Privacy Policy

This describes what Reachable By collects, how we use it, and — most importantly — who we do and don't share it with.

1. What we collect

• Account information: your email address, used for sign-in (via passkey, a magic-link email, or a one-time code sent by email) and to send you your own scan reports.
• Sites you submit: the URLs you ask us to scan, and the resulting scan data — violations found, severity, status, and history.
• Email addresses you enter: teammates you invite (we send each one a single invitation email) and the developer address you choose for fix requests (stored only to pre-fill requests you send from your own email app — we never email that address ourselves).
• Billing: your plan and a Stripe customer ID. Card details are entered on Stripe's own page and never reach us.
• iPhone and iPad app: if you allow notifications, a push token for your device, used only to tell you when a scheduled re-scan finds something new. Signing out or deleting your account removes it.
• Basic technical logs: standard server request logs (needed to run and secure the Service), kept only as long as operationally necessary.

We do not use third-party advertising trackers or analytics scripts on this site, and we don't collect anything beyond what's listed above.

2. How we use it

To run the scans you request, generate your reports (including the summary email sent after a scheduled re-scan), let you sign in, and operate and improve the Service.

3. Who we share it with

Nobody, by default. We do not sell your data. We do not share your account information, submitted URLs, or scan results with the owners or teams of the sites you scan, with that site's visitors, or with any other third party. Scan reports and notification emails go only to your own account email — never to anyone else automatically. If you choose to forward a report yourself, that's a decision you make outside the Service.

We do use a small number of infrastructure providers to run the Service, strictly as data processors:

• Supabase — authentication and database hosting.
• Resend — delivering sign-in, invitation and report emails.
• Stripe — payments and subscription management.
• Apple — delivering push notifications to the iPhone and iPad app.
• Render and Vercel — hosting our backend and dashboard.
• Cloudflare — our domain, and forwarding email sent to hello@reachableby.com.

None of these providers are permitted to use your data for their own purposes.

4. Data retention

We keep your scan history for as long as your account is active, so you can track progress over time. Deleting a site removes its scan history and violations permanently. You can delete your account at any time; doing so removes your account data.

5. Cookies and local storage

We use browser local storage to keep you signed in between visits. We don't use cookies for tracking or advertising.

6. Your rights

You can access, correct, or delete your data at any time from your account, or by emailing hello@reachableby.com. If you're in the EU/UK, this includes the rights available to you under GDPR.

7. Security

We use industry-standard measures — encrypted connections, access controls, and hosting providers with their own security practices — to protect your data. No system is perfectly secure, and we can't guarantee absolute security.

8. Changes to this policy

We may update this policy as the Service changes. The date at the top of this page shows when it last changed.

9. Contact

Questions about this policy: hello@reachableby.com