Privacy policy

What we store

Running the service requires a small amount of data: API keys are stored only as SHA-256 hashes (you see a short prefix in the dashboard), per-account monthly usage counts, the webhook URL if you configure one, and a conversion index (the source URL, byte size and timestamp of each render). Rendered PDFs are kept so you can download them, then deleted automatically after 7 days of retention.

If you sign in with Google, we also store your Google account's email and display name, and a session record so the dashboard remembers you. Your password never touches webcapture; Google only tells us that you signed in. If you sign in with email, we store the address and send a short-lived sign-in code; delivery goes through our email processor, Resend, which handles the address and the message solely to deliver it. The code itself is kept only as a hash and expires in minutes.

Where your data lives, and for how long

The URL you submit, the rendered file, and a usage counter live in our single application datastore on our own infrastructure (OVHcloud, in Singapore), delivered through Cloudflare's network. Rendered files and their log rows are deleted after 7 days. Your account email persists until you ask us to delete it.

Subprocessors

Six providers act as pipes for your data: Google (sign-in identity, and Google Analytics page-view and interaction-event measurement on public pages when configured), Resend (one-time codes and account email), Stripe (billing, once live), OVHcloud (hosting, in Singapore) with Cloudflare (network, and the bot check on sign-in and the free tool), Sentry (error and performance monitoring in production: crash reports with stack traces and coarse request metadata, a sample of request traces, and the same from a signed-in dashboard session. Not advertising or product analytics), and PostHog (product analytics, EU-hosted: counts events like sign-ups and renders, sent from our own server with no cookies in your browser, no IP addresses, and accounts appearing only as opaque ids). None of them owns a product function.

Sign-in and the free URL-to-PDF tool ask Cloudflare Turnstile to tell a person from a bot. That check runs in a Cloudflare frame. It is not analytics and it is not advertising.

When error monitoring is enabled in production, Sentry receives server crash reports: exception type and stack trace, HTTP method and path, and response status, plus a sample of request traces (method, path, and timing). A signed-in dashboard session also sends Sentry a browser crash report and a performance trace of that session. We configure Sentry not to collect cookies, Authorization headers, API keys, or request bodies. It is error and performance monitoring, not advertising or behavioral analytics.

When Google Analytics is configured, public marketing pages send page views and interaction events to Google Analytics 4 (gtag): which buttons are clicked (calls to action and sign-in entries), and free-tool conversions, with no account identity. The Measurement ID is a public site identifier; we do not use GA for advertising or remarketing, and signed-in dashboard pages do not load the snippet. When Ahrefs Web Analytics is configured, public marketing pages also load Ahrefs' cookieless snippet to count aggregate visits and referrers; it sets no cookies and receives no account identity.

The full control list, including what we do not offer, is on the security page.

Cookies

The site itself sets exactly two essential cookies: a sign-in session cookie (HttpOnly, 30 days, so the dashboard stays signed in) and a short-lived handshake cookie (10 minutes, only while signing in with Google). A signed-in dashboard session also loads Sentry in the browser, as described above. When Google Analytics is configured, its gtag snippet also sets Google's _ga cookies on public marketing pages to distinguish visits. No advertising. Product analytics leaves from our server: page views and button clicks are counted in our own database, and product events (sign-ups, key mints, renders, checkouts) go to PostHog from that same server with an opaque account id, no cookies, and no IP address. When Google Analytics is configured, public marketing pages additionally load Google's gtag snippet so we can see aggregate page views and interaction events (which buttons are clicked: calls to action and sign-in entries, and free-tool conversions); the signed-in dashboard does not load it, and it is not used for advertising. The Ahrefs Web Analytics snippet, when configured, loads on the same public pages and sets no cookies at all.

What we never collect

Sign-in uses Google or a one-time email code; your account email is the only identity we hold.

Pages you render

Target URLs are fetched transiently in order to render them and are used to provide the service. You are responsible for having the right to render the pages you submit. Do not submit pages containing personal data unless you have a lawful basis for doing so.

Payments

Subscriptions are billed through Stripe. Card details go directly to Stripe and never touch our servers; we receive only a payment reference so we can move a key to the paid tier.

Deletion

Revoke a key to stop new usage: from your dashboard for your own keys, or with the master key. Rendered files expire on their own through automatic retention. For anything else, email hello@webcapture.io and we will delete it.