Privacy.

When a recipient opens a tracked share, we record:

• The email address they enter at the gate, if the share requires one.
• A random fingerprint — a UUID we generate and store in their browser's localStorage. No cross-site value.
• Session metrics: start time, total active time, max scroll depth, sections read with dwell.
• Coarse network metadata: IP-derived country and city (we never store the IP itself), device / OS / browser from the user-agent, referrer URL.

We don't collect keystrokes, mouse positions, third-party trackers, anything from outside the document, or anything that identifies the recipient beyond the email they provided.

Recipient documents are served from a separate domain, htmlradar.page, which shares no cookies or browser storage with htmlradar.com, and old htmlradar.com links redirect there automatically.

Separately from the share-tracking above, the hosted app records a small amount of first-party usage data so we can fix bugs and understand which features get used:

• Product events — when you sign in, upload a document, create or revoke a share, hit the free-tier cap, view the upgrade page, click a CTA, or submit feedback. Stored in a table called app_events. The monitor worker replays these first-party events to PostHog server-side for product analytics. Your account email is added to your PostHog user profile after sign-in. Owner-scoped share events can include a first open, gate outcome, country, device, or email domain, but not a recipient's raw email address. The browser does not load a PostHog script.
• Page views — when your browser loads a page on htmlradar.com. We store the path, referrer, and a random fingerprint (anonymous, generated client-side, never linked to your email unless you're signed in).
• Crash + error reports — when JavaScript on a page throws an error, we capture the message + stack to a error_log table so we can fix it. We do not use Sentry or any third-party error service.
• Feedback — anything you submit through /feedback is stored in a feedback table and emailed directly to the founder. Email field is optional.

No third-party tracking scripts. No third-party cookies for analytics or advertising. No session replay.

• Document HTML you upload — Cloudflare R2, encrypted at rest in the region of your bucket.
• Primary application data — Supabase Postgres, encrypted at rest.
• Product analytics events — PostHog, sent server-side from the monitor worker.

Only the document owner can see analytics about their shares. Postgres Row Level Security enforces this at the database layer — an authenticated user querying directly cannot see another user's data.

Operators of the hosted service have technical access to the underlying database for support and abuse investigation. Access is logged and limited.

Sessions and section events are currently retained indefinitely. Permanently deleting an individual share removes its viewers, sessions, section events, and attachment-download records from Supabase immediately. The in-app Delete document action archives the document: it removes document and share access, but retains the database rows and uploaded HTML for recovery.

Recipients and account holders can request permanent deletion by emailing privacy@htmlradar.com. Include the email address tied to the data and, for account holders, the affected document. We complete verified requests within 14 days, including matching data in Supabase, R2, and PostHog where applicable.

A recipient can opt out of tracking by calling window.HTMLRadar.optOut() in the browser console of any tracked page. The opt-out persists in their localStorage and applies to every HTMLRadar link they open in that browser afterwards.

The hosted service uses session cookies for authentication, set when you sign in. Tracked share links may set a temporary cookie when a password is required, scoped to that share. We do not use third-party cookies for analytics or advertising.

On your first visit to htmlradar.com, we also set a cookie named hr:src, mirrored in your browser's local storage, recording the page you arrived on and any campaign tags in the link (such as utm_source or gclid). This tells us which of our pages and channels bring people who sign up. It lives only on our own domain, in a first-party cookie and local storage with no third-party trackers, and lasts one year. You can clear it any time by clearing site data for htmlradar.com in your browser.

HTMLRadar is AGPL-3.0 open source. You can audit exactly what the tracker collects and how it's transmitted at github.com/htmlradar/htmlradar.

privacy@htmlradar.com