Privacy Policy
Last updated 21 August 2026. Short version: this site sets no cookies, runs no tracking scripts, and has no account system. The scanner never sees your pages, because it runs on your computer and not ours.
Who is responsible
The controller of any personal data described here is the independent sole trader registered in Ukraine who publishes Curbcut, contactable at hello@curbcut.org. Full registration details are provided on request to anyone exercising the rights listed below, and appear on every purchase receipt issued through our payment provider.
The tool collects nothing
The Curbcut command line tool runs entirely on your own machine using a local headless browser. It has no telemetry, no analytics, no licence phone-home and no crash reporting. The URLs you scan, the pages it loads and the reports it produces never leave your computer. We could not see them if we wanted to, and you can verify this by reading the source, which is why the source is public.
This website
No cookies
This site sets no cookies of any kind, neither ours nor anyone else’s. That is also why you were not shown a consent banner: there is nothing to consent to. There are no third-party fonts, embeds or advertising networks on any page, and nothing here profiles you.
This was not always true, and if you visited before 21 August 2026 it did
not apply to you. Until that date Cloudflare injected its own analytics beacon
(static.cloudflareinsights.com) into pages at the edge. We did not add it
and it was never in our source, which is why we did not notice: it is invisible to a
command line tool and only appears for a real browser. Cloudflare states the beacon was
cookieless and did not fingerprint visitors. We removed it on 21 August 2026 anyway,
because a page that measures you is not the page we said we were serving. It is
recorded here rather than deleted, because deleting it would quietly unsay something
that was true for real visitors.
Server logs
The site is hosted on Cloudflare Pages. Cloudflare processes your IP address and request metadata in order to serve the page and to block attacks. This is ordinary technical processing without which the web does not function, and we rely on our legitimate interest in delivering and protecting the site. We do not build profiles from it and we do not attempt to identify you.
Audience statistics
We read the request statistics Cloudflare already derives from its own server logs — how many requests and page views a day, which countries they came from, which browser families. This is measured on the server. There is no beacon, no counter script and no cookie, and nothing is added to any page to make it work. We can see that four hundred people visited on a Tuesday; we cannot see which pages any one of them read, or follow anybody from one page to the next.
An earlier version of this page said we would use Cloudflare Web Analytics. That product needs a small JavaScript file on every page, which would have contradicted the promise two paragraphs above and the claim on our accessibility statement that this site runs no scripts at all. We chose the promise over the product.
If you email us
Mail to hello@curbcut.org is routed by Cloudflare Email Routing and
delivered into a Google mailbox. We keep correspondence for as long as needed to deal
with your question and for a reasonable period afterwards for our own records, and we
delete it on request. We do not add you to any mailing list, because there is no
mailing list. We never sell or share correspondence.
If you use the scanner
The page checker at /scan takes the address you type, loads that page in a browser on Cloudflare's network, and shows you the result.
We do not keep the page or anything on it. The findings are cached for fifteen minutes against the URL, so that reloading or a second person checking the same address does not spend the browser budget twice. After fifteen minutes it is gone.
To stop one script exhausting a shared daily allowance, requests are counted two ways: a total for everybody, and a per-caller count. The per-caller count is keyed on a salted hash of your IP address, where the salt changes every hour and the counter expires after an hour. Your address itself is never written down, and the hash cannot be turned back into it or matched across hours. The basis for this is our legitimate interest in keeping a free service usable.
We count how often the scanner is used, in the plainest way we could think of: a row per day per outcome, holding a number. Opened the form, ran a scan, served a cached result, refused the address, failed. That is the whole record. It does not contain the address you scanned, your address, your browser or any identifier, and no row can be traced to a person or to a visit.
Knowing which sites people check would be the most commercially valuable thing on this website for us to keep, which is exactly why we say plainly that we do not keep it. We need to know whether anybody uses this tool. We do not need to know who, and the difference is not a technicality.
We obey the target site's robots.txt, and we refuse addresses on private networks.
If you fill in the Monitor form
The form on the pricing section is the one place on this site that collects anything. It stores three things: the email address you typed, the site you named, and what you said you would use Monitor for. Two of those are optional and the form works with only the first.
It does not store your IP address, your browser, a cookie or a session identifier. There is no script on the page that could set one. The form is an ordinary HTML post, which is why it works with JavaScript disabled.
The legal basis is your consent, given by submitting the form. We use it to send you one message, when Monitor opens or when it is abandoned, whichever happens first. There is no mailing list and no second message.
Ask at hello@curbcut.org and the record is deleted the same day. You do not need to give a reason and you will not be asked for one.
The data sits in a Cloudflare D1 database in Cloudflare's network. It is not shared with anyone, not enriched from other sources, and not used to build a profile.
If you buy a licence
Purchases are handled by Paddle.com Market Ltd, which acts as merchant of record and is the seller on your invoice. Paddle collects your payment details and the billing information tax law requires. We never see or store your card number. What reaches us is your email address, your licence key and the country used for tax purposes, which we need in order to deliver the licence and to honour refunds and support. Paddle’s own privacy notice governs what it does with the data it collects.
Processors we use
- Cloudflare — hosting, DNS, email routing, the D1 database behind the Monitor form, the browser that runs the scanner, the short-lived cache and rate-limit counters, and optional cookieless analytics.
- Google — the mailbox that receives forwarded email.
- Paddle — payments, invoicing and tax, as merchant of record.
- GitHub (Microsoft) — hosting the public source code. If you open an issue there, that is GitHub’s service under GitHub’s policies, not ours.
Some of these transfer data outside the European Economic Area. Those transfers rely on the European Commission’s standard contractual clauses or, where applicable, an adequacy decision.
Your rights
If the GDPR or the UK GDPR applies to you, you may ask for access to your personal data, correction, erasure, restriction, portability, and you may object to processing based on legitimate interest. Write to hello@curbcut.org and we will answer within one month. There is no charge.
Given how little is collected, the honest answer to most access requests will be that we hold only your email correspondence, your Monitor form entry if you made one, and your licence record if you bought something.
You also have the right to complain to a supervisory authority in the country where you live or work.
Children
This is a developer and compliance tool. It is not directed at children and we do not knowingly collect data from them.
Changes
If this policy changes, the date at the top changes with it. If a change ever materially affects data we already hold about you, we will say so by email to the address we hold.