Teardown reads the public pages of an online shop you name and tells you what to fix. Doing that needs an account and the address of the shop. It does not need to know anything about you beyond that, and it does not collect anything beyond that.
Czarek Lubanski, a sole trader, trading as Teardown, of 79 Godwin Way, Cambridge CB1 8QW, is the controller of the personal data described here. For anything in this document, including any request about your own data, write to mainproductioncl@gmail.com.
| What | Why | Lawful basis |
|---|---|---|
| Your email address and password (or, if you sign in with Google, the email address Google passes us) | To create your account and let you, and only you, sign back in, and to send the emails an account needs: confirming your address and resetting your password. | Performance of our contract with you |
| The address of the shop you ask us to judge, the pages you pick, your answer to how much moves on it, and the report we make | To produce the report you asked for, and to let you reopen it later instead of paying to run it again. | Performance of our contract with you |
| Which scans you have bought, and your payment history | To give you the scans you paid for, and to keep the accounting records the law requires us to keep. | Contract, and legal obligation for the records |
| What you send us from Help or Report a bug | To answer you, fix what went wrong, and deal with refunds. | Performance of our contract with you, and our legitimate interest in fixing faults |
| Which screens of the app are opened, tied to a random ID in your browser - only if you allow usage statistics | To know which parts of Teardown get used, and so what to improve. | Your consent, which you can withdraw at any time |
| That a page of Teardown was opened, and when a payment is confirmed, that a scan was bought, for how much, and an order reference that means nothing outside Teardown - sent to Google Ads with no cookie and no ad-click reference | To know which of our ads are worth paying for. | Our legitimate interest in measuring our own advertising, which takes nothing from your device and builds no profile of you |
| The same, linked by a Google cookie on this site to the ad you clicked - only if you allow ad measurement | To know which ad brought which visit. | Your consent, which you can withdraw at any time |
| The reference of the Google ad you clicked, held by the page while it is open and, if you buy, kept with your payment at Stripe - only if you allow ad measurement | So that we can tell Google Ads which ad led to a sale. Nothing is sent to Google with it today. | Your consent, which you can withdraw at any time |
| Request counts per network address and per account, held for an hour | To apply rate limits, which is how the service stays up and how abuse is kept out. We store a keyed one-way hash rather than the address or the email itself, and never use it to identify or profile you. | Our legitimate interest in keeping the service running and secure |
We do not collect special category data, we do not buy data about you from anyone, and we do not build a profile of you. No decision with a legal or similarly significant effect is made about you by automated means.
Your password is never stored. What is stored is a PBKDF2-HMAC-SHA256 hash of it, with 240,000 iterations and a salt unique to your account, which cannot be turned back into your password. It is never written to a log, never included in an error report, and cannot be read back by us. If you forget it, we cannot tell you what it was.
Teardown sets one cookie:
| Name | What it is | How long |
|---|---|---|
td_session |
A signed token proving you signed in. It is marked HttpOnly, so page scripts cannot read it; SameSite=Lax, so another website cannot cause your browser to send it; and Secure whenever the site is served over HTTPS. It contains no personal data beyond the account it belongs to. | 30 days, or until you sign out |
Teardown also keeps two things in your browser's local storage. Neither is a cookie, neither is sent to us automatically, and both stay on your own computer:
| Name | What it is | How long |
|---|---|---|
teardown.workspace.v3 |
Your workspace: your appearance setting, the scan you are part-way through, and which report you had open, so a reload does not lose your place. | Until you sign out, or press "Clear this browser" in Settings |
teardown.consent.v4 |
Your answers to the usage-statistics and ad-measurement questions, so you are not asked them on every visit. | Until you change it, or clear this browser |
These and the session cookie are strictly necessary for a service you have actively asked for, so the law does not require us to ask your permission for them, and we do not pretend to. Refusing the session cookie would simply mean being unable to sign in, and a consent banner offering you that choice would be theatre. What we owe you here is a clear explanation, which is this section.
We can count which screens of the app get opened, so we know what people use and what to improve. That is not necessary for the product to work, so nothing is counted until you choose "Allow counting". Until then the code that does it is not even downloaded.
It is done with PostHog, on their EU servers. It keeps a
random ID in your browser's local storage (ph_..._posthog) so that
two visits can be recognised as the same browser - which is exactly why it asks
first. It is set up to collect as little as it can:
? or #, because that is where a
password-reset link or a payment reference would sit.You can take a yes back at any time, from Settings in the app or from "Cookie settings" at the foot of the home page. Saying no stops anything further being sent and removes the random ID from your browser. What was already recorded can be deleted on request - write to mainproductioncl@gmail.com.
Separately from PostHog, and without asking, our own server keeps a tally for each day of how many times a few steps happened: the home page being opened, its font being downloaded (which tells a person's browser from a program), a shop address being sent, the pages of a shop being listed, free scores being shown, an account being created, checkout being opened, a payment and a finished report. Each is a number for a day and nothing else - no address, no shop, no account, no IP address and no ID - so no tally can be traced back to anyone, and two visits cannot be linked. Nothing is stored in or read from your browser to do it; it is counted from the request your browser was already making. Requests from robots are left out. We do it, on the basis of our legitimate interest, to see where people give up, so we can make the product easier.
We pay for ads on Google, and we want to know which of them bring people who find Teardown useful. So every page loads the Google tag for our Google Ads account, in Google's "Consent Mode". Until you choose "Allow both" or switch on ad measurement in Settings, it may not set or read any cookie: it tells Google only that a page was opened (and, after a payment, that a scan was bought, its price and an order reference), with the ad-click reference removed. The order reference is a code we make from the payment that means nothing outside Teardown; it is there so Google counts one purchase once, even if the thank-you page is seen twice. Google receives your IP address and browser details with that, as with any request, and uses them to estimate how many visits its ads brought, without identifying you.
If you allow it, Google also sets a cookie on this site
(_gcl_au, and _gcl_aw if you came from an ad) that
lasts up to 90 days, so it can connect a click on our ad to what happened after
it. Either way it is set up to do as little as it can:
? or #, where a
password-reset link or a payment reference would sit, and where you came from is
sent as the site only, never the full address. A free scan from a promotion code
is not reported at all.If you came from one of our ads and allow ad measurement.
Google adds a click reference to the address of the page its ad sends you to (a
gclid, or on an iPhone a gbraid or wbraid).
With your yes, the page reads it from the address and holds it in its memory
while it is open. It is not stored in your browser: closing or
reloading the page forgets it. If you buy a scan while the yes stands, it goes
with your checkout to Stripe, which keeps it with the payment, beside a note
that you had allowed ad measurement. It is kept so that we can tell Google Ads
which ad led to the sale. We do not send it to Google today. If
we start to, we will send only that reference, with the price, time and order
reference of the purchase, within a day of the purchase and only for purchases
made with your yes - and we will say so here first. Without a yes the reference
is never read, and nothing about it reaches Stripe.
You can take a yes back at any time, from Settings in the app or from "Cookie settings" at the foot of the home page. Saying no stops anything further being linked by a cookie, removes Google's cookies from this site and makes the page forget the ad you clicked; the tag goes back to the cookieless measurement above.
We use a small number of suppliers to run the service. They act on our instructions and may not use your data for their own purposes - except that Stripe, and Google if you sign in with Google, are also responsible in their own right for what they need to meet their own legal duties (fraud prevention and financial regulation, for Stripe), under their own privacy policies. For ad measurement, Google acts under the Google Ads data protection terms.
| Who | What they do | What they see |
|---|---|---|
| Vercel | Runs the servers the site is served from | Requests to the site, including IP addresses, in the ordinary course of serving them, and short-lived server logs. |
| Upstash | Stores accounts, sessions and rate-limit counters | Your account record and saved teardowns |
| Stripe | Takes the payment | Your email address and payment details, and the shop the scan is for. If you came from one of our ads and allowed ad measurement, also that ad's click reference, kept with the payment. Card numbers go straight to Stripe and never reach us - we never see, hold or store them. |
| Resend | Sends our account emails: the link that confirms your address, and a password-reset link when you ask for one. It also carries what you send us from Help or Report a bug to our inbox | Your email address and that message. Nothing else is ever sent - no newsletters, no marketing - and we do not track whether you open them. |
| Only if you choose to sign in with them | That you signed in to Teardown, plus the email address they pass us. If you sign in with a password instead, they learn nothing. | |
| Google Ads | Measures our ads: without a cookie on every visit, and with one only if you switch on ad measurement | That a page of Teardown was opened, your IP address and browser details, and, after a payment, that a scan was bought, its price and an order reference that means nothing outside Teardown. With ad measurement on, also whether you came from one of our ads and a random ID in a cookie on this site. Never your name, your email, or anything about the shops you scan. |
| PostHog (EU) | Only if you switch on usage statistics | Which screens you open, tied to a random ID kept in your browser, and the IP address the request comes from. Never your name, your email, your shop's data, or the text of anything on screen. Off unless you say otherwise. |
| Anthropic | When a scan runs its AI review of how the shop looks and reads, and when you upload screenshots of a shop we could not read | Pictures of the shop's public pages that we take ourselves, the words on those pages and the shop's address - or the screenshots you upload - so their Claude model can judge them. Not your name, your email or your account. Teardown does not keep the pictures or screenshots. Under Anthropic's commercial terms, data sent through its API is not used to train its models. The rule checks, which read your pages' code, send nothing to Anthropic. |
Some of these are based in, or may process data in, the United States. Where that happens the transfer is covered by the UK and EU standard contractual clauses, the UK Addendum, or an adequacy decision, as applicable to that supplier.
When you ask Teardown to judge a shop, our server visits the public pages you pick the way any visitor would and reads what is published there. It signs in to nothing, submits nothing, buys nothing, and changes nothing. It identifies itself honestly in its requests and obeys a shop's robots.txt.
Reading a page means the page and the files it loads: its stylesheets, and the first few hundred bytes of one or two of its pictures, to see what format the server really sends them in. Most of how a shop looks lives in those files rather than in the page, so a report written without them would be guessing. Each one is asked for the same way - openly, and only if robots.txt allows it - and none of them is kept: the report keeps counts and findings, not your files.
For the AI review, our own browser also opens each page you picked and takes two pictures of the top of it - as it looks on a desktop and on a phone - and reads the words on it. The pictures and words are sent to Anthropic for their Claude model to judge how the page looks and whether its words sell, and are not kept by us: the report keeps only the findings and scores. The browser identifies itself as TeardownBot, loads only public addresses, and does not click, sign in, or accept anything. If a shop shows it a block screen or a password page instead of the shop, nothing is sent to Anthropic for that page.
If a shop cannot be read that way, you can upload screenshots of its pages instead. They are shrunk and cut into pieces in your browser, sent to Anthropic to be judged, and not kept by us: the report keeps only the findings and scores. Screenshots can show more than you mean them to - a customer's name, an order, an admin bar - so crop those out first. The judge is told never to repeat a person's name, email, address, phone number or order number, and the report tells you if it saw any.
What it reads is business information a shop has chosen to publish. It is not an attempt to gather personal data about anybody, and where a page happens to contain a person's name we have no interest in it and do not index it. If you are a shop owner who believes we have read something we should not have, write to mainproductioncl@gmail.com and we will remove it.
| What | How long |
|---|---|
| Your account | Until you ask us to delete it - ask from Help in the app, or write to mainproductioncl@gmail.com |
| Your reports | Until you ask us to delete them. You paid for each one, so none of them expires on its own |
| Your signed-in session | 30 days, or until you sign out. Signing out ends it on our side too, not just in your browser |
| What you send from Help or Report a bug | In our email inbox, as any email to us would be, until you ask us to delete it. A bug report includes technical details (which screen you were on, your browser and window size, recent errors) only if you leave that box ticked, and the app shows you every line before it goes |
| Email links | A password-reset link works once, for one hour; a confirm-your-address link for three days. We keep a one-way fingerprint of each link, never the link itself |
| Rate-limit counters | One hour at most |
| Usage statistics, if you allowed them | Until you ask us to delete them, and no longer than PostHog keeps events for our account |
| Ad measurement, if you allowed it | Google's cookie lasts up to 90 days in your browser; Google keeps the measurement under its own retention rules, and we see only totals per ad. The ad click you came from is never stored in your browser; if you bought, it stays with that payment's record at Stripe |
| Payment and invoice records | Six years after the end of the relevant financial year, because tax law requires it |
You have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent - usage statistics and ad measurement - you can withdraw it at any time without losing anything else, and withdrawing does not make what happened before unlawful.
Some of this you can do yourself, straight away: every report can be saved as a PDF or a web page from the report itself, usage statistics and ad measurement can be switched off in Settings or from "Cookie settings" on the home page, and "Clear this browser" in Settings removes everything Teardown keeps on your device. For anything else, including deleting your account, ask from Help in the app or write to mainproductioncl@gmail.com. We will answer within one month.
If you think we have got this wrong, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first, but you are not obliged to.
Passwords are hashed as described above and compared in constant time. Sessions are signed so a token cannot be forged or edited. The session cookie is HttpOnly and SameSite=Lax. Everything that depends on what you have paid for is checked on the server, not in your browser. The crawler refuses to fetch private and internal network addresses, so it cannot be pointed inwards. Rate limits apply to everyone, including us.
No system is perfect. If we ever discover a breach that puts you at risk, we will tell you and the regulator within the time the law allows, and we will tell you what actually happened rather than the smallest true thing we can say.
Teardown is a tool for running a shop and is not intended for or directed at children. We do not knowingly hold data about anyone under 16.
If this policy changes in a way that matters, we will say so in the product rather than quietly reposting the page. The date at the foot is the date of the current version.