Privacy

What do we measure?

The public data of the site you measure: the response headers, the homepage HTML, robots.txt, the sitemap, the certificate and the DNS records. Then a headless Chrome loads the homepage once, like a mobile visitor.

For a few well-known paths (such as .env, debug.log) we only check whether the file is reachable. We do not store its content.

Speed data from real visitors comes from Google’s public Chrome UX Report dataset. It is aggregated data about Chrome users, identifies no single visitor, and we query it with the measured site’s address only.

We also measure the homepages of the most visited Hungarian sites on our own; the list comes from the public Chrome UX Report top list. robots.txt keeps you out of this; the bot page has the details.

What do we store about you?

Measuring needs no account, and the site uses no analytics, advertising or tracking code.

To prevent abuse, we limit how many measurements and checks you can start. For this we store a salted one-way hash of your IP address (for IPv6, of its /64 prefix), never the address itself. The hash is deleted within about a day.

Bot protection: Cloudflare Turnstile

When you start a measurement or an owner check, Cloudflare Turnstile checks that a human is starting it. The Cloudflare script only loads once you start using the form.

The check sends data from your browser to Cloudflare, and our server sends Cloudflare the check token and your IP address. What Cloudflare processes and for how long is described in Cloudflare’s privacy policy.

Cookies

As a visitor, you get no cookie. Only the owner check uses two, and each one is needed for that alone:

• When you start a check, a cookie ties it to this browser, so it can only be finished from here. It lives for at most 48 hours, as long as the check itself.
• After a successful check, the owner sign-in cookie, for at most 1 hour. The Sign out button deletes it at once.

Owner check

When you prove that a domain is yours, we store the domain, the method (DNS or file) and the times of the check, and the token only as a one-way hash. The check is deleted after 9 days.

Opting out

If you do not want your site measured, you can remove it: its report is deleted, and we stop measuring it. We keep the removed domain until you undo the removal, because without it we could not skip the site.

Contact

The general HelloWP privacy notice is here: hellowp.io/hu/adatvedelem.

The data controller is GoBird OÜ. Registry code: 17311365. Registered address: Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia.

GoBird OÜ’s company-wide privacy policy: gobird.io/privacy.

If you have a question about your data, write to us: privacy@gobird.io