Privacy policy

• Your account: your name, email address, and password (stored only as a hash), or your GitHub or Google profile if you sign in with one. For each signed-in session we keep its IP address and browser.
• What you ask it to do: start addresses, goals, names, collections, schedules, and settings for your journeys, audits, and scorecards.
• What runs capture: screenshots, videos, page text and structure, accessibility and style findings, and PDF reports of the websites you point it at. These come from those websites, not from you, but they're stored in your account.
• Sign-in details for your own site (Team plans): stored encrypted, used only by the browser that runs your journey, and never shown back to anyone, written to logs, or sent to the AI model.
• Billing: our payment provider handles your card and billing address; we keep only your plan, its status and renewal date, and the provider's customer ID.
• Usage: pages you view, features you use, errors, and your browser, device, and approximate location (from your IP address), so we can see what works and fix what breaks.
• Email: which emails we sent you, and your email preferences.
• Access keys for AI assistants: stored only as a hash, with when each was last used.

• To run the service: browse the sites you choose, judge each screen, store the results, and show them to you.
• To send the emails the service needs (sign-up, password resets, plan changes) and the ones you can switch off (run results, change alerts, tips).
• To bill you for a paid plan and apply its limits.
• To keep the service secure: rate limits, abuse prevention, and fixing errors.
• To understand how the product is used so we can improve it.

Only with the companies that help us run FreshVisit, each for its own part of the job:

• Hosting and database (Railway).
• Background jobs that run the browser (Trigger.dev).
• Image, video, and file storage (Cloudinary).
• An AI model provider, which receives your goal and the text and structure of each page a journey visits, to decide where to click. It does not receive your account details or your sign-in details for your site.
• Email delivery (Resend).
• Payments (Polar, which sells paid plans as the merchant of record and has its own privacy policy for what it collects at checkout).
• Product analytics and error tracking (PostHog).
• GitHub or Google, if you choose to sign in with them.

Some things you share yourself: a share link shows that journey, audit, or scorecard to anyone who has the link, and everyone in a team workspace sees the workspace's work. We may also disclose information when the law requires it, or to protect the service and its users.

We use a cookie to keep you signed in, and a few more to remember your theme, your sidebar, and your time zone. Our analytics keeps an identifier in your browser so visits can be counted. We don't use advertising cookies or let other companies track you on our pages.

We keep your data while your account is open. When you delete something it disappears from your account at once (Undo can bring it back). When you delete your account, we delete it and its journeys, audits, and scorecards from our database, and cancel any subscription. Work you made in someone else's workspace stays with that workspace. Screenshots, videos, and PDFs in our file storage, and copies in backups, can outlast that for a while; email us and we'll remove the files. Our payment provider keeps billing records as the law requires.

You can change your name and email preferences in Settings, unsubscribe from any optional email with its link, and delete your account there too. To see, correct, or get a copy of your data, or to object to how we use it, email help@contact.freshvisit.app. We answer within 30 days. Depending on where you live, you may also have the right to complain to a data protection authority.

Connections are encrypted, passwords and access keys are stored only as hashes, and sign-in details for your site are encrypted. No service is perfectly secure; if something goes wrong that affects your data, we'll tell you.

FreshVisit is run from the United States, and your data is processed there and wherever our providers operate.

FreshVisit isn't meant for anyone under 16, and we don't knowingly collect their data.

If we change this policy in a way that matters, we'll update the date above and tell signed-up users by email. Questions or requests: help@contact.freshvisit.app.