Privacy
Last updated 1 September 2026.
draft
A working draft, not reviewed by a lawyer. Every retention window below is the one the code actually enforces.
What we do not collect
Worth saying first, because it is unusual. Sloptic runs no analytics, no advertising, and no third party scripts. There is no tracking pixel and no session recorder. Fonts are served from our own domain, so visiting the site makes no request to anyone else. We do not sell or share personal data.
What we store
| what | why | how long |
|---|---|---|
| the URL you submit | to grade it, and to show you the result | kept |
| the report | the findings, measurements, and score | 30 days, or kept if an account saves it |
| a hash of your IP address | rate limiting and abuse | 2 days |
| your email address | only if you make an account, to sign you in | until you delete the account |
| verification records | proof you control a domain or event, and when we checked | until the grant expires or is revoked |
We keep the fact that a grade ran, its score and its timestamps, after the report itself is deleted. That is what rate limiting, abuse investigation and population statistics need, and none of them need the finding list.
Sign in is by emailed link, so we never receive or store a password. If you sign in with Google or GitHub we receive your email address from them and nothing else.
Cookies
One kind: the session cookie that keeps you signed in. There are no advertising or analytics cookies. Signing out clears it. Your browser also keeps a local list of grades you ran, which stays in your browser, is never sent to us, and is cleared with your site data.
Who else processes it
- Supabasethe database and the sign in service, which holds accounts and grades.
- Vercelhosting for the website, which sees ordinary web request logs.
- our own hardwarethe grader runs on a machine we operate, so the traffic that reaches a graded app comes from us.
If your app was graded and you did not ask
Anyone can run a passive grade on a public URL, so a report may exist about an app you built without your involvement. It contains observations about the app. You can delete it yourself using its link, or write to hello@sloptic.org. We will remove it, and you do not need an account or a reason.
Your choices
Delete any report using its link. Ask us to delete your account and everything attached to it. Ask what we hold about you. One address for all of it: hello@sloptic.org.