Privacy Policy & Terms of Service

Last updated: July 22, 2026

Privacy Policy

Shelob Web ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights regarding that data.

By using Shelob Web, you agree to the collection and use of information as described in this policy.

Data We Collect

Account Information

When you create an account, we collect your email address. We use this to authenticate you via magic link sign-in and to send you service-related communications (such as team invitations).

Website Data

When you add a website to your dashboard, we collect and store:

• Your website's domain name and sitemap URL
• SEO audit results (page titles, meta descriptions, heading structure, schema markup)
• Accessibility audit results (issues found by Google Lighthouse)
• Core Web Vitals and performance metrics
• Broken link scan results

This data is collected by crawling the publicly accessible pages of websites you add to your account. We do not access any password-protected or private pages.

Integration Data

If you connect optional integrations, we may store:

• Google Analytics (GA4): Sessions, page views, bounce rate, traffic sources, and landing-page data for the GA4 properties you choose to connect
• Google Search Console: Search keywords, clicks, impressions, and position data for your verified properties
• Cloudflare Analytics: Traffic, cache, and performance metrics for your Cloudflare zones

Integration tokens are encrypted and stored securely. You can disconnect integrations at any time from your dashboard settings.

Third-Party Services

Shelob Web uses the following third-party services to operate:

• Cloudflare Workers & D1: Hosting and database infrastructure. Your data is stored on Cloudflare's global network. See Cloudflare's Privacy Policy.
• Stripe: Payment processing. We do not store your credit card information — it is handled entirely by Stripe. See Stripe's Privacy Policy.
• Google PageSpeed Insights API: Used to run Lighthouse audits on your websites for performance and accessibility data.
• Brevo (formerly Sendinblue): Used to send magic link emails and team invitation emails. See Brevo's Privacy Policy.

We do not sell, trade, or share your personal data with any third party for marketing purposes.

Google User Data

If you connect Google Analytics or Google Search Console, Shelob Web accesses your Google data using the read-only scopes analytics.readonly and webmasters.readonly. Specifically:

• What we access: GA4 reporting data (sessions, page views, bounce rate, traffic sources, landing pages) and Search Console performance data (queries, clicks, impressions, positions) for the properties you explicitly select.
• How we use it: Solely to display your own analytics and search data to you (and team members you invite) inside your Shelob Web dashboard and reports, alongside your site audit results. We do not use Google user data for advertising, profiling, or training machine-learning models.
• How it is stored: Your Google OAuth refresh token is encrypted with AES-256-GCM before being stored in our database. Reporting data is fetched on demand and cached briefly to render your dashboard; we do not build long-term archives of your Google data beyond daily summary snapshots of your own metrics.
• Who can access it: Only you and team members you invite to your dashboard. Google user data is never shared with, sold to, or transferred to any third party, except as required to operate the service on our hosting infrastructure (Cloudflare) or as required by law.
• Deletion: Disconnecting Google in your dashboard settings immediately deletes the stored OAuth token and your GA4/Search Console selections. Deleting a website or your account deletes the associated cached data.

Shelob Web's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How We Protect Your Data

We protect all user data — and sensitive data such as OAuth tokens in particular — with the following mechanisms:

• Encryption in transit: All connections to Shelob Web are served exclusively over HTTPS/TLS. We never transmit your data over unencrypted connections.
• Encryption at rest: Sensitive credentials (Google OAuth refresh tokens and Cloudflare API tokens) are encrypted with AES-256-GCM using a secret key held outside the database before they are stored. Database contents are additionally encrypted at rest by our infrastructure provider (Cloudflare).
• Access controls: Sensitive credentials are never returned by our APIs, never shown in the dashboard, and never written to logs. Every data request is authenticated and scoped to your account; team members can only view dashboards they have been explicitly invited to.
• Secure sessions: Authentication uses expiring magic links and HttpOnly, Secure session cookies. No passwords are stored anywhere.
• Payment isolation: Card details are handled entirely by Stripe and never touch our servers.
• Minimal collection: We request only read-only Google scopes and collect only the data needed to render your dashboard.
• Incident response: If we become aware of a breach affecting your personal data, we will notify affected users without undue delay at the email on their account.

Cookies

Shelob Web uses a single session cookie to keep you signed in. This cookie:

• Is essential for the service to function (authentication)
• Is HttpOnly and Secure — it cannot be accessed by JavaScript and is only sent over HTTPS
• Expires when your session ends or after a set period

We do not use any analytics cookies, advertising cookies, or third-party tracking cookies.

Data Retention & Deletion

We retain your account and website audit data for as long as your account is active. Audit history is stored to show you trends over time.

If you wish to delete your account and all associated data, please contact us at the email address below. We will process deletion requests within 30 days.

When you remove a website from your dashboard, all audit data for that website is deleted.

Terms of Service

Acceptable Use

You agree to use Shelob Web only for monitoring websites that you own or have permission to monitor. You may not:

• Use the service to scan or audit websites without the owner's consent
• Attempt to bypass rate limits or abuse the auditing system
• Share your account credentials or allow unauthorized access
• Use the service for any illegal purpose

Service Availability

We strive to keep Shelob Web available 24/7, but we do not guarantee 100% uptime. Audits run daily on a scheduled basis, and occasional delays or interruptions may occur due to maintenance or third-party service outages.

Data Accuracy

Audit results are based on automated tools (Google Lighthouse, sitemap crawling, etc.) and may not catch every issue. Shelob Web is a monitoring aid, not a guarantee of website compliance or performance.

Account Plans & Limits

• Trial: 7-day free trial with 1 website
• Pro ($29/mo): Up to 5 websites with all features and integrations
• Agency ($59/mo): Up to 25 websites with all features, multi-client management, and team collaboration

Billing & Payments

All payments are processed securely through Stripe. We do not store your credit card details.

Important: Charges on your credit card or bank statement will appear as "Robbie Torres". This is the name of the business account that processes payments for Shelob Web.

Subscriptions are billed monthly on the date you first subscribed. You can manage your subscription, update payment methods, or view invoices through the billing portal in your dashboard settings.

Cancellation & Refunds

You can cancel your subscription at any time from your dashboard settings. When you cancel:

• Your subscription remains active until the end of the current billing period
• You will not be charged again after cancellation
• Your data remains accessible until the billing period ends

We offer refunds on a case-by-case basis. If you believe you were charged in error or are unsatisfied with the service, please contact us within 7 days of the charge.

Contact

If you have questions about this policy, need to request data deletion, or need billing support, contact us at:

Email: support@shelobweb.com