Privacy Policy

This policy explains what data WebCited ("we", "us") collects when you use this site at webcited.xyz, why we collect it, and the choices you have. By using the service you agree to this policy.

What we collect

• Account data. When you sign in with email or Google, our auth provider (Supabase) stores your email address, a hashed password (email signups only), and your name and profile image (Google signups only).
• Scan data. The URLs you submit, the generated questions, AI answer-engine results, and computed scores. Anonymous scans are tied to a random browser cookie, not to you.
• GitHub data (optional). If you connect a GitHub account to open a fix pull request, we use a temporary OAuth token to read the repositories you authorize and to create the pull request you request. We do not store your source code.
• Billing data. Credit purchases are processed by Dodo Payments. We store transaction records and balances; we never see or store your full card details.
• Usage & analytics. We use Google Analytics to understand how the site is used (pages viewed, approximate location, device and browser). This sets analytics cookies and shares usage data with Google.
• Technical data. Standard request logs (IP, user agent, timestamps) for security and debugging.

How we use it

To run scans, show your dashboard and history, send service emails, process payments, prevent abuse, measure usage, and improve the product. We do not sell your personal data.

Sub-processors

We share the minimum data needed with: Supabase (authentication and database), Cloudflare (hosting), Dodo Payments (payments), Google Analytics (usage measurement), GitHub (only when you connect it), and AI answer engines (Google Gemini, OpenAI, Perplexity, xAI) which receive the questions generated for your scan. Each processes data under its own terms.

Cookies

We use essential cookies for authentication sessions and to attribute anonymous scans to your browser, and analytics cookies set by Google Analytics. We do not use third-party advertising cookies. You can block cookies in your browser; essential cookies are required to sign in.

International transfers

Our providers may process data on servers outside your country, including the United States. Where required, transfers rely on the safeguards offered by each provider (such as Standard Contractual Clauses).

Retention & your rights

We keep account and scan data while your account is active. Unverified accounts are removed after 30 days. You can request access, correction, export, or deletion of your data at any time by emailing us. Deleting your account removes your profile and links your scans to no owner.

Children

WebCited is not directed to children under 16, and we do not knowingly collect their data.

Changes to this policy

We may update this policy as the product changes. Material changes will be reflected by a new "last updated" date above, and significant changes will be communicated by email where appropriate.

Contact

Privacy questions or data requests: support@webcited.xyz.