Page Fix service
Privacy
What we never do
- We never log in to, connect to, or write to your site or your client's site. A fix is a patch you apply yourself.
- We never store your API key or session in plain text. Only a hash is kept.
- We never sell or share your data with advertisers.
What we keep, and for how long
| Data | Why | Kept |
|---|---|---|
| Your email address and company name | Your account, sign-in links, receipts | While the account exists |
| Sign-in link tokens (hashed) | Email sign-in | 15 minutes, single use |
| Session and API key hashes, labels, last-used times | Access to the portal and the API | Sessions 30 days; keys until you revoke them |
| Audit results: the page address, scores and the list of issues | Your audit history and fix plans | While the account exists |
| Fetched page content used to score an audit | Scoring only | Not stored. It is read, scored and discarded in the same request. |
| Job snapshots: a copy of the page before the fix, the patch, and a copy after verification | Building the patch, verifying it, and rendering the diff in your report | 30 days from when each file is written, then deleted automatically by a storage lifecycle rule |
| Job records: states, timestamps, outcomes, the credit ledger | Billing and your job history | While the account exists; ledger entries are never edited |
| Payment details | Buying credit packs | Held by Stripe, not by us. We keep the Stripe session and event ids so a purchase is granted exactly once and a receipt link can be shown. |
| Demo audits from the landing page | The free "audit a page" box | Scores and issues under a shared demo account; no visitor identity is attached. Cloudflare Turnstile and a per-address rate limit run in front of it; the address is used for the limit and not stored with the audit. |
Where it lives
Account, audit, job and ledger records are stored in Supabase (Postgres, hosted in the United States). Page snapshots and patches are stored in Cloudflare R2 under a private prefix that is never served publicly. Requests run on Cloudflare Workers. Sign-in emails are sent through Resend. Payments run through Stripe. Each of these providers processes data for us under their own terms.
Cookies and tracking
The portal uses one cookie: your session, HttpOnly, for staying signed in. The landing page and the portal carry no advertising or analytics trackers. Cloudflare Turnstile runs on the landing page and the sign-up form to block bots, under Cloudflare's privacy policy.
Your choices
- Revoke any API key or sign out of any session from the portal at any time.
- Ask us to delete your account and its records: email andrew@gethoneybun.com. Ledger entries tied to payments are kept as long as tax law requires; everything else is removed.
- Ask what we hold about you at the same address.
Contact
HoneyBun (ACFit LLC, California). andrew@gethoneybun.com. We update this page when practice changes; the date at the top is the record.