Glitchmark
Log in
Colour theme

Privacy policy

Last updated

Glitchmark collects what it needs to run your account and scan your sites, and nothing more. Cookies are used only to sign you in. There are no analytics, no advertising and no tracking across other sites.

Who is responsible

Afaq Ahmad, based in Pakistan, runs Glitchmark and decides how its data is used. For questions or requests, email support@getglitchmark.com.

What we collect

  • Request logs. When your browser asks for a page, our host records your IP address, your browser, the page and the time. This keeps the site working and protects it from abuse.
  • Your account. When you sign up, we store your name, your email address and a hashed version of your password, never the password itself. If you continue with Google instead, we store the name, email address, profile picture link and account ID Google sends us.
  • One cookie, only to keep you signed in. When you log in, your browser stores a random key that tells us it is you. Scripts cannot read it, it is sent only to Glitchmark, and it ends when you log out or after 7 days without a visit.
  • One cookie when you sign up, so the link in your confirmation email signs you in only in that browser. It holds a scrambled version of your email address, never the address itself. Scripts cannot read it, it is sent only to Glitchmark's sign-in links, and it ends after 24 hours.
  • One cookie when you continue with Google, so we only accept the sign-in you started. It holds a random key, scripts cannot read it, and it ends after 5 minutes.
  • Sign-ins. For each device you are signed in on, we store its IP address and browser, to keep your account safe. When a new sign-in goes over the devices your plan allows, we email you the new device's browser and system.
  • Your sites and scans. We store the sites you add and the results of each scan: when it ran, the pages checked, the issues found and screenshots of the pages. A scan visits the public pages of a site you added, as any visitor would. When you add a site, we take a picture of its home page to ask whether the site is yours.
  • Your theme choice. If you pick light or dark, the choice is saved in your browser's local storage. It never leaves your device.
  • Waitlist sign-ups. If you joined the waitlist, we keep your email address, the site address you typed and the time, to email you about Glitchmark and to give you the beta discount.
  • Abuse protection. When you sign up, log in or ask for a password reset, we count attempts from your network using a hashed version of your IP address, and attempts on your account using a hashed version of your email address. Each count is deleted once its time window, at most an hour, has passed.
  • Free scans. When you start a scan on the Free plan, we record the site, with hashed versions of your IP address and of a device identifier. Your browser works the identifier out from its settings, such as its screen and fonts, with the open-source FingerprintJS library, only when you start a scan, and sends it only to Glitchmark. The hashes can't be turned back into your address or the identifier. They let each site have one free scan, and stop one person from taking many free scans with new accounts.
  • Emails we send. We email you only about your account and your scans: to confirm your email address, to reset your password, to tell you when someone tries to sign up with your address, and to tell you when a scan you started has finished.
  • Emails you send us. If you email us, we keep the conversation so we can answer.

The scan box on the home page checks the address in your browser, then takes it to sign-up or log-in, and to your account once you confirm it is your site.

Who can see it

Your sites, scans and reports are shown only to you, when you are signed in. Glitchmark admins can view any site, scan and report, for support and to prevent abuse.

What we do not do

No analytics, no advertising and no tracking across other sites. The only cookies are the two that sign you in. We never sell data.

Services that receive data

Vercel

What it does:
Hosts this website and runs the code that handles your account.
What it receives:
Request logs: your IP address, browser, the page you asked for and the time. Vercel keeps them for a short time for security and debugging. Everything you send to Glitchmark passes through it on the way to the database.
Where:
Vercel Inc., United States. Pages are served from around the world; the code that handles your account runs in Frankfurt, Germany.

Neon

What it does:
Hosts the database that keeps accounts, sites, scans and the waitlist.
What it receives:
Your name, email address and hashed password; the IP address and browser of each device you are signed in on; your sites and scan results; waitlist entries; and the hashed IP addresses that count attempts.
Where:
Neon Inc., with the database in Frankfurt, Germany.

Resend

What it does:
Sends the emails from Glitchmark, such as the link that confirms your email address or resets your password.
What it receives:
Your name, your email address and the email we send you.
Where:
Resend, United States.

Hetzner

What it does:
Runs the scanner, which opens the sites you scan in a browser and checks them.
What it receives:
The addresses of the sites you scan, the pages a scan opens, and what the checks find on its way to the database. Not your name or email address.
Where:
Hetzner Online GmbH, with the server in Germany.

Cloudflare R2

What it does:
Keeps the screenshots of scanned pages, and the preview pictures of the sites you add.
What it receives:
The screenshots and preview pictures, which show the scanned pages as anyone visiting them would see them.
Where:
Cloudflare, Inc., United States, with the data usually stored in Western Europe.

Google

What it does:
Signs you in when you choose Continue with Google, instead of a Glitchmark password.
What it receives:
Google learns that you signed in to Glitchmark, only if you choose to. Glitchmark receives your name, email address, profile picture link and Google account ID from it, and keeps them with your account.
Where:
Google LLC, United States.

Paddle

What it does:
Sells the paid plans as the merchant of record: it takes the payment, adds sales tax or VAT where it applies, and sends the receipts.
What it receives:
What you type into its checkout, such as your email address, country and payment details, and which workspace and plan the payment is for. Glitchmark never sees your card number.
Where:
Paddle.com Market Limited, United Kingdom.

Anthropic

What it does:
Looks at screenshots of the pages a scan checks, to find visual bugs such as text running over other text.
What it receives:
The first screen of each page a scan checks, at phone, tablet and laptop sizes, and the page’s address; never your name or email address. Anthropic deletes them within 30 days and doesn’t train its models on them, unless its safety systems flag them as breaking its usage policy, when it may keep them for up to 2 years.
Where:
Anthropic PBC, United States.

How long we keep it

  • Request logs are kept by our host for a short time, under its own policy.
  • Your account, sign-ins, sites and scans are kept while your account exists. When your account is deleted, we delete your name, email address, password and sign-ins.
  • The reports of your sites are kept after your account is deleted, without your name or email address. They describe the site, not you, and they show that its free scan was used.
  • Screenshots are deleted 30 days after a scan on the Free plan and 365 days after a scan on a paid plan, whatever your plan is later. The report itself is kept. Preview pictures of a site's home page are deleted after 7 days.
  • Free-scan records are kept, so a site's free scan stays used. The hashed IP address and device identifier in them are deleted after 30 days.
  • Waitlist entries are kept until you ask us to remove yours or delete your account, and deleted 12 months after you join if you have not created an account.
  • Emails are kept until your question is answered, and you can ask us to delete them at any time.

Why we are allowed to

  • Your account, sign-ins, sites, scans and the emails about your account: we need them to give you the service you signed up for.
  • Your waitlist entry: you gave your consent when you joined, and you can take it back at any time by emailing us.
  • Request logs, the abuse-protection counts, the free-scan records, admins viewing reports and keeping reports after an account is deleted: we have a legitimate interest in running a secure service and in stopping abuse of the free plan.
  • Emails you send us: so we can answer them.

Your rights

You can ask us to:

  • show you the data we hold about you, or send you a copy;
  • correct it, or delete it and your account;
  • stop using it.

Email support@getglitchmark.com and we will answer within 30 days. You can also complain to the data protection authority where you live.

You can also change your name and password, or delete your account, yourself in your account's settings.

Children

Glitchmark is for people aged 18 or older. We do not knowingly collect data about children.

When this page changes

Before Glitchmark collects anything new or uses a new service, this page will say what is collected, why, and which service receives it, and the date at the top will change.