Privacy Policy

WebDiff ("WebDiff", "we", "us") is operated by [COMPANY LEGAL NAME], registered at [COMPANY REGISTERED ADDRESS]. This policy explains what personal data we collect through webdiff.app (the "Service"), why we collect it, and the choices you have.

For privacy questions or to exercise the rights described below, contact us at [CONTACT EMAIL]. [LEGAL REVIEW REQUIRED — confirm the correct entity name and jurisdiction before publishing.]

Account information. When you sign up, we collect your name and email address, either directly (email/password) or through Google Sign-In, via our authentication provider (Better Auth).

Comparison and monitoring data. The URLs you submit to compare or monitor, the configuration options you choose (viewport, capture defaults), and the resulting screenshots, extracted page text, and structured change data we generate from them.

Usage and device data. Your IP address (used for anonymous rate-limiting and security logs), browser and device information, and timestamps of requests.

Payment status. If you upgrade to Premium, Dodo Payments processes your payment details directly — we never see or store your card number. We receive and store your subscription status (active, cancelled, etc.) and a Dodo customer reference ID.

We do not knowingly collect any special or sensitive categories of data, and the Service is not designed to receive them — please don't submit URLs whose content includes sensitive personal data about others.

• Directly from you — account creation, comparison requests, monitor configuration, support messages.
• Automatically — IP address, request metadata, and error logs collected as you use the Service.
• From third parties — Google (if you sign in with Google), Dodo Payments (subscription and payment status).

• To provide the Service — run comparisons, capture pages, execute scheduled monitors, and show you the results.
• To operate your account — authentication, session management, enforcing plan limits.
• To bill you — process and manage Premium subscriptions through Dodo Payments.
• To send Service communications — password resets, billing receipts, and (Premium) email alerts when a monitored page changes.
• To keep the Service secure — rate-limiting, abuse prevention, debugging.
• To improve the product — understanding aggregate usage patterns, never by reading the specific pages you compare beyond what's needed to generate your results.

We process account and billing data to perform our contract with you (providing the Service you signed up for). We process usage and security data (like IP address for rate-limiting) under our legitimate interest in keeping the Service reliable and abuse-free. Where we send optional communications, we rely on your consent, which you can withdraw at any time. [LEGAL REVIEW REQUIRED — confirm legal-basis mapping against final data flows.]

We don't sell your data. We share it only with the service providers ("sub-processors") that operate the Service, each bound to use it solely to provide their service to us:

• Dodo Payments — billing, checkout, and subscription management.
• Neon (Postgres) — primary database hosting.
• Browserless — headless-browser page capture; receives the URLs you submit in order to load and screenshot them.
• Cloudflare R2 — storage for screenshots and captured page assets.
• Vercel — application hosting and scheduled task execution.
• Better Auth — authentication and session cookie management.
• Anthropic (Claude API) — Premium only. If you're on Premium and this feature is enabled, the text of detected changes is sent to Anthropic's API to generate an editorial summary.
• Resend — Premium only. If you're on Premium and this feature is enabled, used to deliver email change-alert notifications.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, and property of WebDiff and our users.

Our sub-processors may store or process data outside your country of residence, including in the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses. [LEGAL REVIEW REQUIRED — confirm each sub-processor's transfer mechanism and hosting regions.]

• Account data — kept while your account is active, deleted within 30 days of account deletion.
• Comparisons and snapshots — kept until you delete them or your account, subject to plan limits.
• Monitor history — kept while the monitor is active; deleting a monitor deletes its associated snapshots.
• Server and security logs — retained for a limited operational period, typically no longer than 90 days.
• Billing records — retained as required by tax and accounting law after subscription cancellation.

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to lodge a complaint with your local data protection authority.

You can access and export your comparison and snapshot data directly from your account. For account deletion or any other request, email [CONTACT EMAIL] — we'll respond within the timeframe required by applicable law (typically 30 days).

California residents: you have rights under the CCPA/CPRA, including the right to know what personal information we collect and to request its deletion. We do not sell or share personal information for cross-context behavioral advertising.

We use a minimal set of cookies: a session cookie (from Better Auth) required to keep you signed in, and no third-party advertising or analytics cookies at this time. Because these cookies are strictly necessary for the Service to function, we don't currently show a cookie banner. If that changes, we'll update this policy and add a consent mechanism where required.

We use industry-standard measures to protect your data, including encryption in transit (TLS), hashed credentials, and access controls limiting who can reach production systems. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

The Service is not directed at children under 16, and we don't knowingly collect personal data from them. If you believe a child has provided us data, contact [CONTACT EMAIL] and we'll delete it.

We may update this policy as the Service evolves. If a change is material, we'll notify you by email or an in-app notice before it takes effect. The "Last updated" date at the top always reflects the current version.

Questions, requests, or complaints about this policy or our data practices: [CONTACT EMAIL], [COMPANY LEGAL NAME], [COMPANY REGISTERED ADDRESS].