Privacy Policy

What we store

Your account holds an email address and a password. A website holds the domain, the address, the claims, and the optional display name and description you enter. Nothing else about you is collected. There is no profile, no tracking cookie and no third-party analytics script.

IP addresses

We record the IP address at registration, at every login, when a website is added, when you subscribe to the newsletter and when a report is filed. These exist for abuse handling only and are automatically cleared after 12 months.

What is public

A published profile shows the domain, the website address, the claims, the optional display name and description, and the date the website was added. It never reveals the account behind it: no email address and no list of your other websites. Appearing in the public directory is a setting you control per website.

Email

We send transactional mail only: email verification, password reset, review results, a reply when you use the contact form, a link to confirm your newsletter sign-up,confirmations for things like deleting your account or unsubscribing, and payment confirmations. Reporting a claim never triggers a mail — the address is kept only so we have a contact if needed. The newsletter is a separate opt-in you switch on and off on your settings page, and every newsletter carries an unsubscribe link. Mail is delivered through our mail provider, which processes the recipient address for that purpose only.

Anti-spam

Public forms may be protected by Cloudflare Turnstile, a privacy-friendly alternative to a CAPTCHA. It checks the request, not the person, and sets no advertising cookie.

Payments

Checkout is handled by our payment provider. We store the payment record (amount, date, status and the domain it was for) so we can support you and meet our bookkeeping obligations. Your card details never touch our servers.

Statistics

We count one number: visits, once per session per day. No IP addresses, referrers, user agents or per-visitor rows are stored, and no third-party analytics is used.

Cookies

byhuman.io sets only functional cookies. There are no advertising or analytics cookies, so there is no consent banner.

• Session cookie: keeps you logged in and holds the security token that protects forms. It disappears when you close your browser.
• Remembered email: if you log in, your email address is remembered for up to 30 days so the login form is prefilled next time. Logging out, changing your email or deleting your account clears it.
• Anti-spam: Cloudflare Turnstile may set a short-lived cookie to complete its check.

Deletion

Deleting a website removes its profile and badge endpoint. Deleting your account deletes all its websites. A newsletter subscription survives account deletion, because consent was given for the newsletter and not for the account, so the unsubscribe link stays valid. Payment records are kept as long as tax law requires.

Your rights and questions

You can view, correct and delete your own data from your settings page. For anything else, such as access, objection or a privacy question, use the contact form.