Privacy

Curbline loads a web page in a browser we control, tests it against WCAG 2.1 AA rules, and stores what it found. This page describes exactly what that means for the data involved.

What a scan does

When a URL is submitted, we open it in a headless Chromium browser on our own servers, wait four seconds for the page to finish rendering, and run axe-core against it. A second pass then walks the page with the Tab key, up to 150 stops, recording where keyboard focus goes.

We request the page the way any browser does. We do not sign in, submit forms, follow links beyond the URL given, or interact with anything beyond pressing Tab. Only the single page at the URL submitted is loaded.

What a scan stores

• •The URL scanned, and the time the scan started and finished.
• •The score, how many WCAG rules applied, and how many passed.
• •For each rule that failed: the rule id, its severity, its description, and the WCAG criteria it maps to.
• •Fragments of the page’s HTML. For each failing rule we store up to 25 examples, each a CSS selector identifying the element and up to 180 characters of that element’s markup. This is the evidence that makes a report actionable — it is also page content, and it is worth being plain that we hold it.
• •Keyboard findings: the type of problem, the element, and the WCAG criterion.

Those snippets are whatever is in the markup at that position. On a normal storefront page that is layout and product copy. We do not extract, index, or search page content for any purpose beyond rendering it back in your report.

Scanning a site you do not own

Anyone can paste any URL into the form on our homepage, including a site they have no relationship with. We do not verify ownership before scanning, and we cannot.

If you submit a URL, you are telling us you have the right to request that scan. Responsibility for that sits with you, not with us — this is set out in the terms. If you operate a site and want a scan of it removed, contact us and we will delete it.

Account data

• •Your email address, which is also how you sign in. There is no password.
• •The sites you add, and any label you give them.
• •Your plan, and identifiers issued by Stripe for your customer and subscription records. We never see or store your card details.

IP addresses

Free scans are rate limited, which requires recognising repeat requests from the same place. We do not store your IP address to do it. The address is combined with a secret held only on our servers and hashed with SHA-256, and only that hash is written down. The hash cannot be reversed to an address, and it is deleted after 24 hours.

Our hosting provider keeps its own request logs, which do contain addresses. Those are subject to their retention, not ours.

How long we keep things

These are the periods our systems actually enforce. A scheduled job applies them daily; they are not aspirations.

• •Scans on an account, including stored HTML snippets: 365 days from the date of the scan. Long enough to show a year of change, which is what monitoring is for, and no longer.
• •Free scans nobody has claimed: 30 days. A scan run from the homepage by someone who never created an account is deleted entirely, along with its stored snippets, after 30 days.
• •Rate-limiting records: 24 hours.
• •Billing event identifiers, kept so repeated messages from Stripe are not processed twice: 365 days.
• •Expired sign-in sessions and unused sign-in links: deleted daily once expired.

Cancelling a subscription does not delete anything. Your scan history stays visible and ages out on the same 365-day clock as everyone else’s, so reactivating picks up where you left off. If you want it gone sooner, ask and we will erase it.

Deleting your account removes your sites, every scan of them, and the stored snippets, by cascade. Stripe keeps its own record of payments, which we cannot delete and which they are independently required to retain.

Who else processes this data

Curbline is a small product built on other people’s infrastructure. In full:

• •Railway — runs the application and the PostgreSQL database. Everything described above is stored there.
• •Resend — sends sign-in links and scan notification emails. Delivery is carried out by Amazon SES in the ap-northeast-1 region (Tokyo). Resend receives your email address and the content of those messages.
• •Stripe — processes payments and holds your billing details. Card numbers go directly to Stripe and never reach us.

No analytics, advertising, or tracking service is used. There are no third-party scripts on this site, and we set no cookies other than the one that keeps you signed in.

Where your data is held

Three jurisdictions are involved. Stating that plainly is the point of this section — it is the part most likely to matter and the least likely to be guessed correctly.

• •The application and the database: Railway, US East (United States). Every scan, every stored HTML snippet, and all account data live here.
• •Sign-in and notification email: Amazon SES, ap-northeast-1 (Tokyo, Japan), via Resend. Your email address and the contents of those messages are processed there.
• •Payments: Stripe, on an Australian account. Billing details and payment records are held by Stripe under their own terms.

So a European or American customer’s data touches the United States, Japan and Australia in the course of normal use. None of that is hidden from you and none of it is incidental — it is how the product is built.

Scans run on behalf of someone else

On the Agency plan, our customer is the agency and the scanned store belongs to their client. We therefore hold fragments of pages belonging to a business that has no relationship with us. We process that content only to produce the agency’s report, we do not use it for anything else, and it is deleted on the schedule above.

The contract that should govern that arrangement does not exist yet. It is recorded as a commercial gap in the terms, because that is what it is.

Contact

Email hello@curbline.app for anything on this page, including removal of a scan or erasure of an account.