Privacy Policy

Who to contact

WebKeeper is a product of ddz.dev LLC, a Wyoming limited liability company at 75 E 3rd St, Ste 7, Sheridan, WY 82801, United States. It operates this website and the application and is responsible for the information described here. The founder handles privacy questions. Contact hello@webkeeper.io with questions about your information or to ask for it to be corrected or deleted. Our Terms of Service cover the use of the application.

Your account

You sign in with your email address and a one-time code we send to it, or with a passkey you add. We keep your email address, the name your teammates see, when your account was created, and any passkeys you add. For a passkey we store its public key and technical details, such as its identifier, device type and when it was added. Your fingerprint, face or device PIN never leaves your device.

Sign-in codes expire after five minutes. A session ends after seven days, or after twelve hours without use. Session and sign-in records can include the IP address and browser details of the request.

Starting a workspace

If you verify your email address to start a workspace but don’t finish, we keep that verified account, meaning your email address and when it was created, so you can come back. It doesn’t create a workspace or start a trial. Deleting an account isn’t available yet; if you ask, we can disable yours so it can’t be used.

When a self-service workspace is created for you, we record that your account started one, the version of the Terms of Service that was accepted and when the workspace was admitted. We keep that record after the workspace is closed, because each person can start only one self-service trial.

The waitlist

When new workspaces are at capacity, the application can put your request on a waitlist. We keep your email address, the workspace name you asked for, the version of the terms you accepted and when you asked. We use them to create your workspace when there’s room and to email you that it’s ready. The request is deleted when your workspace is created.

Your workspace

Members add sites, domains and web addresses, client and business context, answers about responsibility, the names of the people involved, and teammates’ email addresses. WebKeeper adds evidence from public checks: DNS, website responses and redirects, certificates, registration details, response times shown for 30 days, and a daily desktop screenshot of each site’s public landing page shown for seven days.

Only members of a workspace can see its records. We access them only when needed to run, secure or support the service, or when the law requires it. A check of a public address can run once and serve every workspace that tracks it; other workspaces can’t see your records or which addresses you track.

Email we send

We send only transactional email: sign-in codes, team invitations that name your workspace, and messages about your workspace, such as when it’s ready. Amazon Simple Email Service (SES) delivers it. If a message bounces or is reported as spam, SES can stop further delivery to that address. We don’t send newsletters or advertising.

Security logs

To protect accounts and the service, we log refused and rate-limited requests and keep load-balancer access logs. These records can include the IP address, the address requested, browser details and, when you’re signed in, internal account and workspace identifiers. They don’t include what you type into forms or your cookies. They are set to expire after 30 days.

Where the application runs

The application, its database, processing and backups run on Amazon Web Services in the US East (N. Virginia) region. If you use WebKeeper from outside the United States, your information is transferred to and stored in the United States.

Optional product analytics

Inside the application, you can choose to share product usage analytics with PostHog, in its European Union region. Nothing is sent until you allow it, declining doesn’t affect your access, and you can change your choice in Settings. Events include actions and counts linked to internal user and workspace identifiers, never your domains, client names or answers.

You can also allow masked session replay, which records interactions on portfolio screens with customer content hidden. Sign-in and team pages are never recorded. These choices apply to your account and workspace in that browser. Ask us to delete analytics data that has already been collected.

Keeping and deleting application information

Response times are shown for 30 days and screenshots for seven days, and older records are removed by regular clean-up. When a trial ends, checks and editing stop and the workspace stays readable for another 30 days. Ending access doesn’t delete your records.

To close and delete a workspace, its owner can email hello@webkeeper.io from the address they sign in with, and ask for an export first. Closing ends access straight away. Deleting the content happens in stages and can take several weeks, because queued work has to finish first. Public check results and screenshots that other workspaces also use expire on their own schedule. Automated database backups expire after seven days, while manual and final snapshots can be kept longer; we keep a minimal record of each deletion so deleted content is removed again before any restored backup is used. Your account and the admission record described above remain, because deleting an account isn’t available yet.

What the early-access form collects

The early-access and waitlist form on this website saves your email address, agency or portfolio website, approximate portfolio size, any optional message you provide, and the date of your request. Please don’t include credentials, private client information or other sensitive details.

Why we collect it

We use your request to respond to you, arrange access to WebKeeper and understand whether it fits your work. Submitting the form does not subscribe you to a newsletter, create a product account or start a trial. We do not sell these details.

Where the information goes

This site is hosted by Amazon Web Services. Early-access and waitlist requests are stored in an AWS database for the founder to review. Requests are not listed publicly. Hosting providers may process technical request information to deliver and protect the site.

Abuse prevention

The form uses a hidden spam field and submission limits. A hashed network identifier is kept in the rate-limit records, without the original IP address. Rate-limit records become eligible for automatic removal after 24 hours; the hosting provider may complete removal later. We do not put your form contents into application logs.

Simple website statistics

This website sends pageviews, broad referral and campaign categories, button clicks and form acknowledgements to PostHog in the European Union as you browse. This PostHog measurement is cookieless: it saves no analytics cookies or identifiers in local or session storage. We do not send form contents, record marketing sessions or link this browsing to your WebKeeper account.

This website also uses Google Analytics. Google sets analytics cookies (such as _ga) in your browser, kept for up to two years, to tell visitors apart and recognize return visits, and receives page addresses, referrers, your IP address and browser information. Google may process this information outside your country, including in the United States. We do not use it for advertising and do not send form contents or account details.

PostHog processes your IP address and browser information to calculate a daily changing identifier for this website, then strips the IP address before event enrichment. This estimates daily visitors, but cannot reliably recognize return visits on later days. Page addresses exclude query strings and fragments; only approved campaign categories are included. Private previews and local development are not measured. Separate AWS counters retain fixed page/source records for up to seven days and send daily aggregate totals.

We honor Do Not Track and Global Privacy Control for both PostHog and Google Analytics: with either signal, Google Analytics does not load. You can also exclude this browser from statistics. This saves a cookie containing only your preference for up to 180 days. You can include this browser again at any time. Excluding this browser stops Google Analytics from loading but does not delete Google cookies already saved; clear them in your browser settings. These choices do not affect the early-access form.

Hosting providers still process technical request information to deliver and protect the site. The optional analytics inside the application, described above, is separate from these website totals.

Keeping and removing requests

Early-access and waitlist requests are kept while we review them and follow up. You can ask us to remove your request at any time by emailing hello@webkeeper.io. The founder reviews retained requests regularly.

Your rights

You can ask for a copy of the information we hold about you, or ask us to correct it, delete it or stop using it. Email hello@webkeeper.io from the address you sign in with, and we’ll reply within 30 days. The limits described above still apply: deleting an account isn’t available yet, so we disable it instead. A request about records in someone else’s workspace may need that workspace’s owner. Depending on where you live, you can also complain to your data protection authority.

Why we’re allowed to use it

Where the law asks for a legal basis, we use account, workspace and email information to provide the service you asked for. Security logs, abuse prevention, early-access requests and website statistics rely on our legitimate interest in running a safe service and understanding how it’s used. Optional product analytics and session replay rely on your consent, which you can withdraw in Settings at any time.

Children

WebKeeper is for people who look after websites for work. It isn’t meant for children, and we don’t knowingly collect information from anyone under 16.

Changes to this policy

If we change this policy in a significant way, we’ll update the date at the top and tell application users in the app or by email before the change takes effect.