Privacy

StillChecksOut stores the account you create (name, email, password hash), the apps and journeys you add, check results, screenshots, and billing status. Passwords for your account are hashed by the auth library. Test-account passwords and Stripe or database credentials you paste for access matching are encrypted with AES-256-GCM before they are written, and they are never sent back to the browser.

The public checker stores the URL you submit, the report, and the email you give us if you want the full report. That email is synced to ActiveCampaign: we create or update a contact, add it to the list “StillChecksOut sign-ups”, and apply tags for the source (signup or checker) and the plan. Account sign-ups are synced the same way. If ActiveCampaign is down, sign-up still completes and the sync is retried.

Payments are handled by Stripe. We store the Stripe customer id, subscription id, status, and plan. We do not store card numbers. Screenshots can contain whatever was on the page, including test data you typed into the journey. Delete the app to delete its journeys, runs, and stored credentials.

We do not sell personal data. Checker fetches are passive reads of public URLs. We rate-limit them and refuse private networks, localhost, and cloud metadata addresses.

Page views and signup steps are counted in our own database so we can see which pages were opened and how many people created an account. The count is a path and a day. It does not use cookies and it does not store an address, a name, or an identifier for the visitor.

Questions: hello@stillchecksout.com.