Privacy Policy

This policy explains what Sitemark — the web app and the Chrome extension — collects, why, who can see it, how long we keep it, and what you can do about it. Sitemark is provided by Better Labs Private Limited, which is responsible for your data. If anything is unclear, email privacy@sitemark.in.

1. What we collect

• Account data: your name, email address and profile picture. These come from Google when you sign in with Google, or from you when you sign in with an email link or edit your profile. You can upload your own picture.
• Optional onboarding answers: what you do and how you heard about Sitemark. Both can be skipped.
• Review content: the pins, notes, suggestions, comments, attachments and page notes you create, and the name and address of the websites you review.
• Screenshots and page details: when you place a pin, the extension captures a screenshot of the visible page and records where on the page the pin was placed. It only does this on sites you have turned it on for, and only when you place a pin. We do not track your browsing history.
• Browser details: with each pin, your operating system, browser and version, and window size, so the issue can be reproduced.
• Billing details: if you subscribe, your plan, billing dates, the Razorpay subscription ID, and the country your payment came from, which decides the currency and GST. Razorpay handles your card, UPI or bank details. We never see or store them.
• Activity: when you sign in and when you last used Sitemark, and the notifications created for you.
• Usage analytics: which pages you view, how long pages take to load, key actions — signing up and in, creating a project or a pin, inviting someone, and starting or completing an upgrade — and errors the app runs into. Inside the app this is linked to your account ID — never your name, email or what you wrote. See Analytics.
• IP address: sent with every request your browser makes. We use it to show prices in your currency, to protect password-protected links, and for security; our analytics provider uses it to estimate your approximate location. See IP addresses.
• Terms acceptance: the date your account was created, which is when you accepted our Terms of Service by signing in.

2. How we use it

• To sign you in and keep your session secure.
• To show your feedback to the people you work with, and notify them of changes.
• To email you sign-in links, invitations, a notice when someone assigns you a Sitemark, a welcome when you sign up, and notices about your trial and plan.
• To send product news and tips, only if you opt in. It is off by default and can be turned off in your profile at any time.
• To understand how Sitemark is used — which features help, where people get stuck, and which pages are slow — so we can improve it.
• To show prices in the right currency and keep your account secure.

We do not sell your data, share it with advertisers, or use it for advertising.

3. Who can see what

• Project members see the project's pins, comments, attachments and screenshots, and the names and pictures of the other members.
• Owners and editors also see members' email addresses and pending invitations, because they manage who has access. Viewers do not.
• Anyone with a public share link can read that project's report — its pins, notes, suggestions and screenshots, and members' names and pictures — but never email addresses or comment threads. Owners and editors control these links and can add a password or turn them off.

When you leave a project or delete your account, what you wrote in shared projects stays so the team keeps its history, but it is shown as “Former member” — your name and picture are removed from it.

4. Service providers

We use a small number of providers to run Sitemark. Each only processes data to provide their service to us:

• Google — sign-in with Google, and hosting of the Sitemark API (Google Cloud).
• Neon — the database that stores accounts and review content.
• Google Cloud Storage — storage of screenshots, profile pictures and attachments.
• Razorpay — payment processing for paid plans.
• Resend — delivery of sign-in, invitation and notification emails.
• PostHog — product and website analytics.
• Our hosting providers for the Sitemark website.

5. How long we keep it

• Your account and content: until you delete them, or your account.
• Sign-in links: deleted a day after they expire or are used.
• Unaccepted invitations: deleted 30 days after they expire.
• Notifications: read ones after 90 days, all after 180 days.
• Analytics events: up to 12 months.
• Server logs containing IP addresses: up to 30 days.
• Accounts unused for over a year may be scheduled for deletion. If so, we email you first and give you 30 days; signing in once keeps your account.

6. Your choices and rights

• Download your data as a JSON file from Profile → Privacy & data.
• Correct it — edit your name, picture and answers in your profile.
• Delete your account from Profile → Privacy & data. Projects only you are in are deleted with it.
• Stop product news— turn it off in Profile → Privacy & data.
• Turn off website analytics — from the cookie banner, or Cookie settings in the website footer.
• For anything else, email privacy@sitemark.in.

7. Cookies

Essential. Your sign-in session, which is HttpOnly so page scripts cannot read it. Because it is needed for signing in to work, it can't be turned off.

Analytics. PostHog sets a cookie (its name starts with ph_) that tells one visit from the next, so we can count visitors and see how pages are used. On our public website — the home page, policies, help center, sign-in page and shared report links — analytics is on unless you turn it off, from the cookie banner or Cookie settings in the footer. Your choice is saved in your browser for a year. Inside the Sitemark app, once you are signed in, product analytics is always on: it is part of running and improving the service, and it can't be turned off there. Session recording is off everywhere, so the websites you review are never recorded.

We do not use advertising or cross-site tracking cookies.

The web app also keeps a few things in your browser's local storage: your theme, your name and picture for faster loading, recent searches, whether you have collapsed the getting-started checklist, and your cookie choice. None of it is sent to anyone else. The extension stores only your preferences, never your password or session, and does not use analytics. The Razorpay checkout sets its own cookies while you pay, under Razorpay's privacy policy.

8. IP addresses

Your IP address is sent with every request your browser or the extension makes to Sitemark — that is how the internet works. Here is what we do with it:

• Pricing. We look up which country it belongs to, using a copy of the IPinfo database on our own servers (your address is not sent to IPinfo), to show prices in your currency and apply GST. When you subscribe we keep the country for our tax records — not the address.
• Protecting shared links. Wrong passwords on a password-protected report link are counted per IP address to slow down guessing. The count is kept in memory only and cleared within minutes.
• Analytics. PostHog receives it with analytics events and uses it to estimate your approximate location, such as your country and city. On the website this only happens while analytics is on.
• Security. Our hosting providers record it in standard server logs, which we use to investigate errors and abuse. These logs are kept for up to 30 days.

We never sell IP addresses or use them to follow you across other websites.

9. Children

Sitemark is not meant for children under 13, and you must be at least 13 to sign in. If you believe a child has created an account, contact us and we will delete it.

10. Security

Data is encrypted in transit and at rest. Sessions are signed and short-lived tokens are used for realtime connections; share-link passwords are stored only as salted hashes. If a breach affects your data, we will tell you promptly, explain what happened, and what we are doing about it.

11. Changes

If we change this policy in a way that matters, we will update the date above and tell signed-in users before the change takes effect.

12. Contact

Questions or requests about your data: privacy@sitemark.in. Complaints can go to our Grievance Officer. See the Contact page.