Privacy policy

Last updated: 2026-10-29

TightBucket ("we") runs tightbucket.com. This policy explains what we collect, why, and your choices. Questions: tafadzwamchikanya@gmail.com.

What we collect

• Audits: the website address you submit, the public data we read from it (page content, PageSpeed metrics, public DNS records) and the resulting report. Reports are public at an unguessable link and marked noindex.
• Rate limiting: your IP address, used only as a daily counter key to stop abuse. Counters are deleted after 35 days.
• Email address: only if you give it to us (to receive a report, monitoring alerts or a reply). We use it for what you asked for, plus occasional related tips. Every marketing email has a one-click unsubscribe.
• Account data: if you join via Whop, we receive your Whop user ID, name, email and plan to provide the service.
• Business contact data: to offer audits to businesses, we may process publicly available work contact details (name, role, work email) under legitimate interest. You can object at any time, and we'll stop and suppress you.
• Analytics: cookieless Cloudflare Web Analytics (no personal profiles, no cross-site tracking). We set no advertising cookies.

Browser-only tools

The graders, CSV tools and calculators run entirely in your browser. Files and text you paste are not uploaded, unless you click an "AI suggestion" button, which sends only that text to generate the suggestion. It isn't stored.

Processors we use

• Cloudflare (hosting, database, analytics, AI inference)
• Google (Gmail for sending email, PageSpeed Insights, Gemini as an AI fallback)
• Whop (checkout, billing, membership)
• Hunter.io (business email lookup for outreach, if used)
• LinkedIn (publishing our own posts)

Retention

Reports: 24 months, then deleted unless you're monitoring the site. Email and contact records: until you unsubscribe or ask for deletion (we keep a suppression entry so we never email you again). Payment records: as required by tax law, held by Whop.

Your rights

You can ask for access, correction, deletion or a copy of your data, or object to processing. Every email has a delete my data link; or email tafadzwamchikanya@gmail.com, and we'll respond within 30 days. If you're in the EU/UK you can complain to your data protection authority.

Security

Data is encrypted in transit, admin access requires single sign-on, and webhook and API traffic is signed and verified.

Changes

We'll update the date above and, for material changes, email active users.