Privacy policy

• Analytics on this site and the docs site, if you allow them. Nothing is loaded and no cookie is set until you choose "Allow" on the box that asks on your first visit; a browser sending Do Not Track is never asked and never tracked. With consent, PostHog records page views, clicks and navigation, and replays of sessions on our own pages, to show which parts of the site people use, and sets a cookie and a browser-storage entry to recognise a returning browser. Everything goes to /ingest on this domain and is passed server-side to PostHog's US service — your browser never talks to a third-party domain, and no other third-party script or external font is loaded. Analytics run only on the live sites, never on previews or local copies. This covers our pages only; it has nothing to do with the site you ask us to test.
• Hosting logs. The hosting provider keeps ordinary web-server logs (IP address, path, time) under its own retention. The theme switch remembers your choice in your own browser and never leaves it.
• A run request, if you send one: the site URL you typed, your email address, the fact that you confirmed you are allowed to test the site, which run you picked, what you asked for if you picked a special run, whether you ticked the optional box allowing findings to be shared publicly, and the time. That is one record in a private object-storage bucket, readable only with a token held by the operator.
• Rate limiting keeps a count against your IP address for about a minute, so one sender cannot flood the form. In the key-value store the address is hashed first; in the fallback that runs when that store is unavailable it sits in the server's memory as-is until it is overwritten. Either way it is never written to disk and never joined to your request record.
• The early-access list, if you join it: your email address and the fact that you ticked the box asking us to write when a spot opens. One record in the same private bucket, kept until you ask for it to go — one email removes it.
• A human check on those two forms. Cloudflare Turnstile decides whether the sender looks automated. It reads the request and signals from your browser to make that call; it is on the forms only, not on ordinary pages, and it sets no advertising cookie.
• If you email directly: whatever you put in the email.

The operator starts each run by hand on their own computer — nothing runs automatically when you submit the form. The URL is checked for shape, not fetched, until the operator opens it. Simulated prospects then visit the site you named in a real browser. The run produces screenshots, a screen recording, a step-by-step log of what each prospect saw, typed and decided, the page text behind every completion the tool checked, generated prospect profiles with fictional names, and the report.

If your site sends verification emails, they go to throwaway addresses on a domain the operator controls, and the tool reads them to pull out codes and links. Those emails sit in the operator's mailbox and are rendered into the run folder as images. Anything visible on your pages during the run — including any personal data your own pages display — appears in those screenshots and logs.

All of it is stored on the operator's computer, not on this website. The report is emailed to the address you gave, as a PDF.

• The hosting provider runs this site; a private bucket holds the request records.
• A key-value provider holds the one-minute rate-limit counters.
• PostHog (US) receives the analytics and session replays described above.
• Cloudflare runs the human check on the two forms and sees those submissions' signals.
• Google delivers the report email from the operator's Gmail account, and the throwaway mailboxes are read over IMAP from that account.
• The AI provider whose model plays the prospects — Anthropic through Claude Code, or another provider the operator chooses, such as opencode or Codex — receives the text and screenshots of your pages, and the contents of the verification emails, during the run, under that provider's terms. The prospects' email addresses are throwaway.

Nothing is sold or shared for advertising. We write to you about your own request, and, if you joined the early-access list, once when a spot opens — nothing else.

You have not chosen yet, so analytics are off. Turn them on

Until you ask. Email talk@leakdown.dev from the address you used, and the request record, the run folder with its screenshots and recording, the throwaway mailboxes and the sent copy of the report are deleted within 30 days. Deleted mailbox messages go to the mail provider's bin first, which keeps them about 30 more days. You can also ask what is held about you, or for a correction, the same way.

Runs are kept while the alpha runs, so the tool can be improved against real journeys. They are not sold, not published, and not handed to anyone beyond the recipients listed above.

A tested site is named publicly only with its owner's written consent — the tick box on the request form, or an email saying so. Until then it appears under a placeholder such as "site-g". Change your mind and it comes down.

The service is for people who run, or are authorised to test, a website. It is not intended for anyone under 18.

When you run Leakdown yourself, nothing is sent to this website. Sessions, recordings and reports stay on your machine. Your chosen AI provider sees the pages your prospects visit, and if you configure a mailbox, verification emails land in it. What that provider keeps is governed by your agreement with them.

Changes are made here, with the date at the top. Material changes to what is collected are also noted on the request form.