Privacy policy

untick is an independent software product operated by Mahmoud Shayeb, an individual developer (not a registered company). In this policy “we” means the person operating untick, who is responsible for your data. We build a tool that catches dark patterns, so we hold ourselves to the same standard: this site has no advertising trackers, counts visits without cookies, and sets only one strictly necessary cookie when you sign in. Questions: hello@untick.io.

The tag after each item is the legal reason we may use it: contract means we need it to give you the service, legitimate interest means a reasonable need of ours that doesn’t override your rights.

What we collect and why

• Account dataName, email, password (stored only as a salted scrypt hash), timezone and your settings. Needed to run your account. contract
• Sites and scansThe addresses you ask us to scan, the results, and screenshots of those public pages. Needed to provide the service. contract
• Free scansWithout an account: the address scanned, a one-way hash of your IP address and of the free-scan cookie code, used only for fair-use limits. legitimate interest
• Bot protectionWhen you sign up or run a free scan, Cloudflare Turnstile checks that a person, not a script, is using the form. legitimate interest
• EmailsAccount emails (confirming your address, password resets), monitoring alerts and a monthly summary. Alerts and the summary can be switched off in Settings → Alerts.
• Slack and webhooksIf you connect one, we store its address and a signing secret, and send your alerts (site, issues found, report links) there. That service’s own terms then apply.
• API tokensA hash of each token (never the token itself), its name, its first characters and when it was last used.
• BillingHandled entirely by Paddle.com, our Merchant of Record. We only store your Paddle customer and subscription IDs, your plan, billing period and subscription status. We never see or store card details.
• How pages are usedOur own server notes which page you opened, which tool you used (for example a free scan, with the visitor profile and number of pages), whether it worked, the site that sent you, campaign tags in the link and your country. To count people rather than clicks, it makes a short code from your IP address, your browser name and a random value that changes every day. The IP address itself isn’t stored, and each day’s random value is deleted, so the code can’t follow you from one day to the next. No cookie or browser storage is used for this. If you’re signed in or use an API token, the note is linked to your account and deleted with it. Kept for 400 days and never shared. We use it to learn which tools help people. legitimate interest
• Technical logsOur hosting provider keeps request and error logs, including IP addresses, for a few days for security and troubleshooting. legitimate interest

What we don’t do

We don’t sell or rent data, run ads, use advertising trackers, or install anything on the sites we scan. Scans only load pages that are already public, the way any visitor would.

Visit counts

On our public pages we use Cloudflare Web Analytics to see how many people visit and which pages they read. Cloudflare says it doesn’t use cookies or local storage for this and doesn’t fingerprint visitors. From Cloudflare we only see totals, such as page views, countries and page speed. It isn’t used for ads, and it isn’t loaded in the signed-in app.

Our own count of pages and tools used, described above, runs on our own server on every page, the app included, without cookies or browser storage.

Cookies

• untick_sessionKeeps you signed in. Strictly necessary, HTTP-only and secure. Expires after 30 days without use.
• untick_free_scanSet only when you run a free scan without an account. Strictly necessary to stop abuse: one browser can run at most 3 free checks a day. It holds a random code and nothing about you, is HTTP-only, is sent only to our free-scan service, isn’t used for tracking and expires after 24 hours.
• untick_ownerOnly ever set in the browsers of the person who runs untick, so their own testing isn’t counted. Visitors never get it.
• PaddlePaddle’s checkout sets its own cookies only when you open checkout. For paying customers, the app loads Paddle’s payment scripts (including its Retain payment-recovery script) with your Paddle customer ID, so it can tell you when a payment fails. Our payment update page, which our failed-payment emails link to, loads the same scripts so you can update your card there.

Who processes data for us

• Cloudflare: hosting, database and screenshot storage, the browser that scans websites, AI that reads unusual button and checkbox wording on scanned pages (only text from those public pages), bot protection (Turnstile), network and DDoS protection, and visit counts (Cloudflare Web Analytics).
• Paddle: payments, invoicing and tax, as Merchant of Record, and emails about failed payments (Paddle Retain).
• Mailjet: email delivery.

Some of these providers process data outside the EU and UK, including in the United States. Where they do, transfers rely on the European Commission’s standard contractual clauses or an adequacy decision such as the EU–US Data Privacy Framework.

How long we keep it

• Your sites, scans and screenshots: for as long as your account exists. Your plan decides how far back you can see and open scans in the app (a site’s latest scan always opens); older results stay stored until you delete the site or your account.
• Unclaimed free scans and their screenshots: 30 days.
• Notes of pages and tools used: 400 days.
• Sessions end after 30 days without use; password-reset and confirmation links are deleted a day after they expire.
• Deleting a site deletes its scans and screenshots. Deleting your account (Settings → Delete account) immediately deletes your sites, scans, screenshots, alert channels, API tokens, sessions and the notes of pages and tools you used, and cancels your subscription.
• Paddle keeps payment and invoice records for as long as tax law requires.

Your rights

You can access, correct, export or delete your data, restrict or object to processing, or complain to your local data protection authority. Email hello@untick.io and we’ll respond within 30 days.

Changes

When this policy changes, we update the date above. We’ll email account holders about material changes before they apply.