Privacy Policy

Effective Date: March 17, 2026 · Last Updated: March 17, 2026

This Privacy Policy explains how Proof ("Proof," "we," "our," or "us") collects, uses, and discloses information when you use withproof.dev and related services.

1. Information We Collect

We collect the following categories of information:

Account Information

• Email address
• Account identifiers and plan status
• Stripe customer ID (for billing management)

Note: When you make a purchase without an existing account, we automatically create a Proof account using the email address you provide at checkout. You will receive a sign-in link via email to access your account and manage your subscription.

Submitted Testing Data

• URLs/domains you submit for testing
• Optional run settings you provide

Operational and Technical Data

• IP address
• Device/browser metadata
• Request logs, timestamps, and usage metrics

Interaction and Output Data

• Browser interaction traces generated during tests
• Screenshots of tested sites/pages
• QA reports and AI-generated analyses
• Research session inputs and AI-generated focus group insights

Analytics Data

• Site usage analytics collected via Umami (privacy-focused analytics — no tracking cookies, no personal data collection)

2. How We Use Information

We use information to:

• provide, operate, and maintain the Service;
• execute requested test runs, research sessions, and generate reports;
• monitor reliability, prevent abuse, and enforce policies;
• communicate service, support, and billing-related messages;
• improve model prompts, workflows, and product quality;
• comply with legal obligations.

3. Legal Bases (GDPR)

Where GDPR applies, we rely on one or more of the following legal bases:

• Performance of a contract — providing requested testing and reporting;
• Legitimate interests — service security, abuse prevention, quality improvement;
• Consent — where required, e.g., certain cookies or communications;
• Legal obligation — compliance with applicable laws.

4. Cookies and Analytics

We use essential technical cookies/session mechanisms needed to run the Service. We also use Umami analytics to understand aggregate usage and improve performance. Umami is a privacy-focused analytics platform that does not use cookies and does not collect personally identifiable information.

5. Sharing and Third-Party Processors

We do not sell personal information. We may share data with subprocessors that help us operate the Service, including:

• Cloudflare — hosting, edge delivery, security/CDN, and bot protection (Turnstile);
• LLM and AI infrastructure providers — to analyze test artifacts and generate report content;
• Umami — privacy-focused website analytics;
• Stripe — payment processing, subscription management, and billing. When you make a purchase, your email and payment details are processed by Stripe under their privacy policy. We do not store credit card numbers or payment credentials;
• Resend — transactional email delivery (magic link authentication, welcome emails, and report notifications);
• Other operational vendors (e.g., logging) as needed.

We may also disclose data if required by law, legal process, or to protect rights, safety, and platform integrity.

6. Data Retention

We retain data for as long as reasonably necessary for the purposes above, including account operation, support, dispute resolution, and legal compliance.

Default retention targets (subject to change):

• Account and billing records: retained while account is active and as required by law;
• Test artifacts (screenshots, interaction data, reports): retained for service history and product quality, then deleted or de-identified on a rolling basis;
• Security logs: retained for abuse prevention and incident response.

7. De-Identified and Aggregated Data

When you submit a URL for testing, we may collect and retain de-identified, aggregated, or publicly-derived information about the website or domain — such as technology stack, site category, industry classification, security posture, and structural metadata. This information is derived from publicly accessible sources (the website itself) and is not linked to your personal identity.

This data may be retained indefinitely, including after account deletion, as it does not constitute personal data. We use it to improve our service, build market intelligence, and enhance the quality of reports for all users.

8. AI-Generated Content

Proof uses AI models to generate QA reports and research insights. AI personas in our Research product simulate user behavior based on demographic profiles — they do not represent real individuals. We do not use your submitted data to train our own AI models. Data may be processed by third-party AI infrastructure providers under data processing agreements.

9. Data Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect information. All data is transmitted over encrypted connections (TLS/HTTPS) and stored in encrypted-at-rest infrastructure (Cloudflare D1). No method of transmission or storage is 100% secure.

10. Your Rights and Choices

Depending on your location, you may have rights to:

• request access to personal information;
• request correction or deletion;
• object to or restrict certain processing;
• request portability (where applicable);
• opt out of certain communications.

To make a request, contact hello@withproof.dev. We may need to verify identity before processing requests.

11. CCPA/CPRA Notice (California)

If you are a California resident, you may have rights under CCPA/CPRA, including the right to know, delete, correct, and limit certain uses of sensitive personal information (if applicable). Proof does not sell personal information and does not share personal information for cross-context behavioral advertising as of this policy date.

12. International Data Transfers

Your information may be processed in countries other than your own. Where required, we use appropriate safeguards for cross-border data transfers.

13. Children's Privacy

The Service is not directed to children under 13 (or higher age where required by local law), and we do not knowingly collect personal data from children.

14. Changes to This Policy

We may update this Privacy Policy periodically. We will post the revised version with an updated "Last Updated" date.

15. Contact

Proof (withproof.dev)
Operator: David Daniel
Portland, OR
Privacy contact: hello@withproof.dev