Privacy Policy

In short

We set no cookies for analytics, and no other company measures your visit.
We count visits in two ways, both on our own servers: the web server's ordinary access log, and a self-hosted copy of Plausible.
If you use the contact form we keep your name, email, company, message, IP address and the time. A scheduled job deletes it after 180 days.
Your form message is also emailed to us through Resend, which sees the same fields and nothing more.
The EAA readiness check runs in your browser. We never see your answers — only that someone finished it and which of the three bands they got — unless you choose to email yourself the result, which sends only your email address and that band.
The free checker scans the one page you give it and emails you the result; we store the URL, your email and the scan for 90 days to send that email and to prevent abuse.
We do not sell or share your data, and we do not track you across sites.
In the EU/EEA you can ask us to show, correct or delete what we hold. Write to contact@wcagauditor.com.

The full policy below is the one that governs. This summary is here to help you find your way through it, not to replace it.

This page describes, plainly, everything this website collects — no more and no less. If a section below does not apply to a feature, that feature does not appear in this policy, because it does not collect anything.

Analytics

There is no third-party analytics on this site, and no cookies are set for analytics. Nothing here reports to Google, to an advertising network, or to any company other than us. Both of the things we do measure are described below, and both run on our own servers.

First, our web server keeps an ordinary access log — the same request records any web server keeps in order to be operated — and we summarise it with GoAccess, which runs on our own infrastructure and reads that file. It ships no code to your browser, sets no cookies, and sends nothing to a third party. Such a log records the page requested, the time, the referring page, your browser's user-agent string, and the IP address the request came from.

Second, we run Plausible, self-hosted on the same infrastructure, to count a few in-page actions a server log cannot see: that someone finished the readiness check (and which of the three readiness bands they got — never the answers themselves), that someone clicked through to the contact page, and that a contact form was submitted. Plausible sets no cookies, does not fingerprint you, does not track you across sites and assigns no persistent identifier. Its script is served from this domain, and the counts it records are stored on our own server — nothing about your visit is sent anywhere else. You can block it with any content blocker without breaking a single feature of this site.

The contact form

When you submit the form at the contact page, we store:

Your name and email address
Your company, if you provide one
Your message
The IP address the submission resolved to, and a timestamp

We use this to respond to you and to prevent abuse of the form (rate limiting, spam filtering). We keep it for 180 days, after which it is deleted automatically — the deletion is a scheduled job, not a promise someone has to remember to keep.

Your submission is also forwarded to our team as an email notification through Resend, which acts as our email-delivery data processor for that one message and sees the same fields you submitted, and nothing more. We name it here whether or not that leg is switched on at any given moment: the record we keep of you is the stored one described above, and it exists either way.

The self-assessment quiz

The EAA readiness check runs entirely in your browser. Your answers are never sent anywhere, and we never see them. The link at the end of the result is an ordinary link: following it to the contact page carries none of your answers with it, and the contact-form section above then describes everything we receive — which is only what you type into that form yourself.

What the self-hosted analytics above does record about the check is exactly two things: that someone completed it, and which of the three readiness bands they landed in. Your individual answers stay in your browser regardless — a band is not a record of what you told the check, and there is no way to work backwards from one to the other.

The result panel has one optional button: "email me this result". It is never submitted automatically. If you choose to use it, we send your email address and the readiness band you landed in — never your individual answers — to the same storage the contact form uses (described above), so it is retained and deleted on the same 180-day schedule.

The free EAA checker

When you submit the form at the free checker, we store the URL you gave us, your email address, the scan result, and a timestamp. Unlike the contact form and the self-assessment quiz, this feature runs a real automated scan of the page you name — our server fetches it to check it against EN 301 549 — so we can email you the report. The report link resolves to the same sanitized, read-only view an audited organization can share publicly; it carries no data about you, only about the page.

We use the stored URL and email to send that one email and to prevent abuse (rate limits, and a cap on how often the same URL or email address can be requested). We keep this for 90 days, after which it is deleted automatically, the same scheduled-job mechanism the contact form uses. As with the contact form, the email itself is sent through Resend, which sees the same fields and nothing more.

What we do not do

No third-party cookies
No cross-site tracking
No sale or sharing of your data with data brokers or advertisers

Your rights

If you are in the EU/EEA, you have rights under the GDPR to access, correct, or delete the data we hold about you, and to object to or restrict its processing. To exercise any of these rights, contact us at contact@wcagauditor.com.