Privacy

What we collect and why

We keep only what we need to run reports, watch pages, and take payments. We do not sell your data and we do not use advertising trackers.

When you run a check

• The address you submit, so we can load it and report on it.
• What we measured: scores, findings, the files we named, and the page's own HTML and network log for as long as the report is kept.
• Public reports may appear in the recent list when the site is public.

When you sign in

• Your email address, for the account and for the sign in link.
• Your credit balance and what you spent it on.
• The pages you save, the projects you put them in, and the domains you prove you control.

When we watch a page for you

• The address, how often to check it, and what counts as a good answer.
• Every time the answer changed: when it stopped, when it came back, the status code and the reason. We do not keep a row for every check that went fine.
• Where to send the alert. That is your own email unless you give us another, or a webhook address.
• When a certificate or domain name expires, so we can warn you before it does.

When you measure a page behind a login

This is the most sensitive thing we hold, so here is exactly what happens to it.

• You give us one session: a cookie or a header from your own site. We never ask for a password and we cannot sign in on your behalf.
• It is encrypted before it is stored, with a key kept on our server and not in the database.
• It is only ever sent to the host it belongs to. If your page redirects somewhere else, it is dropped rather than followed.
• We only accept one for a domain you have already proved you control.
• We never show it back to you or to anyone. You see the first few characters and a length.
• Revoking deletes it there and then. The row stays so you can see when it was added and removed, with nothing in it.
• We ask you to use a throwaway account rather than your own admin login, and that is not a formality.

When you pay

• Card details never reach us. They go to the payment company and stay there.
• Most payments are handled by Bachs. Payments in Naira are handled by Paystack. Which one depends on where you are when you check out.
• We keep your email, what you bought, when, and the reference the payment company gave it. That is what a receipt and a refund need.
• We record which payment company a subscription lives in, so we know where to look when you want to change or cancel it.

When you put your own name on a report

• Your company name, your colour, and the web address of your logo.
• We never fetch or store the logo itself. The report you download points at your own address, so the file stays yours.
• We count how many reports you download, so you can see how many you sent. We do not record anything about the report or who you sent it to.

Logs and hosting

We run on Cloudflare, and the server that does the measuring and holds the database is in Montreal, Canada. Request logs and security signals may include your IP address, your browser, and the country Cloudflare says a request came from. We use the country to show prices in your currency. This is for abuse control, reliability and billing, and nothing else.

Cookies and local storage

A sign in cookie so you stay signed in, and local storage for small conveniences like your theme and which tab you were on. We use one privacy focused analytics service to count visits. No advertising trackers, anywhere.

How long we keep things

Reports and what we measured are kept while a public report link still works. Signed in data retention for past reports: 7 days on a free account, 30 days after you buy credits, and 12 months on Pro, Team, or Agency. Looking at an old report never spends credits. Outage history is kept so the uptime figures mean something. Payment records are kept as long as the law requires. A session for a logged in page is kept until you revoke it or delete the page.

Who else handles your data

A short list, and it is the whole list. Full detail, including what each one is for and where it sits, is on the data processing page.

• Cloudflare serves the site and protects it.
• OVH hosts the server that runs the checks and holds the database, in Canada.
• SendByte sends your sign in links, reports and alerts.
• Vemetric counts visits, without advertising trackers.
• Bachs takes card payments in dollars. Paystack takes card payments in Naira, for customers who pay in Naira.

Contact and requests

Email hello@pafcore.site to ask what we hold about you, to correct it, or to have your account deleted. We will not ask why.

Last updated: 29 September 2026.