Privacy
Last updated 2026-09-16
This page says what Quiet Shift collects, why, where it lives, and how long we keep it. We collect as little as we can. We never sell data and never use it for advertising.
Buying a product
Purchases go through Gumroad, the seller of record. Gumroad collects your payment details and handles them under Gumroad's privacy policy. We never see your card number. Gumroad sends us, for each sale: your email address, the product and tier, a sale id, and what you typed into the checkout fields (for Repo Review, the repository URL and your notes; for Access Report, the website URL). We store this in our order database so we can do the work and answer support questions. We keep order records for as long as we need them for accounting and to handle refunds.
Repo Review: your code
- We clone the repository you submit to a machine we control and analyse it with automated tools and with an AI model. The code is sent to the AI model provider's API (Anthropic) for analysis under that provider's API terms, which do not allow it to be used for training.
- Any access token you give us for a private repository is used only to clone that repository. Please revoke it once you have your report.
- The clone is deleted after the report is delivered.
- The report is stored on Cloudflare R2 for 30 days so you can download it, then deleted. Save a copy.
- Findings may quote small snippets of your code. They appear only in your report.
Access Report: your website
- We crawl the pages of the website you submit. We do not log in, do not submit forms, and never complete a purchase; the keyboard check only presses Tab. We respect requests not to be crawled (robots.txt).
- Page captures (the accessibility tree, the Tab order, images with their alt text, form fields) and screenshots are sent to the AI model provider's API (Anthropic) for the agent-assisted checks under that provider's API terms, which do not allow them to be used for training.
- Screenshots taken during the review are stored for 30 days, then deleted. The report is stored for 30 days, then deleted.
Tabkeeper
The extension collects no data. Your tabs and sessions stay in your browser. If you enter a license key, the extension sends that key and the product name to Gumroad's license verification endpoint to check it, and nothing else. Optional backups are encrypted with a passphrase only you know.
Mail sent to any @quietshift.dev address is delivered by Cloudflare Email Routing to our software, stored in our database, and copied to the owner's inbox so a person sees it. We keep support mail for as long as we need it to help you.
Website analytics
quietshift.dev uses Cloudflare Web Analytics. It sets no cookies, does not fingerprint, and shows us page counts, referrers, countries, and browser types in aggregate. We cannot identify you from it.
Where data lives
Our software runs on Cloudflare (Workers, D1, R2). Review work runs on a machine we control. AI analysis uses Anthropic's API. Payments are Gumroad's.
Your rights
Write to support@quietshift.dev to see what we hold about you, to correct it, or to have it deleted. We answer within a few days. Deleting an order record does not remove Gumroad's receipt; ask Gumroad for that.
Changes
The date at the top shows the current version.