Teardown reads shops you compete with and redesigns yours. Doing that needs an account, your shop's details, and the addresses of the shops you want studied. It does not need to know anything about you beyond that, and it does not collect anything beyond that.
Before this is shown to a paying customer, the operator must replace the bracketed placeholders below with a real trading name, legal identity, address and contact email. A privacy policy without an identifiable controller does not satisfy Article 13 UK GDPR, and it leaves customers with no one to send a request to.
[YOUR TRADING NAME] ([YOUR LEGAL NAME - e.g. a limited company and its number, or your own name if a sole trader]), of [YOUR REGISTERED OR TRADING ADDRESS], is the controller of the personal data described here. For anything in this document, including any request about your own data, write to [YOUR CONTACT EMAIL FOR PRIVACY REQUESTS].
| What | Why | Lawful basis |
|---|---|---|
| Your email address and password | To create your account and let you, and only you, sign back in. | Performance of our contract with you |
| Your name and business name, if you give them | To address you, and to put a real business name on the designs produced for you rather than a placeholder. | Performance of our contract with you |
| Your shop's web address, products, prices and delivery rules | This is the raw material of the product. A redesign of your shop that did not know your products or your prices would be a template, not a redesign. | Performance of our contract with you |
| The addresses of shops you ask us to study, and what we found there | To produce the teardown you asked for, and to let you reopen it later instead of paying to run it again. | Performance of our contract with you |
| Your interface language, theme and similar settings | So the product looks and reads the way you left it. | Performance of our contract with you |
| Your subscription status and payment history | To give you the plan you paid for, and to keep the accounting records the law requires us to keep. | Contract, and legal obligation for the records |
| IP address and request counts, held briefly | To apply rate limits, which is how the service stays up and how abuse is kept out. Not used to identify or profile you. | Our legitimate interest in keeping the service running and secure |
We do not collect special category data, we do not buy data about you from anyone, and we do not build a profile of you. No decision with a legal or similarly significant effect is made about you by automated means.
Your password is never stored. What is stored is a PBKDF2-HMAC-SHA256 hash of it, with 240,000 iterations and a salt unique to your account, which cannot be turned back into your password. It is never written to a log, never included in an error report, and cannot be read back by us. If you forget it, we cannot tell you what it was.
Teardown sets one cookie:
| Name | What it is | How long |
|---|---|---|
td_session |
A signed token proving you signed in. It is marked HttpOnly, so page scripts cannot read it; SameSite=Lax, so another website cannot cause your browser to send it; and Secure whenever the site is served over HTTPS. It contains no personal data beyond the account it belongs to. | 30 days, or until you sign out |
Teardown also keeps your workspace in your browser's local storage: the shop details you have typed, your settings, and the results currently on screen. That stays on your own computer. It is not a cookie, is not sent to us automatically, and is cleared when you sign out.
Both of these are strictly necessary for a service you have actively asked for, so the law does not require us to ask your permission for them, and we do not pretend to. Refusing the session cookie would simply mean being unable to sign in, and a consent banner offering you that choice would be theatre. What we owe you here is a clear explanation, which is this section.
When Teardown shows you a mockup using a competitor's real typeface, the font has to be fetched from Google Fonts, because that is where the font lives. Doing so discloses your IP address to Google.
That is not necessary for the product to work, so it is off until you switch it on, we ask before doing it, and you can change your mind at any time in Settings under Data. With it off, mockups use a close substitute already installed on your computer and no request leaves your browser. Nothing else about Teardown changes either way.
Everything else the page needs, including all of its own fonts, is served from our servers, so no other third party learns that you visited.
We use a small number of suppliers to run the service. They act on our instructions, and none of them may use your data for their own purposes.
| Who | What they do | What they see |
|---|---|---|
| Vercel | Runs the servers the site is served from | Requests to the site, including IP addresses, in the ordinary course of serving them |
| Upstash | Stores accounts, sessions and rate-limit counters | Your account record and saved teardowns |
| Stripe | Takes the payment | Your email address and payment details. Card numbers go straight to Stripe and never reach us - we never see, hold or store them. |
| Google, Apple or Shopify | Only if you choose to sign in with them | That you signed in to Teardown, plus the email address they pass us. If you sign in with a password instead, they learn nothing. |
| Google Fonts | Only if you switch on competitor typefaces | Your IP address, when a font is fetched. Off unless you say otherwise. |
Some of these are based in, or may process data in, the United States. Where that happens the transfer is covered by the UK and EU standard contractual clauses, the UK Addendum, or an adequacy decision, as applicable to that supplier.
This part is unusual enough to spell out. When you ask Teardown to study a competitor, our server visits that shop's public pages the way any visitor would and reads what is published there: layout, wording, prices, delivery promises. It signs in to nothing, submits nothing, buys nothing, and changes nothing. It identifies itself honestly in its requests and obeys a site's robots.txt.
What it reads is business information a shop has chosen to publish. It is not an attempt to gather personal data about anybody, and where a page happens to contain a person's name we have no interest in it and do not index it. If you are a shop owner who believes we have read something we should not have, write to [YOUR CONTACT EMAIL FOR PRIVACY REQUESTS] and we will remove it.
| What | How long |
|---|---|
| Your account | Until you delete it, or ask us to |
| Saved teardowns | 12 months from the day they were run, then they are deleted automatically |
| Your signed-in session | 30 days, or until you sign out |
| Rate-limit counters | Minutes to hours |
| Payment and invoice records | Six years after the end of the relevant financial year, because tax law requires it |
You have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. You can also withdraw consent for competitor typefaces at any time without losing anything else.
Two of these you can exercise yourself, immediately, without asking us: Settings, then Data, exports your whole workspace as a file you can keep or move elsewhere, and the same panel deletes it. For anything else, write to [YOUR CONTACT EMAIL FOR PRIVACY REQUESTS]. We will answer within one month.
If you think we have got this wrong, you can complain to the Information Commissioner's Office at ico.org.uk, or to your own country's data protection authority if you are in the EU. We would rather you told us first, but you are not obliged to.
Passwords are hashed as described above and compared in constant time. Sessions are signed so a token cannot be forged or edited. The session cookie is HttpOnly and SameSite=Lax. Every part of the product that depends on your plan is checked on the server, not in your browser. The crawler refuses to fetch private and internal network addresses, so it cannot be pointed inwards. Rate limits apply to everyone, including us.
No system is perfect. If we ever discover a breach that puts you at risk, we will tell you and the regulator within the time the law allows, and we will tell you what actually happened rather than the smallest true thing we can say.
Teardown is a tool for running a shop and is not intended for or directed at children. We do not knowingly hold data about anyone under 16.
If this policy changes in a way that matters, we will say so in the product rather than quietly reposting the page. The date at the foot is the date of the current version.