Privacy Policy

How to read this draft

This notice describes the DataTuber website as it is built. It does not claim compliance with the GDPR, the UK GDPR, Israeli privacy law, or any US state privacy law. If one of those laws applies, counsel has to say so and this notice has to be rewritten before it takes effect.

Account data and screenshot content are different. Account data is the email, verification time, session hash, and API key hash stored for a sign-in. Screenshot content is whatever a target page happens to contain. Every capture stores the URL, the viewport, the image format, and the response status. A capture made with an API key, or from the signed-in dashboard, also stores the image bytes so that account can download them later. The homepage demo returns the image and does not store it. Deleting the account deletes stored images with the capture rows. There is no separate timer that erases them.

Roles

This draft does not call the operator a controller or a processor. Those roles can differ for account data and for pages a customer asks a future API to capture. The label is a legal conclusion, not a product slogan.

TODO: OWNER/COUNSEL REVIEW. Decide controller and processor roles. Decide whether business customers need a data processing agreement, a subprocessor list, and international transfer terms before any customer content is processed.

What the current website processes

Submitting the sign-in form sends the email address to this website and stores it in Neon. When Mailgun is configured, this website asks Mailgun to deliver one message with a verification link. Mailgun receives the address so it can deliver that message. The address stays unverified, and the account cannot open the dashboard or call the API, until that link is opened. Opening the link stores the verification time and a hash of a session token in an httpOnly cookie named dt_session. The homepage Capture screenshot button sends the URL to this website, which asks Cloudflare Browser Rendering for an image and returns that image to the browser. The image is not stored. The URL, the viewport, the image format, the response status, and a hash of the visitor IP are stored so the public demo can be rate limited. When a Google Analytics measurement ID is configured, each page view also sends the page address, the referrer, and browser details to Google. The table states what the repository does with each category.

Connection logs

The repository contains no application logger and no log store. A hosting network can still record IP address, user agent, requested path, and time as part of delivering the site. Whether that happens, where it is stored, and how long it is kept are not confirmed.

TODO: OWNER/COUNSEL REVIEW. Name the host, the region, the log fields, and the log retention period from the host contract or dashboard. Until that evidence exists, do not promise that logs are absent and do not invent a retention number.

What a later product might process

The following are plans, not current processing. They are listed so this notice is not mistaken for a description of a live API.

• A Google identity, if that sign-in is added later. It is not offered now.
• Messages a customer sends to a future support channel.
• A record that the account holder accepted a published terms or privacy notice. The drafts are not in effect, and sign-in does not record acceptance.

A submitted URL or a captured page can contain personal information or sensitive information, including information the customer did not mean to send. Customers should not point a capture tool at pages they are not allowed to collect. The homepage demo does fetch the URL you submit, and it does not store the image. An API key or the signed-in dashboard does store the image on that account.

Purposes

For the current website, the purpose of operating the server is to return the pages a visitor requests, to verify an email address, to keep a session, to issue API keys, and to enforce screenshot quotas. When a measurement ID is configured, page views are also measured with Google Analytics. Submitting the sign-in form stores the address and, when Mailgun is configured, asks Mailgun to deliver the verification link.

If connection logs exist at the host, their purpose has to be taken from the host setup. This draft does not assign one.

Future purposes, only if those features are built, would be: creating and securing an account, authenticating API requests, producing a screenshot the customer asked for, showing the customer their own usage, preventing abuse, and answering support. Marketing email is not a current purpose and no marketing list exists.

Lawful bases

This draft names no lawful basis. It does not treat a page view as consent to analytics. Typing into a preview field is not treated as consent to a contract.

TODO: OWNER/COUNSEL REVIEW. If the GDPR, UK GDPR, or another basis-driven law applies, name the basis for each real processing activity, including host logs. If Israeli law applies, state the applicable duty in the language counsel approves. Do not add a consent banner to imitate compliance.

Sources

The visitor types the homepage URL and can click Capture screenshot. That URL is sent to this website so it can request a screenshot. Submitting the sign-in form sends the email address so a message can be delivered. Other typed fields stay in the browser. The operator does not buy data and does not receive account data from Google, because Google sign-in is not connected.

Recipients and processors

The homepage screenshot demo sends the target URL to Cloudflare Browser Rendering and receives the image. The sign-in form sends the submitted address to Mailgun when Mailgun is configured, so Mailgun can deliver one message to that address. Page views are sent to Google Analytics when a measurement ID is configured. No error tracker, payment, authentication, or object storage vendor is installed. The host that receives a visitor connection is not identified in source.

TODO: OWNER/COUNSEL REVIEW. List each real recipient, the service they provide, and the location used. Link the contract or data-processing terms. Leave the list empty rather than copying a typical stack.

International transfers

No transfer safeguard is recorded in the repository. No standard contractual clauses and no adequacy decision are adopted here, because no processor contract is in the project. The location of a future host is unknown, so this draft does not describe a transfer path.

TODO: OWNER/COUNSEL REVIEW. Map where each system runs and which transfer tool, if any, the law requires. The founder location stated in the project brief is not, by itself, a hosting location.

Retention

Account rows stay until the signed-in account holder deletes the account from Settings. That deletion removes the user, workspace, API keys, sessions, usage counters, and capture rows for that workspace, including any stored screenshot. An unverified address is stored when the form is submitted. There is no session before the link is opened, so deletion is available after verification. Anonymous demo rows are not tied to an account. There is no export of personal data and no automatic deletion job for anonymous rows. This draft does not promise deletion within a number of hours or days, and it does not describe backups.

Browser memory used by the preview forms ends when the page is left or reloaded, unless the browser's own autofill keeps a copy.

A future retention rule has to follow the real delete path, including backups and provider logs. Criteria counsel will need include why the data is kept, how a customer can ask for deletion, and what a host log retains outside the application.

TODO: OWNER/COUNSEL REVIEW. Set retention only from implemented behavior. Include backups. Describe how an account-deletion request will be honored once accounts exist.

Security

Account email, session hashes, and API key hashes are stored in Neon. The session cookie is httpOnly. The full API key is not stored after it is shown. An account with an unverified email cannot open the dashboard or call the API. The screenshot demo and the sign-in message read provider credentials from a local environment file when those features run. Those are facts about this build, not a security certification. This draft does not claim encryption at rest, a penetration test, or a compliance seal.

Whether the public site is served over HTTPS depends on the host and DNS configuration, which are outside this repository.

TODO: OWNER/COUNSEL REVIEW. Describe only controls that are actually on. If you later cite encryption, name the layer and the system. Avoid absolute claims such as "bank-grade" or "cannot be breached."

Your rights and requests

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal data, to object to or restrict certain uses, and to complain to a regulator. This list is a reminder that those rights can exist. It is not a statement that a particular statute applies, and it is not a fulfillment channel.

Settings can delete the signed-in account and the rows listed in the retention section. The product has no page that exports personal data. No privacy contact is published, so a request cannot be submitted through a dedicated privacy address. Identity checks and response times are unset.

TODO: OWNER/COUNSEL REVIEW. Publish a request channel, say how identity will be verified, and set a response time the operator can meet. Name the regulator path only if counsel confirms the relevant authority.

Cookies and similar storage

Details are in the Cookie Policy. The application sets one essential session cookie, dt_session, after a verification link is opened. When Google Analytics is configured, Google's tag also sets the analytics cookies listed there. The application writes no local storage or session storage. There is no cookie banner. A banner should be added when the law requires a choice before those analytics cookies are set.

Children

The website is aimed at developers evaluating an API. It is not directed at children. The sign-in form stores the email address that is submitted. No age gate is implemented.

TODO: OWNER/COUNSEL REVIEW. Set the age threshold that will apply before accounts open, including any parental-consent duty. Do not copy 13 or 16 until counsel confirms the rule for the markets you serve.

Changes to this notice

The version and history are in the header. A change to this draft does not notify visitors, because the draft is not in effect. A published notice will need a version id and, for material changes, a notice method counsel approves. There is no mailing list to notify today.

Privacy contact

No privacy contact is published. Please do not send personal information to an address that this page does not list.

TODO: OWNER/COUNSEL REVIEW. Add a monitored privacy contact that the operator controls. Keep it separate from a personal inbox unless counsel and the operator agree that the personal inbox is appropriate and disclosed.

Related drafts

• Terms of Service
• Acceptable Use Policy
• Copyright and Takedown
• Cookie Policy
• API and Beta Service Disclaimer