Privacy Policy

The short version

Damdit is a desktop app that keeps your work on your computer. Your projects, audits, findings, reports, and access keys for connected services are stored locally and are never sent to Damdit’s servers.

Damdit’s servers know your email address, the computers you use Damdit on, and your subscription status. Payments are handled by Paddle. Some optional features send data to third parties, such as page URLs to Google for PageSpeed Insights. The details are below.

Who is responsible

The controller of your personal data is Antonín Bureš, sole proprietor, IČO 02035138, VAT ID CZ686100966, Czech Republic (full details in the Legal notice). This includes personal data collected through this website and the launch updates.

Privacy questions and requests: privacy@damdit.com

1. Data that stays on your computer

The app stores these locally on your computer and does not send them to Damdit:

• projects, website URLs, audit results, findings, evidence, screenshots, comparison history, and reports;
• access keys and tokens for connected services (Webflow, PageSpeed Insights, Search Console), encrypted by your operating system’s secure storage (Keychain on macOS; on Windows and Linux, the system’s equivalent). If your system offers no secure storage, Damdit does not save them;
• your settings.

You control this data. Deleting a project or the app’s data folder removes it from your computer. Exported reports are files you manage yourself. When your subscription ends, nothing is deleted.

2. Your Damdit account and licence

To start a trial or use a subscription, you sign in with your email address. The Damdit account service stores:

The account service does not receive audit data, website URLs, project names, findings or access keys.

Legal basis: performance of the contract (GDPR Art. 6(1)(b)); for trial-abuse prevention via the identifier hash, legitimate interest (Art. 6(1)(f)).

Where: a server operated for Damdit at Roští.cz in the Czech Republic (EU). Encrypted backups are stored with Scaleway in France and Hetzner in Germany (EU).

Kept: see How long data is kept. In short, account data is kept while your account exists, and the trial hash for 24 months.

3. Payments (Paddle)

Paddle.com acts as the merchant of record. Paddle collects and processes your payment details, billing address and tax information as an independent controller under its own privacy policy. Damdit never sees your full card details.

Paddle shares with Damdit: your email address, country, subscription and transaction status, and amounts. Damdit keeps these billing and transaction references as long as tax and accounting law requires, up to 10 years.

Legal basis: performance of the contract; legal obligations for accounting and tax records.

4. Scheduled audits

Scheduled audits run entirely on your computer and send nothing to Damdit.

5. Anonymous diagnostics

Damdit sends anonymous diagnostics only if you choose to share them, on the welcome screen or in Settings → Privacy & Data (Anonymous diagnostics). Until you choose, nothing is sent or stored for sending, and audits finished before you chose to share are never sent later. You can withdraw your consent at any time with the same switch; unsent events are then removed.

After an audit with an Overall Score, the app may send only: the app version, the operating system and its major version, the completion time rounded to the hour, the Overall Score, the number of modules in the audit, the number of issues in total, per severity and per category and — if a compatible previous audit exists on your computer — its score, the difference and a coarse time range between the two. It also includes a random delivery ID used only to avoid counting the same event twice.

It never includes URLs, project names, page content, findings, credentials, account or subscription identity, device identifiers, or IP addresses. Your IP address is visible to the server when the connection is made, but it is not added to the data and not stored. Diagnostics are kept in a database of their own, apart from account data, and cannot be linked to your account.

Where: the server at Roští.cz in the Czech Republic (EU) that also runs the account service, in a separate container with its own database, which is never joined with account data. The account service only passes the event on; your IP address and other request details don’t reach the diagnostics. Requests pass through Roští.cz’s shared proxy, which keeps connection logs with IP addresses for at most a few hours for troubleshooting; they never leave that server. Only daily totals are kept; the delivery ID is deleted after 7 days. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time without affecting what was sent before. Kept: as aggregated product statistics without identifiers, as described above.

6. Services the app contacts on your behalf

• The websites you audit receive the requests an audit makes, like any visitor. They see your computer’s IP address and the app’s user agent.
• Third-party scripts on the websites you audit: the app opens each page as a visitor’s browser does, so the page’s own scripts run, for example Google Analytics, Google Tag Manager, web fonts, reCAPTCHA, chat widgets or advertising pixels. These services receive your computer’s IP address and the address of the page under their own terms, and an audit can appear as visits in the website’s analytics. Each audit starts without cookies or stored data, and nothing is kept after it ends. Damdit does not block these scripts, because they affect what the audit measures.
• PageSpeed Insights (Google): optional and off unless you turn it on or add your own API key. When PageSpeed is on, the app sends the URLs of the pages it measures from your computer directly to Google, which loads and measures them; Damdit’s servers are not involved. Google also sees your computer’s IP address and, if you added one, your API key, and counts the requests in your Google Cloud project. With your own key, the app also asks Google’s Chrome UX Report about the audited website’s home page, domain and pages with speed issues. Google processes these requests under its own terms and privacy policy. You can turn PageSpeed off per project. Your API key stays in your system’s secure storage.
• Search Console (Google) (optional): only if you connect a Google account. Google then knows that your Google account has given Damdit read-only access, and receives the Search Console property and the page URLs the app inspects. You can see and remove this access in your Google Account. The app talks to Google directly from your computer; your account’s email and access keys stay on your computer, and Damdit’s servers are not involved.
• Webflow (optional): only if you connect it. The app talks to Webflow directly from your computer using your access key. Damdit’s servers are not involved.
• Google otherwise: the app’s own windows load nothing from Google. Google receives data from the app only through PageSpeed Insights, Search Console and the scripts of the websites you audit.
• Your AI tools (command-line tool and MCP server, bundled with the app): tools you connect, such as Claude Code, Codex, Cursor or Claude Desktop, run audits and read results locally through Damdit on your computer. Damdit doesn’t send them anything by itself. What an AI tool sends elsewhere depends on that tool and its provider’s terms. You can turn this access off in Settings.

Google user data (Search Console). If you connect Google Search Console in a project, the app asks Google for read-only access to your Search Console data (scope webmasters.readonly) and for your Google account’s e-mail address (openid, email), so it can show which account is connected. The app uses this access only on your computer: to list your Search Console properties, so you can choose the one that matches the website, and to ask Google how it indexes the pages Damdit audits. The results appear in that project’s audits and reports on your computer. Damdit’s servers never receive your Google data, the access token or the results. Damdit does not sell this data, share it with third parties, use it for advertising, or use it to train AI models. The sign-in is kept encrypted in your operating system’s secure storage and is deleted when you disconnect Search Console, delete the project, or delete Damdit’s local data. You can also revoke access at any time in your Google Account (myaccount.google.com/connections). Damdit’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Downloads and app updates

The app checks download.damdit.com for updates and downloads them from there. The server sees your IP address, the app version and your operating system. Downloads are stored and delivered by Scaleway in France (EU). Damdit counts downloads per day, version and platform, without IP addresses.

8. The damdit.com website

The website is hosted by Vercel. The host processes technical data such as IP address, browser type and requested pages to deliver the site and protect it from abuse. This technical data is retained only for the period needed to deliver and secure the website, under the relevant hosting configuration.

Legal basis: legitimate interest in operating a secure, reliable public website.

The website does not use cookies, advertising pixels, behavioural analytics, or heatmaps. The checkout will be provided by Paddle, which may set its own cookies.

When you sign in at damdit.com/account, your browser keeps the sign-in session (access and refresh tokens) in its local storage on your device until you sign out or the session ends. It is not a cookie, it is sent only to the Damdit account service, and it is not used for tracking.

9. Launch updates

Damdit has no newsletter and collects no email addresses for launch updates. Updates are posted on Damdit’s LinkedIn and Mastodon profiles, which are linked from the website. Following them is governed by the privacy policies of LinkedIn and of the Mastodon server, and those services process the data of their own users. Damdit only sees what those services show to every profile owner.

10. Emails

• Sign-in and account emails (sign-in codes, trial and subscription notices) are sent through Scaleway Transactional Email in France (EU), without open or click tracking.
• Support: if you write to support@damdit.com, your email and anything you include are processed to answer you. The app’s Contact Support creates an email you see and can edit before sending; it may include your app version and redacted technical details, but never access keys, URLs, project names, or page content. Mailboxes are hosted by Roští.cz in the Czech Republic. Support emails are kept for 24 months after your request is closed.

11. Errors and crashes

Damdit uses no third-party error monitoring. The app does not send crash reports. After a crash, it offers a pre-filled email to support@damdit.com that you can read, edit or discard before sending.

12. Recipients and transfers

All services that store your account data or its backups are European companies with data in the EU. Where data leaves the EU/EEA (Paddle, Google, Vercel), the transfer relies on an adequacy decision (the United Kingdom; the EU–US Data Privacy Framework for certified US companies) or on standard contractual clauses. You can ask for more information at privacy@damdit.com.

Damdit does not sell personal data and does not use it for advertising.

13. Your rights

You can ask for access, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Write to privacy@damdit.com. You can also complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz) or the authority in your country.

14. Changes

If this policy changes materially, you’ll be told on this page and by email at least 30 days before it takes effect. The date at the top shows the current version.

15. How long data is kept