Privacy Policy

Last updated: August 9, 2026

This is a starting template, not finished legal advice. It's grounded in what this app actually does as of the date above, but real compliance (GDPR, CCPA, and similar laws) depends on specifics — your jurisdiction, where your users are located, and exactly which third-party services are active — that a generated document can't fully account for. Have an actual lawyer review this before relying on it for real compliance.

This policy explains what KWI Toolkit ("we," "us") collects when you use this site, why, and what you can do about it. It covers this app specifically, based on what it actually does today — not generic boilerplate copied from somewhere else.

What we collect

If you create an account (Google sign-in or email/password), we store:

Your email address
Your display name and avatar image, if you sign in with Google
Your subscription plan (Basic, Pro, or Premium) and role

If you use the site without an account, we don't collect any of the above — the free Basic tier's audit tools work without signing in at all.

Site content you audit. When you run a tool against a URL, the app fetches that page (and, for site-wide tools, other pages it links to) server-side to analyze it, then returns the results to you. We don't store the fetched page content, and we don't keep a record of which URLs you've scanned — that only exists in your own browser's local storage (visible in "Recent scans" on each tool), never sent to or stored on our servers. Clearing your browser data clears it completely.

Cookies

We use one functional cookie set: a session cookie from our authentication provider (Supabase), which is what keeps you signed in between visits. It's required for the account/dashboard features to work at all — there's no way to opt out of it while staying signed in, since it *is* the sign-in state. We don't use any advertising or cross-site-tracking cookies of our own.

Ads (Basic plan only)

The free Basic tier shows ads served by Google AdSense. Google may use cookies and device information to personalize which ads you see, both on this site and elsewhere, based on your browsing activity. You can review or adjust your ad personalization settings directly at adssettings.google.com, and Google's own policy on this is at policies.google.com/technologies/partner-sites. Pro and Premium plans don't show ads at all.

Third parties we share data with

We don't sell your data. The services below process it on our behalf, to make the app work:

Google AdSense — serves the ads shown to Basic-plan visitors, described above.
Supabase — hosts our database and handles authentication. Your account data (above) lives in their infrastructure.
Google — if you sign in with Google, they handle that authentication step. If you use the Core Web Vitals tool, the URL you enter is sent to Google's PageSpeed Insights API to retrieve performance data for it.

We don't currently process real payments — Pro and Premium plan changes are handled manually, not through a live billing processor. If that changes, a payment processor will be added to this list along with what it handles.

Your rights

Depending on where you live, you may have the right to access, correct, or delete your personal data, or to object to or restrict how it's processed. There's currently no self-service "delete my account" button in the app, and requests are handled manually rather than through a dedicated support channel yet.

Children's privacy

This site isn't directed at children, and we don't knowingly collect data from anyone under 13 (or the minimum age required in your region, if higher).

Changes to this policy

If we materially change what we collect or how we use it, we'll update the date at the top of this page. Continuing to use the site after a change means you accept the update.