Privacy Policy

Effective Date: March 17, 2026 · Last Updated: March 17, 2026

This Privacy Policy explains how Proof ("Proof," "we," "our," or "us") collects, uses, and discloses information when you use withproof.dev and related services.

1. Information We Collect

We collect the following categories of information:

Account Information

• Email address
• Account identifiers and plan status

Submitted Testing Data

• URLs/domains you submit for testing
• Optional run settings you provide

Operational and Technical Data

• IP address
• Device/browser metadata
• Request logs, timestamps, and usage metrics

Interaction and Output Data

• Browser interaction traces generated during tests
• Screenshots of tested sites/pages
• QA reports and AI-generated analyses
• Research session inputs and AI-generated focus group insights

Analytics Data

• Site usage analytics collected via Umami (privacy-focused analytics — no tracking cookies, no personal data collection)

2. How We Use Information

We use information to:

• provide, operate, and maintain the Service;
• execute requested test runs, research sessions, and generate reports;
• monitor reliability, prevent abuse, and enforce policies;
• communicate service, support, and billing-related messages;
• improve model prompts, workflows, and product quality;
• comply with legal obligations.

3. Legal Bases (GDPR)

Where GDPR applies, we rely on one or more of the following legal bases:

• Performance of a contract — providing requested testing and reporting;
• Legitimate interests — service security, abuse prevention, quality improvement;
• Consent — where required, e.g., certain cookies or communications;
• Legal obligation — compliance with applicable laws.

4. Cookies and Analytics

We use essential technical cookies/session mechanisms needed to run the Service. We also use Umami analytics to understand aggregate usage and improve performance. Umami is a privacy-focused analytics platform that does not use cookies and does not collect personally identifiable information.

5. Sharing and Third-Party Processors

We do not sell personal information. We may share data with subprocessors that help us operate the Service, including:

• Cloudflare — hosting, edge delivery, security/CDN, and bot protection (Turnstile);
• LLM and AI infrastructure providers — to analyze test artifacts and generate report content;
• Umami — privacy-focused website analytics;
• Other operational vendors (e.g., logging, email, billing) as needed.

We may also disclose data if required by law, legal process, or to protect rights, safety, and platform integrity.

6. Data Retention

We retain data for as long as reasonably necessary for the purposes above, including account operation, support, dispute resolution, and legal compliance.

Default retention targets (subject to change):

• Account and billing records: retained while account is active and as required by law;
• Test artifacts (screenshots, interaction data, reports): retained for service history and product quality, then deleted or de-identified on a rolling basis;
• Security logs: retained for abuse prevention and incident response.

7. AI-Generated Content

Proof uses AI models to generate QA reports and research insights. AI personas in our Research product simulate user behavior based on demographic profiles — they do not represent real individuals. We do not use your submitted data to train our own AI models. Data may be processed by third-party AI infrastructure providers under data processing agreements.

8. Data Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect information. No method of transmission or storage is 100% secure.

9. Your Rights and Choices

Depending on your location, you may have rights to:

• request access to personal information;
• request correction or deletion;
• object to or restrict certain processing;
• request portability (where applicable);
• opt out of certain communications.

To make a request, contact hello@withproof.dev. We may need to verify identity before processing requests.

10. CCPA/CPRA Notice (California)

If you are a California resident, you may have rights under CCPA/CPRA, including the right to know, delete, correct, and limit certain uses of sensitive personal information (if applicable). Proof does not sell personal information and does not share personal information for cross-context behavioral advertising as of this policy date.

11. International Data Transfers

Your information may be processed in countries other than your own. Where required, we use appropriate safeguards for cross-border data transfers.

12. Children's Privacy

The Service is not directed to children under 13 (or higher age where required by local law), and we do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will post the revised version with an updated "Last Updated" date.

14. Contact

Proof (withproof.dev)
Operator: David Daniel
Portland, OR
Privacy contact: hello@withproof.dev