Privacy notice

What this notice covers

This notice describes the data flows used by the SiteRefit website, contact form, and private preview system.

Information submitted through the quote form

The form can collect an existing website URL, name, email address, the biggest problem with the current site, anything the replacement must retain, and an optional desired timeframe. If a callback is requested, the form also collects a phone number, general availability, and time zone. The information is used to assess and respond to the request.

Private preview data

Private preview records can include a business name, industry, general location, preview content, status, creation date, and expiry date. Access codes are stored as one-way hashes using a separate secret pepper; raw codes are not stored in preview records.

Successful access creates a signed, Secure, HttpOnly, SameSite cookie scoped to that preview path. The current session lifetime is 30 minutes. Failed access counters expire after approximately 10 minutes.

When you enter a valid private-review code, we record the visit time, approximate city, region and country, network provider and IP address, device type, operating system and browser versions, and the device model when your browser supplies it. The form may also supply screen size, language and time zone. We record the review pages you open and the time between the first and last page, so we can understand whether a review was seen and follow up when help may be needed. Location may reflect a VPN or Private Relay rather than your actual location. We cannot read your device’s own name.

A random first-party browser cookie identifies repeat visits and assigns a device number within each project. It is Secure, HttpOnly and SameSite=Lax, lasts up to 400 days, and grants no access. Owner browsers use a separate signed cookie with the same lifetime to exclude our visits and tests; saved owner networks and browser automation signals also exclude them from client counts. Wrong-code attempts for an existing project are recorded separately and never count as an open. Failed security checks and unknown projects are not added to this review log.

Service providers

• Cloudflare hosts the site and can process network, security, rate-limit, Turnstile, and Worker request data.
• Cloudflare Turnstile is used on launch forms to distinguish legitimate requests from automated abuse.
• Resend delivers accepted quote requests to SiteRefit by email and processes the submitted contact information and message.

Private-review activity is stored in Cloudflare D1 and is visible only through the authenticated owner portal. This is used for private-review follow-up, not advertising.

Appearance preference

If you change the light or dark appearance, this site saves that choice in your browser’s local storage under siterefit-theme. It is used to remember the appearance on your next visit, not to identify you. You can remove it by clearing this site’s browser data. Without a saved choice, the site follows your device setting.

Operational logs and security

The application writes redacted operational event types such as configuration failure, rate limiting, preview denial, malformed preview records, Turnstile failure, delivery failure, and accepted delivery. Application logs are designed not to include access codes, Turnstile tokens, secrets, full IP addresses, or submitted message bodies.

Retention and deletion requests

Short-lived preview sessions and access-attempt counters expire automatically as described above. Inquiry and delivery records are retained only as long as needed to respond, maintain necessary business records, and resolve security or delivery issues.

Private-review visits and page records older than 13 months are removed by a scheduled cleanup. Browser cookies can be removed at any time by clearing this site’s browser data.

Reply to an existing SiteRefit email conversation, or use the quote form, to request access, correction, or deletion.

Changes

This notice will be updated when processors, forms, analytics, retention practices, or the preview system materially change. The effective date above identifies the current version.