Privacy Policy

1. What we collect

Account data. When you sign in with Google or GitHub we receive your name, email address, and avatar. We never see your password.

Job data. We store the URLs you submit, job metadata (status, dimensions, format, timing, errors), and the generated screenshot images.

Usage data. Request logs (endpoint, method, response code, latency, timestamp) for the captures run on your account, and a record of each action you take in the dashboard. We do not record an IP address against these.

Sign-in records. Each sign-in session stores the IP address and browser user agent it was created from. See retention below — we do not currently delete these.

Payment data. Your card details go to PayPal and never reach us. What we do store is the transaction reference, pack, amount and status, plus PayPal's own responses to the order and the payment kept whole — and those responses carry the payer details PayPal attaches to them, including the name and email address on your PayPal account. Verified PayPal webhooks are stored whole for the same reason.

2. How we use it

To run the service (capture, store, and serve screenshots), to bill credits, to prevent abuse and enforce rate limits, and to answer support requests. We do not sell personal data and we do not use it for advertising.

3. Retention

Screenshot images. Deleted after the service's retention window, 14 days at present. After that the job reports image_expired and the image URL stops resolving, so copy anything you need to keep into your own storage. You can also delete a screenshot yourself before then, from the dashboard, which removes the image immediately.

Job records. Deleting a screenshot — by your hand or by the 14-day sweep — removes the image file, not the record of the job. The URL you submitted, the status, timing, and size are kept as the record of what ran and what it cost.

Request logs and sign-in records. Kept indefinitely at present. We have not yet built the job that prunes them, and we would rather say that than name a retention window we do not enforce.

Payment records. Kept as long as required for accounting.

4. Sharing

We share data with the processors needed to run the service: our hosting provider (VPS infrastructure), PayPal for payments, and Google or GitHub for sign-in — whichever you use is handed an authentication request every time you sign in, and there is no other way to sign in. Each processes data under its own contractual terms. We disclose data to authorities only when legally required. That is the list of processors we hold a contract with; it is not the list of everyone who sees a capture while it is happening. Section 5 covers the rest.

5. How captures reach the page

Every capture leaves through the Tor network. We never fetch a target page directly from our own network. Each capture is routed out through an anonymising proxy, and that proxy is mandatory: if it is unavailable the capture fails rather than going out unproxied. So the URL you submit and the page we fetch travel through volunteer-operated Tor relays and leave at a third party's exit node — one we do not operate, vet, or hold any contract with. When a target cannot be reached over Tor, retries may instead be routed through a pool of public proxy servers, which are outside our control in the same way.

What the exit operator can see. For an https:// target, the exit operator sees which host was asked for but not the contents of the page. For an http:// target — which the service accepts — the exit operator sees the full request and the full response in plaintext: the path, any query string, and the page itself.

What that means for what you submit. Prefer https://. Do not submit URLs carrying credentials, session tokens, signed one-time links, or anything else that would be damaging in a stranger's hands, and do not assume a page reachable only by such a link stays private because the link is obscure.

6. Cookies

We set two strictly necessary cookies, both for signing you in — no advertising or cross-site tracking. Your theme preference is kept in your browser's local storage rather than in a cookie. See the Cookie Policy.

7. Security

Public traffic to previewapi.dev and api.previewapi.dev reaches us through a Cloudflare tunnel, which terminates TLS; the origin server is not exposed to the internet directly. Traffic between our own components on the private capture network is not encrypted, and the egress path is covered in section 5. API keys are stored as HMAC-SHA256 hashes under a server-side secret that is never in the database, and the full key is shown only once at creation.

Screenshot URLs are unguessable, not access-controlled. A stored image is served from a URL containing a random token, and that token is the whole of the protection — image delivery carries no per-request authorisation, so it is not checked against your account. Anyone holding the URL can fetch the image for as long as it is retained. Treat a screenshot URL as a secret. We do not claim more than this here — where a control is not something we could evidence on request, we have left it out rather than describe it.

8. Your rights

What you can do yourself. The dashboard shows most of what we hold on you: your jobs and their screenshots, your API keys, your usage, and your credit history. You can delete any screenshot, and revoke any API key, from the dashboard at any time.

What the dashboard does not show. It is not a complete view. It does not show the IP address and browser user agent recorded against each sign-in session, the responses PayPal returns for your orders and payments (which carry the name and email address on your PayPal account), or the administrative records written when we act on your account. Email [email protected] and we will send you any of those.

What came from your provider. Your name, email, and avatar were taken from Google or GitHub the first time you signed in, and are not refreshed afterwards. Changing them at Google or GitHub will not change them here — email us and we will correct the record.

What to ask us for. There is no self-serve export and no self-serve account deletion yet — the delete button in Settings is deliberately disabled rather than pretending otherwise. Email [email protected] for either and we will do it by hand. Deleting your account removes your jobs, screenshots, keys, and remaining credits.

9. Contact

Privacy questions: [email protected].