Privacy policy

Privacy at a glance

Introduction

AccessHawk ("the Service") is built and operated by JonesLabs LLC (joneslabs.dev) ("we," "our," or "us"). This Privacy Policy explains what information we collect when you use accesshawk.ai, how we use it, who we share it with and how long we keep it.

By using AccessHawk, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use the Service.

Information we collect

Information you provide

Account information

To create an account we need your email address. You can add a display name in Settings. If you sign in with Google, GitHub or Microsoft, we receive your name, email address and profile picture URL from that provider, and we store the provider's account ID and the email address it gave us so we can connect the sign-in to your account. We ask only for basic sign-in access: email and profile from Google, user:email from GitHub, and openid, email, profile and User.Read from Microsoft. You can link or unlink providers in Account Settings.

URLs for scanning

When you submit a URL, our scanning browser loads the page and captures a screenshot, the accessibility tree, the HTML and Lighthouse accessibility results. We store the report, the scan results and the screenshots in your account, along with your project names and scan settings. Issues in a report can quote short snippets of the page's HTML. The full HTML and accessibility tree are used for the analysis and aren't saved with the scan.

API keys (BYOK)

Paid plans can save an OpenRouter API key to run scans on models from OpenAI, Google and xAI, including after the monthly allowance is used. We check the key with OpenRouter, then encrypt it with AES-256-GCM using a key derived for your account. It's decrypted only on our servers when a scan uses it, and it's never logged or shown back to you.

Custom scan headers (Team)

On the Team plan you can add cookies, bearer tokens or other headers so we can scan pages behind a login. They're encrypted with AES-256-GCM, saved with the schedule if you create one, and decrypted by our scan worker when the scan runs.

Bearer tokens and other headers are sent only with requests to the scanned page's origin, which means the same scheme, host and port as the URL you scan. Third-party resources the page loads don't receive them. Neither does another subdomain, the www or non-www version of the site, or the http version of an https page. Cookies, including a Cookie header you add, are set only for the scanned page's host and the directory of its URL path. We still recommend using credentials for a test account.

AccessHawk API keys and webhooks

If you create AccessHawk API keys, we store a SHA-256 hash of each key, its first characters and the name you give it. We can't recover a full key. A webhook URL you send with an API scan is kept with the queued scan job for up to about an hour after the job finishes, and we sign each webhook request.

Contact form and bug reports

Contact form messages reach us by email with your name, email address, message and the IP address you sent it from. Bug reports from inside the app also include your user ID, account email, the page you were on and your browser details. We send an automatic confirmation to the address you enter on the contact form.

Information collected automatically

Analytics data

We use Umami, an analytics tool we host ourselves and serve through accesshawk.ai/u. It records page views with the referring site, browser, operating system, device type and country. Umami doesn't use cookies or store IP addresses. Cloudflare Web Analytics, which Cloudflare runs on our pages, measures page views and page load performance, also without cookies. We don't record sessions.

Sign-in sessions

When you sign in, we create a session that records your IP address and browser user agent. Signing in ends any other session on your account. Sessions expire after 7 days or when you sign out.

Server logs

Our servers log requests, errors and scan activity. Log entries can include your user ID, the URLs you scan and, for some security events, your IP address. Our logger redacts fields such as keys, tokens and secrets before anything is written.

Information stored in your account

Your AccessHawk account holds:

• Your email address (encrypted) and optional display name
• Your profile picture URL, if a sign-in provider supplied one
• Linked sign-in providers: the account ID and email address each provider reported
• Projects, scan history, reports, scan results and screenshots
• Scheduled scans and their settings
• Your encrypted OpenRouter API key, if you save one
• Hashes and names of your AccessHawk API keys, if you create any
• Your plan, subscription status and Polar customer ID (Polar handles payment details)
• Preferences, such as your theme and whether scan completion emails are on
• When you last signed in

You can delete scans, projects, schedules and API keys yourself, or delete your whole account from Account Settings. Data retention explains what happens then.

How we use information

We use the information we collect to:

• Provide the Service: Load the pages you submit and send the captured data to Anthropic's Claude for analysis, or to OpenRouter if you use your own key
• Improve the Service: Look at page-view and usage totals to see which features people use
• Maintain security: Detect abuse, rate-limit requests and investigate problems
• Communicate: Send sign-in codes and email change confirmations, scan completion emails (on by default; you can turn them off in Settings), notifications for scheduled scans where you've turned them on, team invitations and membership notices, the warning before an inactive Starter account is deleted, and replies when you contact us
• Track sign-ups: When someone creates an account, we send ourselves an email with the new account's email address and display name
• Comply with legal obligations: Meet legal requirements and respond to lawful requests from authorities

Data sharing and third parties

Third-party services we use

• Google Sign-In

  Optional sign-in. We receive your name, email address and profile picture URL. No other Google data is accessed.

  Google privacy policy

• GitHub Sign-In

  Optional sign-in. We receive your name, email address and avatar URL. We get no access to your repositories or code.

  GitHub privacy statement

• Microsoft Sign-In

  Optional sign-in through Microsoft Entra ID. We receive your name, email address and profile picture URL if one is available. No other Microsoft data is accessed.

  Microsoft privacy statement

• Polar

  Merchant of Record for subscriptions. Polar runs checkout and handles payment details, invoices and sales tax. We never see your card number. Invoices show "Polar Software, Inc."

  Polar privacy policy

• Anthropic (Claude API)

  AI analysis of included scans. Anthropic receives each included scan's screenshot, accessibility tree, HTML and Lighthouse results, and Claude returns the issues we build the accessibility report from.

  Anthropic privacy policy

• OpenRouter

  Used only for scans you run with your own OpenRouter API key. It receives your key and the scan data, and routes the data to the model you chose so it can write the accessibility report. We also check your key with OpenRouter when you save it.

  OpenRouter privacy policy

• Resend

  Sends our emails. It receives your email address and each email's content, which can include sign-in codes, scanned URLs, project names and team names. Contact form messages reach us through Resend too.

  Resend privacy policy

• Cloudflare

  DNS, CDN and DDoS protection. All traffic to accesshawk.ai passes through Cloudflare, which also runs Cloudflare Web Analytics on our pages. We store screenshots and database backups in Cloudflare R2.

  Cloudflare privacy policy

• Umami (self-hosted)

  Page-view analytics that we host ourselves. No data is sent to Umami's company.

  About Umami

• Hivelocity

  Hosts our servers, database and job queue on a server we manage in Hivelocity's data center in Tampa, Florida, USA. Our server logs stay on that server.

  Hivelocity privacy notice

Data other people can see

• Share links (Pro and Team): Anyone with a share link can view that report, its screenshot and the scanned URL until the link expires (after at most 7 days) or you turn sharing off. We count how many times a shared report is viewed.
• Teams: On the Team plan, projects and scans belong to the team leader's account. The team leader and every member can see the team's projects and all scans run in them, including scans other members ran. The team leader can see members' names and email addresses, and emails for the team's scheduled scans go to the team leader.

We do not:

• Sell your personal information or share it for advertising
• Ask Google, GitHub or Microsoft for more than basic sign-in access
• Share your OpenRouter API key with anyone other than OpenRouter
• Use your scan data for purposes other than providing the Service
• Look at your scan results except when needed to provide support or investigate abuse

Data retention

Scan data

Reports, scan results and screenshots stay in your account until you delete them or your account is deleted. Scans that fail or don't finish are deleted after 7 days. Finished results are also held in our job queue for about an hour so your browser can load them.

Inactive Starter accounts

We delete Starter (free) accounts that go 30 days without a sign-in. We email a warning 7 days before deletion, and signing in restarts the count. Accounts on a paid plan aren't deleted for inactivity.

Deleting your account

When you delete your account, we cancel any active subscription immediately. We then delete these records from our live systems: your user record, sessions, sign-in codes, projects, scans, screenshots, schedules, API keys, share links, team membership and audit records. If you lead a team, the team is closed and its members lose access to the team's projects. Polar keeps its own payment records as Merchant of Record. Copies in server logs, and emails we've already sent or received, aren't removed. We back up the database every night and keep the latest 14 backups. Those backups can hold your deleted data until newer backups replace them.

API keys (BYOK)

Your encrypted OpenRouter key stays in your account until you remove it in Account Settings or delete your account.

Sign-in codes, sessions and invitations

Sign-in codes and email change links expire after 4 hours. Sessions expire after 7 days. Team invitations expire after 7 days and are deleted 30 days later.

Server logs

Server logs are kept on our server for security and troubleshooting for a limited time: removed once a size limit is reached or within a day after the service is updated or restarted, and never more than 90 days for the server's system log.

Analytics data

Umami page-view data is kept on our own Umami server. Cloudflare keeps Web Analytics data under its own policy.

Data security

We protect your data with these measures:

• AES-256-GCM encryption: Your account email address, OpenRouter API key and Team custom scan headers are encrypted before we store them. See Privacy at a glance for the copies of email addresses we store in plain text
• HTTPS encryption: Traffic between your browser and our servers is encrypted with TLS
• Key handling: OpenRouter keys are checked with OpenRouter before we save them, and our logger redacts keys and tokens
• Content Security Policy: Content Security Policy headers limit where scripts and other resources can load from
• SSRF protection: We check the URLs you submit, and the requests the scanning browser makes, to keep scans away from private networks. The scanning browser also runs on an isolated network. Within our server, it can reach only AccessHawk's own services
• Hosting: Our servers and database run on a server we manage at Hivelocity in Tampa, Florida, USA. Screenshots are stored in Cloudflare R2

For more on how we handle your OpenRouter key, see our Security Guide.

No method of transmission or storage is 100% secure, and we can't guarantee absolute security. If a security incident affects your data, we'll notify you as the law requires.

Your privacy rights

All users

Wherever you live, you can:

• Delete your data yourself, or ask us to delete it
• Ask what personal information we hold about you and how we use it

Delete your data

You have several options to delete your data:

• Delete individual scans: From your dashboard, click on a project to view scans, then delete individual scan results.
• Delete individual projects: Delete entire projects along with all associated scans from your dashboard.
• Remove API key: From Account Settings, remove your stored API key at any time.
• Delete account: Delete your account from Account Settings. This cancels any active subscription immediately and removes your account data as described under Data retention.

European Economic Area (GDPR)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation:

• Right of access: Request information about the personal data we hold about you
• Right to rectification: Request correction of inaccurate personal data
• Right to erasure: Request deletion of your personal data
• Right to restrict processing: Request limitation of processing of your personal data
• Right to data portability: Request transfer of your data to another service
• Right to object: Object to processing of your personal data
• Right to withdraw consent: Withdraw consent at any time

Our legal basis for processing personal data is legitimate interest in providing and improving the Service.

California residents (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected
• Right to delete: Request deletion of personal information we have collected
• Right to opt-out: Opt out of the sale of personal information (note: we do not sell personal information)
• Right to non-discrimination: Not receive discriminatory treatment for exercising your rights

Cookies and tracking

AccessHawk uses a few cookies and browser storage items:

Authentication cookie

accesshawk_session keeps you signed in. It can't be read by page scripts and expires with your session.

Sign-in cookies

When you sign in with Google, GitHub or Microsoft, we set oauth_redirect, oauth_intended_plan and oauth_link_mode, which expire within 5 minutes. Our sign-in library and your sign-in provider may set their own short-lived cookies during that step.

Cloudflare security cookies

Cloudflare may set its own security cookies, for example when it shows a bot check.

Browser storage

We keep a few items in your browser's local storage: your theme, which announcements you've dismissed or already seen, and a pending scan so you can recover it after a reload. During sign-up we keep the plan you picked in session storage, and the demo page remembers whether you've unlocked it.

Analytics (cookie-free)

Our analytics tools don't set cookies. See Analytics data under Information we collect.

You can block or clear cookies in your browser settings. If you block the session cookie, you won't be able to stay signed in.

Children's privacy

AccessHawk is not intended for use by children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately using the "Privacy/Data Requests" option, and we will take steps to delete such information.

International data transfers

AccessHawk is operated by JonesLabs LLC in the United States. Your information is processed in the United States and in the other countries where the service providers listed under Data sharing and third parties operate.

By using the Service, you consent to the transfer of your information to the United States and those other countries.

Third-party websites

The Service may contain links to third-party websites (e.g., Anthropic, OpenRouter, WCAG documentation). This Privacy Policy applies only to AccessHawk. We are not responsible for the privacy practices of third-party websites.

When you submit a URL for scanning, our server accesses that third-party website to capture data. The owners of those websites may have their own logging and analytics that could record our server's access. We do not control and are not responsible for third-party website data practices.

Changes to this policy

When we change this Privacy Policy, we update the "Last updated" date at the top of the page. For material changes, we also post a notice in the app.

Your continued use of the Service after changes become effective constitutes your acceptance of the revised Privacy Policy.

Contact information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Website: https://accesshawk.ai
Company: https://joneslabs.dev

For privacy-related inquiries or to exercise your data rights, please visit our Contact page.

• For privacy requests: Select "Privacy/Data Requests"
• For general inquiries: Select "General Inquiry"

We will respond to verified requests within the timeframes required by applicable law.

For EU residents: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.