Privacy
Last updated 1 September 2026.
draft
A working draft, not reviewed by a lawyer. Every retention window below is the one the code enforces.
What we do not collect
Worth saying first, because it is unusual. Sloptic runs no advertising, no tracking pixels, and no session recorder. Your browser talks to two places besides us: our database and sign-in provider when you sign in, and Google or GitHub if you pick one of those to sign in with. Both are listed below. The only measurement we take is analytics on our own domain: page paths, referrers, country, and device class, counted cookielessly by our host with no fingerprinting, no cross-site tracking, and no IP storage. The URL you submit never appears in analytics. We do not sell or share personal data.
What we store
- the URL you submit
- to grade it, and to show you the result
- how longkept
- the report
- the findings, measurements, and score
- how long30 days, or kept if an account saves it
- a hash of your IP address
- rate limiting and abuse
- how long2 days
- page views and a few product events (a grade submitted, a grade finished)
- knowing what is used, and what kinds of people use Sloptic
- how longheld by Vercel, aggregated, cookieless: no cookies, no IP storage, no cross-site tracking
- your email address
- only if you make an account, to sign you in
- how longuntil you delete the account
- verification records
- proof you control a domain or event, and when we checked
- how longuntil the grant expires or is revoked
We keep the fact that a grade ran, its score and its timestamps, after the report itself is deleted. That is what rate limiting, abuse investigation and population statistics need, and none of them need the finding list.
Sign in is by emailed link, so we never receive or store a password. If you sign in with Google or GitHub we receive your email address from them and nothing else.
Cookies
Only the session cookie that keeps you signed in. There are no advertising cookies, and the analytics is cookieless. Signing out clears it, and the local list below with it. Your browser also keeps a list of grades you ran, so you can find them again without an account. It lives in your browser and is cleared with your site data. When you open your grades we send those ids back to look them up, which is the only way to show you their scores; we issued them, and we do not learn anything new from it.
Who else processes it
- Supabasethe database and the sign in service, which holds accounts and grades.
- Vercelhosting for the website, and the cookieless page analytics: paths, referrers, country, device class, and a few product events. No cookies, no IP storage, no cross-site tracking.
- Resendthe service that delivers our email: your sign-in links, and the message telling you a grade finished. It receives your address and what the message says.
- Zohothe mailbox behind hello@sloptic.org, so anything you email us is held there.
- our own hardwarethe grader runs on a machine we operate, so the traffic that reaches a graded app comes from us.
If your app was graded and you did not ask
Anyone can run a passive grade on a public URL, so a report may exist about an app you built without your involvement. It contains observations about the app. You can delete it yourself using its link, or write to hello@sloptic.org. We will remove it, and you do not need an account or a reason.
Your choices
Delete any report using its link. Ask us to delete your account and everything attached to it. Ask what we hold about you. The address for all of it: hello@sloptic.org.