Limited Use
Sitepeel’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Use of information received through the extension also adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. We use this information only to provide or improve the user-facing features described here, not for advertising, sale to data brokers, or credit decisions.
Account security
We use Cloudflare Turnstile to limit automated signup, sign-in, password resets and form spam. It processes browser and network signals for this security check. We block known disposable email domains and apply rate limits. Email verification and password-reset codes contain six digits, are single-use and expire after ten minutes. Enter the code in the Sitepeel form where you requested it. Authentication emails are delivered through Resend. Sitepeel does not store plaintext passwords or put account passwords in extension content scripts.
What Sitepeel does
Sitepeel provides browser tools for inspecting and extracting website design details. This policy explains the information used by the extension, this website, account services, payments, and transactional email. Contact support@sitepeel.dev for privacy questions.
Sign-in and your account
Sign in with Google or a verified email address and password. Google sign-in requests basic OpenID, email and profile scopes; we do not receive your Google password, Gmail messages, contacts, or Drive files. Supabase Auth manages Google and email/password sign-in and securely hashes passwords. Google may provide your display name and profile image to Supabase. Sitepeel stores provider identifiers, your verified email address, account creation and trial activation times, and access status. Google and email sign-in using the same verified address share an account. Gmail aliases are normalized to prevent repeat trials.
What happens on a website
The extension opens when you click its icon. Inspection, measurements, edits, font previews, page snapshots, and asset collection run in your browser. We do not automatically collect your browsing history or scan other tabs. Some previews and downloads request fonts or media from their original hosts.
Tool usage counts
When you are signed in, the extension records which Sitepeel tool you open and how many times each day, linked to your account. We use these counts to improve Sitepeel and to show you what you used. They never include page URLs, page content, exports or screenshots. The extension also keeps these counts on your device. In Firefox, counts are sent only if you allow technical and interaction data.
Website demo
The homepage tools can be tried without signing in. Their inspection, exports, design prompts and Design MD run locally in your browser. An optional AI request is sent directly to the provider you configure. The demo does not start a trial or change your extension access.
Free website tools
The free tools (the DESIGN.md generator and the AI slop checker, asset extractor, responsive checker, mockup studio, font finder, color palette and built-with tools) load the public address you enter on Sitepeel’s servers, hosted by Cloudflare. DESIGN.md results are stored with the address, a screenshot of the first screen and the measurements; if “Show it in the public gallery” is on, anyone can see and like them, otherwise they stay unlisted but reachable by their link. Font, color and stack checks are kept for 24 hours so repeat checks are fast. Screenshots and responsive checks are sent straight to you and not stored. Font previews load from Google Fonts or from the website you checked. We keep a one-way hash of your network address to limit use, count likes and handle reports. To remove a page from the gallery, use the contact form.
Local generation and earlier versions
In extension version 1.0.3 and later, element picking, code exports, extracted design prompts and Design MD run on your device. These actions do not send captured page URLs, titles, text, HTML, CSS or design measurements to Sitepeel. Sign-in, purchases and periodic license checks still contact our account service; license checks send account credentials and a random verification challenge, not page content. Earlier extension versions send the capture needed for a prompt or Design MD request to our HTTPS service. Those earlier captures are processed in memory and are not saved in our account database or intentionally included in application logs. Optional provider mode is described separately below.
Optional AI providers
AI is optional. If you connect a provider, your API key is stored on your device and sent directly to the provider you select. In the website tools, these settings are stored for that browser tab. Sitepeel does not receive your provider key. The provider receives the design information needed for your prompt and handles it under its own policies. Any provider usage charges are separate from Sitepeel.
Payments
Dodo Payments is our merchant of record and handles checkout, payment details, tax, and receipts. Sitepeel stores order and payment identifiers, the purchased product, quoted price and currency, regional billing country when applicable, payment status, and the policy version accepted at checkout. We do not store your full card number or security code. See Dodo Payments’ Privacy Policy.
Product videos
Our walkthroughs use Wistia and YouTube players. Their services receive the connection information needed to deliver a video, including your IP address. We enable Wistia privacy mode and use YouTube’s privacy-enhanced embed. Short tool demonstrations are hosted on sitepeel.dev. See Wistia privacy and Google privacy.
Transactional emails
Resend sends account and purchase notifications on our behalf, using your account email address. We disable open and click tracking for these emails. They contain account and service information, not a newsletter subscription. Replies go to support@sitepeel.dev. See Resend’s Privacy Policy.
Uninstall feedback
After removal, your browser opens an optional feedback page. We only collect feedback when you submit it. Your message and optional reply email are stored privately in Cloudflare and sent to support@sitepeel.dev through Resend so we can improve Sitepeel and respond. We do not attach your Google account, browsing history, or extension identifiers. The page has no analytics or session recording. Turnstile checks for automated submissions. Short-lived hashes of the connection IP and reply email limit spam. Suspected sales pitches are retained for review without being emailed to support. Feedback and support emails are retained for product improvement and support; contact support@sitepeel.dev to request deletion.
Cookies, local storage, and security
Essential, secure cookies keep you signed in on the website. The extension stores session credentials in storage restricted to its trusted extension context. We use server-side account records to enforce the 24-hour trial and paid access. Short-lived session tokens, payment verification, and rate limits help protect the service. Infrastructure providers process connection information such as IP addresses; Sitepeel uses hashed IP-based rate-limit records with short retention. No advertising cookies are required.
Website analytics and recordings
When analytics are enabled, DataFast and PostHog measure public page visits, referral sources, button clicks, pricing views and engagement, tool actions, signup and sign-in steps, trial activation, checkout starts, and errors. Signed-in website activity can be linked across visits with a stable pseudonymous account reference and access status; we do not send your account email or name. Anonymous visitors remain identified by their browser. Dodo Payments sends DataFast attributed payment identifiers, amounts, currencies and visitor identifiers. Verified, tracked checkout purchases also appear in PostHog, with amount and currency; checkout clicks are counted separately from payments. PostHog records masked website interactions, click and scroll heatmaps, and page performance. Forms, account and tool panels, entered or edited text, generated code and prompts, and sign-in pages are excluded from recordings. Error reports contain error categories, sanitized source locations and response status codes, never passwords, verification codes, form contents, provider keys or response bodies. Console and network-body recording remain disabled. Analytics apply to sitepeel.dev, not to other websites used with the installed extension. PostHog has IP anonymization enabled.
Crawler analytics
We use DataFast server-side tracking to understand how AI and search crawlers access public pages. Recognized crawler requests may share their user agent, IP address, public path and response status for crawler verification. Query strings, account pages, sign-in routes, API routes and extension tool pages are excluded. This tracking does not collect normal browser visits.
Google Analytics
When analytics are enabled, Google Analytics measures page visits, traffic sources, engagement and selected tool actions. We disable Google signals and advertising personalization, and do not send account identifiers, API keys or generated prompts. Marketing campaign parameters may be included; authentication and credential parameters are excluded. See Google privacy.
Your analytics choice
Website analytics, masked recordings and Google Analytics are enabled by default on supported pages. No privacy popup opens automatically. You can turn analytics off or enable them using Privacy choices in the footer. We respect saved opt-outs, including an earlier basic-only choice, and browser Do Not Track and Global Privacy Control signals. Your explicit choice is saved on this browser for 180 days; a default-enabled visit is not stored as an explicit consent choice. Turning analytics off stops future browser collection, removes analytics identifiers on this site and reloads the page to unload the trackers. It does not automatically delete previously collected data. Ad blockers may also prevent collection. Contact support@sitepeel.dev for deletion requests. PostHog recordings are retained for 30 days. Analytics services process data under their own retention policies; our PostHog project is hosted in the US. See PostHog privacy and DataFast privacy.
Contact messages
When you send our contact form, your name, reply email, optional subject and message are stored privately in Cloudflare and forwarded to support@sitepeel.dev through Resend. We use this information to respond and provide support. We do not attach a Google account or browsing history, and the contact page has no analytics or session recording. Messages are retained for support; contact support@sitepeel.dev to request deletion. Turnstile checks for automated submissions. Short-lived IP and reply-email hashes limit spam. Suspected sales pitches are retained for review without being emailed to support.
Retention and deletion
Account and entitlement records are kept while your account or purchase remains active. Session credentials expire and temporary sign-in records are removed regularly. Rate-limit records are short-lived. Payment records may need to be retained for accounting, fraud prevention, disputes, or legal obligations. Contact support@sitepeel.dev from your account email to request access, correction, or deletion. Where needed to prevent repeat trials, we may retain a minimal trial-history record rather than restart a used trial.
Service providers and your rights
Google, Supabase, Cloudflare, Dodo Payments, and Resend provide identity, authentication, hosting, payment, and email services. DataFast and PostHog provide optional website analytics. They may process information outside your country. We do not sell your personal information. Depending on where you live, you may have rights to access, correct, delete, or object to processing of your information, and to complain to your privacy regulator. We will assess requests under the applicable rules.
Changes
We may update this policy when the service changes. The date at the top identifies the current policy; material account-related changes may also be communicated by email.