Last updated 30 August 2026. This describes what the service actually does today, including the parts that are not flattering. If something here stops being true, it is a bug in this page.
There are no analytics, no tracking pixels, no advertising, and no third-party scripts on this site — you can confirm that by viewing source on any page. The only cookie is the session cookie that keeps you signed in. We do not sell or share your data, and we do not email you anything except password resets.
We never see your card details. Payment happens on Stripe's systems.
This is the part worth reading carefully. When you watch a URL, we fetch that public page and store a normalized copy plus the diffs between versions. Those snapshots belong to a shared corpus, not to your account: if three people watch the same page, it is fetched once and they read the same stored copies.
Two consequences. First, snapshots and diffs are not deleted when you delete your account — they are records of a public page, other accounts may be watching it, and they were never personal data. Second, the fact that some account watches a given URL is effectively durable. Do not watch a URL whose address is itself a secret — an unguessable share link, a preview URL, a page behind a token in the query string. Watch public pages.
Sessions expire after 30 days and are purged. Rate-limit records are purged after a day. Password-reset tokens are purged as soon as they are used or expire.
Snapshots and diffs are deleted once they are old enough that no plan can read them. Your plan's "diffs kept for 30 days" or "kept for a year" describes how far back you can read; deletion happens against the longest plan window plus a margin, so a Pro reader never loses something they were entitled to see, and history we reconstructed from the Internet Archive — which reaches back about a year and would otherwise sit right on the boundary — is not quietly eaten at the edge.
Two things are kept regardless of age: the current snapshot of a page, because it is what the next change is compared against, and any snapshot an existing diff still refers to. Deleting either would break something you can still see.
You can delete it yourself, and it is a real delete:
DELETE /api/auth/me { "password": "your password" }
It needs a signed-in session and your current password — an API key on its own cannot do it, because a key can sit in a config file on a laptop. Your account, watches, API keys, sessions, read positions and recovery codes are removed. Cancel any active subscription first; we will not cancel your billing as a side effect of a different request. As above, snapshots of the public pages themselves remain in the shared corpus.
Passwords are hashed with PBKDF2-SHA256 at 100,000 iterations. API keys are 240 bits of randomness, stored as SHA-256. Sessions are revocable server-side rows. Sign-in is rate-limited per address and locks out escalating on repeated failure.
That said: this is a small, new service run by one operator. It has no SOC 2, no penetration test, and no security team. Judge it accordingly, and do not put anything in it that would hurt you if it leaked.
Questions about any of this, or a request we have not built a button for yet, can go through the dashboard. If you are in a jurisdiction that gives you rights over your data, ask and we will do it by hand — there are few enough accounts that this is honest rather than a brush-off.