Privacy

Reports. The URL you entered, the final URL, the response headers, the page’s HTML-derived findings, a screenshot, and the speed measurements. Reports are public to anyone who has the link, carry a noindex tag so search engines do not list them, and are kept for 12 months. Raw Lighthouse data is kept 30 days.

Your connection. To enforce fair-use limits we keep a salted hash of your IP address for 24 hours. The raw address is not stored with a report.

Feedback. A thumbs up or down on a finding stores the vote and the check id, nothing that identifies you.

Site search. When a search on getreport.app finds nothing, we count the words you searched for, lowercased and cut to 60 characters, so we know which guides to write. We keep only the count per search, with no IP address or anything else about you, and we drop searches that look like an email, a web address or a long number.

Email. Only if you set up monitoring or alerts. The address is encrypted at rest and hashed for lookup, and every mail carries a one-click unsubscribe and delete link. Monitoring is not live yet.

Domain verification. Proving you own a site needs no email and no account: you publish a token as a DNS record, a meta tag or a file, and we check it. We store the domain, its token, when it was verified and its settings (such as whether search engines may index its reports). Nothing about you.

Donations. The amount, the date, the platform and, if you chose to be listed, the name you gave. We never see or store card details. A salted hash lets us count you once on the supporters wall.

• No cookies unless you accept analytics (see below), with one exception: when you verify a domain, this browser gets a strictly necessary cookie (gr_owner, 12 months) that proves it checked the record, so you can change that domain’s settings. It holds the domain, an expiry date and our signature, nothing about you, and is set only when you verify. Your browser also keeps a few preferences (your cookie choice, a dismissed banner, feedback given) in its own storage, which never leaves your device.
• No advertising scripts, and no advertising use of analytics data.
• No selling, sharing or profiling. Sponsors get a logo placement, not data.
• No fetching of anything except the public page you asked us to check and the standard files around it (robots.txt, sitemap, favicon, security.txt).

Always: Plausible. A self-hosted, cookie-free counter of page views and clicks (which tool, which button). It stores no personal data and needs no consent.

Only if you accept: Google Analytics. The first time you visit we ask. If you accept, Google Tag Manager loads Google Analytics, which sets two cookies (_ga and _ga_…, up to 2 years) to tell a returning browser from a new one. Advertising features stay off. If you reject, nothing from Google loads and no cookie is set. The site works the same either way.

What Google gets. The page path without anything after the?, the page title (on reports a generic one), where you came from (only the site, not the page) and which feature you used, such as “speed test finished”. Google never gets the address you check, your email or anything else you type: our code removes them from every request to Google before it leaves your browser.

Changing your mind. Use “Cookie settings” at the bottom of any page. Rejecting later deletes the Google Analytics cookies.

Under the GDPR you can ask what we hold about you, have it corrected or deleted. For reports: if you own the checked site, you can verify the domain with a DNS record, a meta tag or a file, no email needed. Deleting its reports from the domain page comes next; until then, write to us after verifying and we delete them. For emails: every mail has a delete link. For anything else: hello@getreport.app. We answer within 30 days, usually within a few.

The controller is the operator of getreport.app, reachable at the same address. You can also complain to your national data protection authority; in Croatia that is AZOP.

This page changes when the service does; the date at the top and the changelog record it.