does. We do not sign in, submit forms, follow links beyond the URL given, or interact with anything beyond pressing Tab. Only the single page at the URL submitted is loaded.

What a scan stores

• •The URL scanned, and the time the scan started and finished.
• •The score, how many WCAG rules applied, and how many passed.
• •For each rule that failed: the rule id, its severity, its description, and the WCAG criteria it maps to.
• •Fragments of the page’s HTML. For each failing rule we store up to 25 examples, each a CSS selector identifying the element and up to 180 characters of that element’s markup. This is the evidence that makes a report actionable — it is also page content, and it is worth being plain that we hold it.
• •Keyboard findings: the type of problem, the element, and the WCAG criterion.

Those snippets are whatever is in the markup at that position. On a normal storefront page that is layout and product copy. We do not extract, index, or search page content for any purpose beyond rendering it back in your report.

Scanning a site you do not own

Anyone can paste any URL into the form on our homepage, including a site they have no relationship with. We do not verify ownership before scanning, and we cannot.

If you submit a URL, you are telling us you have the right to request that scan. Responsibility for that sits with you, not with us — this is set out in the terms. If you operate a site and want a scan of it removed, contact us and we will delete it.

Account data on curbline.app

This section covers accounts on this website. If you installed Curbline from the Shopify App Store, the section below applies to you instead — the two are separate, and a Shopify install does not create an account here.

• •Your email address, which is also how you sign in. There is no password.
• •The sites you add, and any label you give them.
• •Your plan, and identifiers issued by Stripe for your customer and subscription records. We never see or store your card details.

If you installed Curbline from the Shopify App Store

The Shopify app is the same scanner reached a different way, and the data relationship is narrower than the one above. The single most important fact about it is what it does not ask for.

Curbline requests no Shopify access scopes at all. Its configured scope list is empty. It cannot read your products, customers, orders, inventory, finances, or anything else in your admin, because it was never granted permission to and no such permission is requested at install. It takes your shop domain from the session Shopify issues, and then reads your storefront from the outside — the same public page any shopper loads. It adds no script to your storefront and makes no change to your theme.

What we hold for a Shopify install:

• •Your .myshopify.com domain.
• •The session token Shopify issues so the embedded app can authenticate. No password and no customer-facing credential is involved.
• •Scans of your storefront — the same results, HTML snippets and keyboard findings described above, about pages rather than about people.
• •The address you enter under “Where should alerts go?”, if you set one. We ask for it rather than taking your Shopify account email, because the person installing an app is often not the person who should receive its mail. Every alert carries a one-click unsubscribe.
• •Your plan, and the subscription identifiers Shopify sends us. Merchants who subscribe through Shopify are billed by Shopify — Stripe is not involved and we receive no card details by any route.

Shopify’s mandatory privacy webhooks

Shopify requires every public app to handle three requests on a merchant’s behalf. Curbline handles all three. What they do here is shaped by the fact that we hold no customer data:

• •A customer data request returns nothing, because there is nothing to return. We hold no shopper records — no names, emails, addresses or order history — so there is no customer file to produce. We answer the request rather than ignoring it, and we answer it honestly.
• •A customer redaction request likewise erases nothing, for the same reason. Nothing about a shopper was ever stored.
• •A shop redaction request deletes everything. Shopify sends this 48 hours after an uninstall. It removes the shop record and, by database cascade, every site, scan, rule violation and keyboard finding belonging to it.

Uninstalling is the step before that. On uninstall we delete your sessions immediately and mark the shop as uninstalled, but keep its scan history for those 48 hours — which is what lets a reinstall pick up where you left off rather than starting a second, empty copy of your store. If you reinstall inside that window your history returns. If you do not, the shop redaction above erases it.

If you want your data gone sooner than the 48 hours, email us and we will erase it on request.

IP addresses

Free scans are rate limited, which requires recognising repeat requests from the same place. We do not store your IP address to do it. The address is combined with a secret held only on our servers and hashed with SHA-256, and only that hash is written down. The hash cannot be reversed to an address, and it is deleted after 24 hours.

Our hosting provider keeps its own request logs, which do contain addresses. Those are subject to their retention, not ours.

How long we keep things

These are the periods our systems actually enforce. A scheduled job applies them daily; they are not aspirations.

• •Scans on an account, including stored HTML snippets: 365 days from the date of the scan. Long enough to show a year of change, which is what monitoring is for, and no longer.
• •Free scans nobody has claimed: 30 days. A scan run from the homepage by someone who never created an account is deleted entirely, along with its stored snippets, after 30 days.
• •Rate-limiting records: 24 hours.
• •Billing event identifiers, kept so repeated messages from Stripe are not processed twice: 365 days.
• •Expired sign-in sessions and unused sign-in links: deleted daily once expired.

Cancelling a subscription does not delete anything. Your scan history stays visible and ages out on the same 365-day clock as everyone else’s, so reactivating picks up where you left off. If you want it gone sooner, ask and we will erase it.

Deleting your account removes your sites, every scan of them, and the stored snippets, by cascade. Stripe keeps its own record of payments, which we cannot delete and which they are independently required to retain.

Who else processes this data

Curbline is a small product built on other people’s infrastructure. In full:

• •Railway — runs the application and the PostgreSQL database. Everything described above is stored there.
• •Resend — sends sign-in links and scan notification emails. Delivery is carried out by Amazon SES in the ap-northeast-1 region (Tokyo). Resend receives your email address and the content of those messages.
• •Stripe — processes payments and holds your billing details for subscriptions bought on this website. Card numbers go directly to Stripe and never reach us.
• •Shopify — for merchants who installed from the Shopify App Store, Shopify issues the session, bills the subscription and sends us the subscription status. Those merchants’ payment details are held by Shopify under their terms, and Stripe is not in that path at all.

No analytics, advertising, or tracking service is used. There are no third-party scripts on this site, and we set no cookies other than the one that keeps you signed in.

Where your data is held

Three jurisdictions are involved. Stating that plainly is the point of this section — it is the part most likely to matter and the least likely to be guessed correctly.

• •The application and the database: Railway, US East (United States). Every scan, every stored HTML snippet, and all account data live here.
• •Sign-in and notification email: Amazon SES, ap-northeast-1 (Tokyo, Japan), via Resend. Your email address and the contents of those messages are processed there.
• •Payments: Stripe, on an Australian account. Billing details and payment records are held by Stripe under their own terms.

So a European or American customer’s data touches the United States, Japan and Australia in the course of normal use. None of that is hidden from you and none of it is incidental — it is how the product is built.

Scans run on behalf of someone else

On the Agency plan, our customer is the agency and the scanned store belongs to their client. We therefore hold fragments of pages belonging to a business that has no relationship with us. We process that content only to produce the agency’s report, we do not use it for anything else, and it is deleted on the schedule above.

The contract that should govern that arrangement does not exist yet. It is recorded as a commercial gap in the terms, because that is what it is.

Contact

Email hello@curbline.app for anything on this page, including removal of a scan or erasure of an account.