Data and privacy

Data used

When you run an audit, your browser sends the page address, the chosen device (mobile, desktop or both) and the report language to the WebCheck server. The server validates the request, then sends the URL to Google PageSpeed Insights, which runs the Lighthouse checks.

The full address can include a path and parameters after the question mark. Avoid URLs containing personal data or secrets. WebCheck removes parameters and the fragment from the address shown in the report, but this does not remove them from the request sent to Google.

Results and retention

• There is no account and no WebCheck database holding your reports.
• If you click “Save on this device”, up to five reports are stored in this browser’s local storage, for the current WebCheck address. This does not send the report back to the server and is not synced across your devices.
• Comparing two saved reports happens in your browser; the selected reports are not sent to the server.
• You can delete one report or the whole history from the audit page. Clearing your browser data also deletes these saves.
• Storage is tied to the site address. A change of domain does not carry these reports over automatically.
• The optional “Prepared by” and “For” fields stay in the open page. WebCheck does not send them with the audit and does not write them to the local history or to its server. They are added to the PDF or the copied summary only if you ask.
• A successful result may be kept in a temporary Cloudflare cache for 15 minutes to avoid running the same audit again straight away.
• The PDF is produced by your browser’s print function; WebCheck does not receive the file.
• The site currently has no advertising and no audience measurement tool. Fonts are hosted on the WebCheck site itself.

A locally saved report contains the displayed public address (without parameters or fragment), the chosen device, the scores and the findings. Other people using the same browser profile can also see these saves.

Cloudflare provides hosting and runs the service. Google provides the PageSpeed analysis. These providers may process technical data needed for their own services; their own terms also apply.

To protect the service, each IP address is limited to 20 analyses per hour. The counter uses a fingerprint of the IP address (a one-way hash), not the address itself, and is deleted automatically after two hours at most.

To limit abuse, the Cloudflare Turnstile check loads when you start typing an address in the audit form. The server verifies its token with Cloudflare before calling PageSpeed Insights.

Accounts

An account is optional. Without one, you can run 3 analyses per day; with a free account, 5 per day.

• Sign-in uses Google. WebCheck receives and keeps only your email address, your name and a technical Google identifier. It never receives your Google password.
• We also keep your plan, the dates of sign-up and last sign-in, your number of analyses per day and an anonymous count of audits (without the audited addresses) for service statistics.
• A session cookie (wc_session, HttpOnly) keeps you signed in for 30 days. It is used only for that purpose.
• You can delete your account at any time from the “My account” page. Your account, sessions and usage are deleted immediately.

With Pro, you can save reports to your account. We then store the audited address (without its parameters), the results, the optional “Prepared by” and “For” names, and your logo if you save one. You can delete a report or the logo at any time; deleting your account deletes them all. A share link makes a report visible to anyone who has the link, until you disable it or delete the report. Shared reports are not indexed by search engines.

Pro subscriptions are sold and charged by Lemon Squeezy, acting as merchant of record (payment, invoices, taxes). WebCheck never receives your card details. We only keep the subscription status, its renewal or end date and the link to your Lemon Squeezy customer portal. The Lemon Squeezy privacy policy applies to the payment.

What you can do

• Only audit public pages you are allowed to submit.
• Remove passwords, tokens, identifiers and private parameters from URLs before running an audit.
• To keep the full diagnosis, use the PDF print after the audit.

Publisher and contact

WebCheck is published by Ahmed. For any question about the service or this page, write to contact@getwebcheck.com.