Privacy Policy

Who We Are

This website is operated by Web Aloha, a web design, SEO, and GEO agency. In this policy, “we,” “us,” and “our” mean Web Aloha.

Questions and privacy requests can be sent to yes@webaloha.co.

Information We Receive

Depending on how you use the website, we may receive:

• information you submit through contact, audit, referral, or newsletter forms, such as your name, email address, company, website URL, and message;
• technical request information processed by our hosting and security providers, such as an IP address, browser details, requested URL, timestamps, and security signals;
• website usage information from the analytics services described below; and
• a public URL or domain you ask one of our website tools to inspect. Tool results are returned to you, while ordinary infrastructure logs may still record the request.

Please do not submit confidential, financial, health, government-identification, or other sensitive information through these forms or tools.

How We Use Information

We use information to:

• provide a requested tool result, audit, or response;
• communicate about an inquiry or potential project;
• deliver newsletters to people who subscribe and maintain unsubscribe records;
• operate, secure, troubleshoot, and improve the website;
• understand website traffic and content performance; and
• produce aggregate website statistics from limited technical tool results, as described below.

We do not use submitted form information for automated decisions that produce legal or similarly significant effects.

Forms, Email, and Newsletters

We use Brevo to deliver form emails and manage newsletter contacts. Information submitted through a form may therefore be sent to and stored by Brevo and in our business email account. Newsletter subscription is separate from sending a contact or audit request: we add an address to the newsletter list only when the newsletter form is submitted.

You can unsubscribe using the link in a newsletter or by emailing us. We may retain a minimal suppression record so that we do not resubscribe an address accidentally. See Brevo’s privacy policy for information about its processing.

Website Tool Research

When enabled, our private research collection uses server-generated technical results from public URL scans in the Website Font Checker, Website Technology Checker, PHP Version Checker, Redirect Checker, Google Index Checker, and Schema Markup Validator. Font scans can also contribute technology detections based on the fetched HTML and response headers. Pasted page source, pasted schema, and results derived from pasted input are excluded from this collection.

Research records can contain the scan date, source tool, detector and method versions, outcome, completeness, confidence, cache status, and limited technical facts, such as font families, technology categories, exposed PHP versions, redirect counts, indexability signals, and schema types or issue counts. A technical indexability result does not establish whether Google has indexed a page. The records describe websites people chose to check with our tools; they are not a representative sample of all websites.

We use coded website and page keys, generated with a secret-key hash (HMAC), to recognize repeated scans and avoid counting them as independent websites or pages. These keys do not contain the original URL. Coding reduces direct identification but is not a promise of irreversible anonymization. Research records do not include raw target URLs, query strings, fragments, credentials, raw response headers, HTML, CSS, page text, pasted source, schema property values, your name, email address, IP address, or analytics ID. We do not attach visitor analytics or form records to research records.

When research collection is enabled, individual records are kept in a separate private Neon database configured in Frankfurt, Germany. Records are excluded from research use after 90 days and removed by a scheduled daily cleanup. We may retain separately generated aggregate statistical snapshots for longer. Any published report presents aggregate findings and their source and limitations; we do not publish a list of websites checked by visitors. See Neon’s privacy notice.

No signup is required to use these tools. The submitted URL is still processed to run a scan, and the hosting, security, and analytics processing described elsewhere in this policy still applies. To limit automated abuse of research collection, the research system transiently processes the IP address supplied by Vercel’s edge infrastructure to derive a purpose-specific daily hash (HMAC) using the UTC date. It stores the daily hash with up to 20 day-specific coded website keys separately from research records. These daily website keys differ from the persistent coded website keys in research records; the abuse-limit storage contains no raw IP addresses or URLs. These abuse identifiers cease to be used at the next UTC midnight and are removed by a cleanup scheduled daily at 00:05 UTC. If a cleanup job is unavailable, physical deletion can be delayed until cleanup resumes; expired records remain excluded from use. The research system does not persist the raw IP address or attach the daily hash to a research record. This does not make every interaction with the website anonymous.

Analytics

We use Vercel Web Analytics, Vercel Speed Insights, and GA4 as follows:

• Google Analytics 4 (GA4) loads when a page is visited and measures page views, sessions, referrals, approximate location, and browser/device information. Its standard web implementation uses first-party cookies such as _ga and _ga_* to distinguish users and sessions. Google says IP addresses are used during collection for purposes including approximate location and are not logged or stored in GA4. See Google’s description of Analytics data collection and Google’s privacy policy.
• Vercel Web Analytics provides aggregated page-view information such as page, referrer, country, browser, and device type. Vercel states that this product does not use third-party cookies or associate analytics data with an individual or IP address. See Vercel Web Analytics privacy information.
• Vercel Speed Insights collects a sample of page-performance measurements, including page paths, loading and responsiveness metrics, and browser, device, and network characteristics. We remove query strings and fragments from the page URLs sent with these measurements. See Vercel Speed Insights privacy information.

Analytics reports help us understand overall usage; we do not ask visitors to provide a name or email address to view ordinary pages. Analytics identifiers and technical data should not, however, be described as inherently anonymous in every context.

Security Checks With Cloudflare Turnstile

When you use a form or tool protected against automated abuse, the site may load Cloudflare Turnstile. Turnstile evaluates browser and interaction signals and issues a short-lived verification token. We validate that token before processing the protected request; we do not use it for advertising. See Cloudflare’s Turnstile overview and Turnstile privacy notice.

Hosting and Server Logs

The website is hosted on Vercel. Vercel may process request and infrastructure data needed to deliver and secure the site, including IP addresses and server logs. See Vercel’s privacy notice.

Cookies and Your Choices

The standard GA4 configuration may set the following first-party cookies:

Actual duration can be shorter because of browser controls or our service settings. Vercel Web Analytics is described by Vercel as operating without third-party cookies. Turnstile may use necessary storage or signals when a protected action is requested.

You can block or delete cookies in your browser or use the Google Analytics opt-out browser add-on. Blocking security functionality may prevent a protected form or tool from working.

We do not use advertising pixels or retargeting cookies on this website at the date shown above.

When We Disclose Information

We do not sell or rent personal information. We disclose relevant information to service providers that help us operate the site, including Vercel, Google Analytics, Cloudflare Turnstile, Brevo, Neon for research storage when enabled, and our business email provider. Those providers process information under their own terms and privacy documentation.

We may also disclose information when reasonably necessary to comply with law, enforce our terms, protect rights or safety, investigate abuse, or complete a business reorganization. We do not describe provider processing as “no sharing,” because information must be transmitted to those providers for their services to work.

Retention

We keep inquiries and related correspondence for as long as reasonably needed to respond, manage a potential or active business relationship, maintain business records, resolve disputes, or meet legal obligations. Newsletter contact information is generally kept until you unsubscribe or ask us to delete it, subject to retaining a limited suppression record.

Analytics and infrastructure data are retained according to our provider configurations and the providers’ applicable retention rules. These periods can change, so we avoid promising a fixed period that the live service configuration may not support.

Your Requests

Depending on where you live and the circumstances, applicable law may give you rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. These rights can have exceptions and are not identical in every jurisdiction.

Email yes@webaloha.co to make a request. We may need to verify your identity and will respond within the period required by applicable law. You may also have the right to complain to your local data-protection authority.

Third-Party Links

The website links to external sites. Their privacy practices are governed by their own policies, not this one.

Changes

We may update this policy as our website or providers change. The current revision date appears at the top of the page.

Contact

Email: yes@webaloha.co

Website: webaloha.co