Skip to content
Free scan
Menu

Privacy policy

This draft explains what Loudlark collects, why, and what you can ask of us. It collects things in two places: the free Growth Scan, which needs no account, and signing in to a workspace.

Draft Draft. This text has not been reviewed by a lawyer and is not in force. It describes how the service is designed to work.

Loudlark is the company and the product. The legal entity, its address and a contact for privacy questions are to be added before this policy takes effect.

The address you type. We keep only its origin (the scheme and the host). Paths, query strings and anything that looks like a token are dropped before anything is stored.

The public pages of that site, about ten, which we read the way any visitor can, and the report we write from them.

The network address of your device, used to limit how many scans one address can start in a short time.

We do not ask for your name or your email, and nobody is added to a list.

A report lives at an unguessable link. Anyone you send the link to can open it. It is marked noindex and kept out of search engines and our sitemap, and it expires; the period will be stated here before launch.

The pages you can read without signing in set no cookies and load nothing from another origin: the typeface is served by us. We count a few events on our own servers: a scan started, a scan finished, a sign-up link clicked. Which properties each event carries is to be added.

Asking for a sign-in link and signing in set cookies. Each one belongs to this site alone, is HttpOnly (a script on a page cannot read it), is SameSite=Lax (another site cannot send it along with a form) and is Secure on https.

sb-<project>-auth-token: Keeps you signed in. A large session is split into numbered parts (.0, .1). Signing out removes it. Lasts up to 30 days.

ll_pending_email: Remembers the address you typed on the sign-in form, so the next page can show it back and a link made for a different address is refused. Lasts up to 15 minutes.

sb-<project>-auth-token-*code-verifier: Only if you choose Continue with Google: a few cookies, with names that end in code-verifier, hold one-time secrets that tie Google's answer to your browser. Lasts up to 30 days.

You create a workspace with your email address: we email you a link that signs you in, and there is no password. We then hold that address, the name and address of each product you add, the scan you carried over from the free scan if you did, and the content we draft for you.

When you connect accounts (for example Stripe, analytics and publishing accounts), we will also hold what each needs. Connected-account tokens will be encrypted at rest and used only inside the job that needs them, and will never be put in a prompt to a model. Each customer works in a workspace that the database keeps apart from every other.

We expect to use providers for hosting and the database, background jobs, AI models, web search and payments. The list of providers, and what each receives, is to be added.

You will be able to ask us to access, correct or delete what we hold about you. How to ask, and how long we keep each kind of data, is to be added.

  • The legal entity, its address and a privacy contact.
  • How long a report, a workspace and its logs are kept.
  • The providers that handle data and what each receives.
  • The legal basis and the jurisdiction, and whether a data processing agreement is offered.
  • Review by counsel.