Privacy policy

1. Summary

• UX Audit checks a page in your browser. The audit itself never leaves your computer.
• Your settings and your five most recent reports, including their screenshots, are stored only on your computer.
• A later version will offer optional sharing of audit counts. It stays off until you turn it on, and you can turn it off at any time.
• If you share, we receive the rule IDs an audit flagged and how often each appeared. We also receive the domain you audited, the standards you picked, your version, your country and a random install ID.
• We never receive full page addresses, page content, screenshots, your report or your name.
• We use shared data only to understand and develop UX and content design standards at a wider scale. We don't sell it, use it for advertising or use it to profile anyone.
• This website sets no cookies and runs no analytics or tracking scripts.

2. Who we are

UX Audit is made by Written in Pixels LLC, a Florida limited liability company (“Written in Pixels”, “we”, “us” or “our”).

Under the EU and UK General Data Protection Regulation, Written in Pixels LLC is the controller of the personal data described in this policy.

Written in Pixels LLC
7901 4th St. N., Suite 300
St. Petersburg, FL 33702
United States
hello@writteninpixels.studio

We haven’t appointed a data protection officer, because the law doesn’t require one for the processing described here. Send any privacy question to the email address above.

3. What this policy covers

This policy covers the UX Audit browser extension, whether you install it from the Chrome Web Store or download it from this website. It also covers the website at ux-audit.writteninpixels.studio.

It doesn’t cover other Written in Pixels websites or products, which have their own policies. It also doesn’t cover the websites you choose to audit.

4. What stays on your computer

When you click the UX Audit button, the extension reads the page in the tab you’re viewing so it can run its checks. Chrome’s activeTab permission limits this to that tab, and only after you click.

The extension can’t read any other tab or any page you haven’t asked it to audit.

The extension stores the following in your browser’s local extension storage, on your computer only.

• The standards you selected
• Your five most recent reports, each with a screenshot of the visible part of the audited page
• Your sharing choice and, if you turn sharing on, your random install ID

Each new audit replaces the oldest report once five are saved. Removing the extension deletes all of this data. We can’t see or access it.

The extension doesn’t use cookies, doesn’t track your browsing and doesn’t load code from anywhere else. Everything it runs, including the open-source axe-core accessibility engine, ships inside the extension.

5. Optional sharing of audit counts

This section applies from the version of UX Audit that adds the sharing switch. Until then, the extension sends nothing to us or anyone else.

Sharing is off by default. If you turn it on in the extension’s popup, then after each audit the extension sends us only the following.

• Audit counts. The ID of each rule the audit flagged, such as “img-alt”, and how many times it appeared.
• Domain. The domain of the audited page, such as example.com, without the path, query string or anything after it.
• Settings. The standards you selected for that audit.
• Version. The version of UX Audit you’re running.
• Country. The country your browser’s time zone points to, such as “US”. The extension works this out on your computer and sends only the country code. We never use your IP address to find your location, and we never collect your region, city or precise location.
• Install ID. A random identifier created when you turn sharing on. It isn’t linked to your name, email, Google account or device.
• Time. The date and time the audit ran.

We never receive

• full page addresses, page text, images, form contents or anything typed into a page
• screenshots or the contents of your reports
• your name, email address, Google account or any login details
• your IP address, region, city or precise location
• your browsing history or information about any tab you didn’t audit

When our servers receive a request, our hosting providers may briefly process your IP address to deliver it. We don’t store IP addresses with shared audit data.

A domain can sometimes identify a person or a small business, such as a site named after its owner. So we treat domains as personal data. We never publish a domain alongside its findings, and we report results only as totals and patterns.

You can turn sharing off at any time in the popup. Turning it off stops all sending straight away. Removing the extension does the same.

6. Why we use shared data

We use shared audit data only to understand how UX and content design standards are applied across the web. It helps us develop those standards at a wider scale and improve the checks in UX Audit.

We don’t

• sell or rent shared data, or share it for cross-context behavioral advertising
• use it for advertising, marketing or contacting the owners of audited sites
• use it to build profiles of people or make automated decisions that affect them
• use it to decide creditworthiness or for lending, insurance, housing or employment purposes
• let anyone outside Written in Pixels read it, except the service providers listed in section 9

We may publish research based on this data, such as which standards are missed most often. Anything we publish is aggregated and doesn’t name domains or install IDs.

Our use of information from the extension follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

7. Legal basis for processing

If you’re in the European Economic Area or the United Kingdom, we rely on the following legal bases.

• Consent for optional sharing (Article 6(1)(a) GDPR). You give consent by turning sharing on and can withdraw it at any time by turning it off. Withdrawing doesn’t affect processing that happened before.
• Legitimate interests for keeping this website and our servers secure and working (Article 6(1)(f) GDPR). This covers short-lived server logs kept by our hosting providers.
• Legal obligation where we must keep or disclose information by law (Article 6(1)(c) GDPR).

8. This website

ux-audit.writteninpixels.studio sets no cookies, uses no local storage and runs no analytics, advertising or tracking scripts. Its security settings block scripts entirely.

Like any website, our host Netlify receives technical information when you visit, such as your IP address, browser type, the page requested and the time. Netlify uses this to deliver the site and protect it against abuse. We don’t combine it with anything else.

If we add analytics to this website, we’ll update this policy first and ask for consent where the law requires it.

9. Service providers

We use these providers to run UX Audit. Each one processes data on our behalf, under a data processing agreement, and only for the purposes in this policy.

Provider	What it does	Data involved
Netlify, Inc.	Hosts this website and the extension download	Server request data such as IP address and browser type
Supabase, Inc.	Stores shared audit counts, from the version that adds sharing	The data listed in section 5
Google LLC	Distributes the extension through the Chrome Web Store and handles our email	Install and uninstall counts that Google reports to us, and any email you send us

Google’s own handling of your Chrome and Chrome Web Store data is covered by Google’s privacy policy, not this one.

We may also disclose information if the law requires it, or to protect our rights or the safety of others.

If our business is merged, sold or reorganized, data may pass to the new owner. This policy would still apply to data collected under it.

10. International transfers

Written in Pixels is based in the United States, and our providers store data there. If you’re in the EEA, the UK or Switzerland, data you share is transferred to the United States.

To protect those transfers, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. Where a provider is certified, we also rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask us for a copy of these safeguards.

11. How long we keep data

• Data on your computer stays until a newer audit replaces it, you clear it or you remove the extension.
• Shared audit records are kept for up to 24 months from the audit date. After that we delete them, or reduce them to totals that can’t be traced to an install ID or a domain.
• Aggregated totals that can’t identify anyone may be kept for as long as they’re useful for research.
• Server logs are kept by our hosting providers for their standard periods, which are short and used only for delivery and security.
• Emails you send us are kept as long as needed to answer you and for our business records.

12. Security

We protect shared data with encryption in transit (HTTPS) and encryption at rest from our storage provider. Only the Written in Pixels team can read it. Database rules let the extension add records but never read them.

No system is perfectly secure. If a breach affects your personal data, we’ll notify the relevant authorities and you where the law requires. Under the GDPR, that includes telling a supervisory authority within 72 hours.

13. Your rights

Depending on where you live, you may have the right to

• know what personal data we hold about you and get a copy
• correct data that’s inaccurate
• have your data deleted
• restrict or object to our processing
• receive your data in a portable format
• withdraw consent at any time
• not be discriminated against for using any of these rights

Shared data is tied only to a random install ID, so we can’t find your records from your name or email. To use a right, email us your install ID. The popup shows it when sharing is on.

The popup also lets you reset the ID, which separates future audits from past ones. We may ask for reasonable information to confirm a request is genuine.

We’ll respond within one month to requests under the GDPR or UK GDPR. For complex requests, we may extend that by two months.

We’ll respond within 45 days to requests under US state laws, and may extend that by 45 days. We’ll tell you if we need the extra time.

If you’re in the EEA or the UK, you can also complain to your local data protection authority. In the UK that’s the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to sort out your concern first.

14. California and other US states

This section adds to the rest of the policy for residents of California and other US states with comprehensive privacy laws. These include Colorado, Connecticut, Virginia and Texas.

This list follows the categories in the California Consumer Privacy Act (CCPA). We haven’t collected any personal information through the extension so far. Once sharing is released, people who turn it on may give us the following.

• Identifiers, limited to the random install ID
• Internet or other electronic network activity, limited to the audit counts, domain, settings, version and time described in section 5
• Geolocation data, limited to country. This isn’t precise geolocation, so it isn’t sensitive personal information under the CCPA.

We collect this from the extension, with your permission, for the purposes in section 6. We disclose it only to the service providers in section 9 for those purposes.

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising, and we haven’t done so in the last 12 months. We don’t collect sensitive personal information. We don’t knowingly sell or share the personal information of anyone under 16.

Because we don’t sell or share personal information, there’s nothing to opt out of. We still treat a Global Privacy Control signal as a valid request to opt out, should that ever change.

You or an authorized agent can make a request by emailing us. If you use an agent, we may ask for proof they’re authorized. Some states let you appeal if we decline a request. To appeal, reply to our decision, and we’ll respond within the time your state’s law requires.

15. Children

UX Audit is a professional tool for people who design and build websites. It isn’t directed to children.

We don’t knowingly collect personal information from children under 13, or under 16 in the EEA and UK. If you believe a child has shared data with us, email us and we’ll delete it.

16. Changes to this policy

We’ll update this policy if UX Audit or the law changes. The date at the top shows when it last changed.

A material change means collecting new kinds of data or using data for a new purpose. Before one takes effect, we’ll explain it in the extension and on the Chrome Web Store listing. We’ll ask for fresh consent where the law requires it.

We won’t use data collected under an earlier version of this policy for a new purpose without your consent.

17. Contact us

For privacy questions or requests, email hello@writteninpixels.studio or write to Written in Pixels LLC, 7901 4th St. N., Suite 300, St. Petersburg, FL 33702, United States.