What we collect, and what we do not.

Creating an account stores your name, your email address and a one-way hash of your password, never the password itself. If you sign in with Google we store the same name and email address, plus the tokens Google issues so the connection keeps working; we never receive your Google password and ask Google for nothing beyond your name, email address and profile picture.

Alongside that we keep what your account is entitled to: which plan you are on, when it runs out, and how many scans, teardowns and reports you have used. That is the whole reason accounts exist , before them, the count lived in your browser and vanished with your cache.

We do not store the pages you scanned against your account. The record described in section 03 is kept separately, for takedown notices, and is not joined to your account.

Sessions are kept in a cookie that is signed, HTTP-only, and expires after thirty days. There is no advertising cookie, no tracking pixel, and nothing about you is sold to anyone. You can ask us to delete the account and everything in it at any time, see section 07.

We use PostHog for product analytics: pages visited, buttons pressed, and session replays showing how the interface behaved. A replay captures the pagehaul interface as you saw it, including the results of a scan on your screen. We use this to find what is broken and what is confusing, and for nothing else.

Beyond that, your browser keeps your theme choice, your recent scans and any teardown notes you are part-way through writing, all in local storage on your own device. You can clear them at any time. What you have left is no longer kept there, it lives on your account, which is the point of having one.

When you scan a page, the address you enter is sent to our server so it can be fetched. We record the submitted address, the time, and the IP address it came from.

There is one reason for this. If a site owner tells us their content was copied through this service, we need to be able to find that request and act on it. Without a record we could not answer a takedown notice, and a service like this one has to be able to.

These records are kept for no longer than 90 days and are not used for profiling, advertising or resale.

To enforce the free plan’s scan allowance, the server also keeps a short-lived count of deep scans per hashed network address. It holds a one-way hash rather than the address itself, lives in memory only, and is gone within days.

A purchase asks for your email address. It is used for exactly three things: sending your receipt and license, matching a payment to you if something goes wrong, and restoring a license your browser lost. It is embedded in the license itself and appears in the payment notification we receive.

Payments are processed by Dodo Payments, the merchant of record. We never see or store card numbers or bank details; their checkout handles all of that. What we keep is the payment reference, the plan, the amount and your email, for as long as needed to honour the purchase and answer disputes.

Files travel from the site you named to your browser; they are never stored with us. When you download an archive, your own browser builds it on your own device. Scan results live in your browser and expire there after 7 minutes.

We do not read, index, analyse or retain the contents of what you capture, and there is nothing to delete on our side, because no copy of anyone’s site ever exists in our systems.

The site is hosted on Vercel, analytics is processed by PostHog, payments are processed by Dodo Payments, and email, receipts, unlock links and feedback, is sent through Gmail. Each processes requests on our behalf and will see the usual technical information any web request carries, including IP address, as part of serving and protecting the service.

When you scan a page, your browser and our server both make requests to that site. It will see those requests in its own logs, in the ordinary way any visit is logged. That is outside our control.

You can ask what we hold about a request, ask for it to be deleted, or object to us holding it. Write to pagehaul.contact@gmail.com.

For anything held against your account, signing in and asking is enough. For the takedown records in section 03, which are not joined to any account, we will usually need the address you scanned and roughly when, in order to find the record at all.

Deleting your account removes your name, email address, password hash and usage counters. A paid plan is deleted with it, so if you have time left on one, tell us and we will sort that out first.

If this policy changes in a way that affects what we collect, the date at the top will change and the previous wording will no longer apply. There is no mailing list; we email about your account and your purchases, and nothing else.