Privacy Policy
Back to DHSea Score · Last updated October 15, 2026
DHSea Score ("the service", "we") is a free website report card operated by DHSeaDev, an independent project based in Iowa, United States. This policy explains what personal data the service handles, why, who else touches it, how long we keep it, and what you can do about it. It is written to be read, so the short version comes first.
The short version
- You can use the service without an account. We do not ask for your name, and we do not use advertising, analytics or tracking cookies.
- We do not sell your personal data and do not share it for advertising.
- An optional free account stores your email address and a list of your last 20 report summaries. You can download or delete both yourself, at any time, from the Account panel.
- To enforce the daily limit we keep a counter tied to a one-way hash of your network address (or of your account id). We cannot turn the hash back into your address.
What we handle, why, and for how long
| Data | Why | Where | Kept |
|---|---|---|---|
| The web address you ask us to grade | To fetch and score that page | Sent to our server for one request. The page and your report are not stored by us. The scoring runs in your browser. | Not stored. Hosting logs may keep request details briefly (see Cloudflare below). |
| Daily-limit counter: a salted one-way hash of your IP address (IPv6 is grouped to its /64 network) or of your account id, plus a count and the UTC date | To enforce the daily limits (2 anonymous, 5 signed-in) and prevent abuse | Cloudflare D1 database | About two days. Routine clean-up runs as the service is used, so a row can occasionally last a little longer. |
| Account: email address, a salted hash of your password (held by Google; we never see your password), account id, whether your email is confirmed, sign-in times | To provide the account and the higher daily limit; to prevent abuse | Google Firebase Authentication | Until you delete the account |
| Report history: address, score, grade and date of your last 20 reports (confirmed accounts only) | To show you your recent reports | Google Cloud Firestore, readable only by your account | Until you clear it or delete the account |
| Feedback you send: topic, message, optional email | To fix problems, improve the service and answer you | Cloudflare D1 database. We do not store your IP address with it. | Up to 12 months, or until you ask us to delete it |
| Sign-in token in your browser's local storage (email, account id, refresh token) | To keep you signed in | Your own device | Until you sign out or clear site data |
We do not set cookies. We do not use third-party analytics, advertising or social-media trackers, and we load no third-party scripts or fonts.
The sites you grade
When you grade an address, our server requests that public page once, identifying itself as "DHSeaScoreBot/1.0", and returns the page to your browser for scoring. The site you grade will see our server's address, not yours, and may log the request. Do not enter addresses that contain secrets (for example tokens in the URL), because the address is sent to our server.
Who processes data for us
- Cloudflare, Inc. hosts the site and runs the server code, the daily-limit database and DNS. Cloudflare processes request data such as your IP address and keeps operational logs under its own terms.
- Google LLC (Firebase) provides sign-in (Firebase Authentication) and stores report history (Cloud Firestore). Google processes your email address, sign-in information and the history data on our behalf and under its own terms; it also sends the confirmation and password-reset emails.
We disclose data to others only if the law requires it or to protect the service from abuse. We do not sell personal data and we do not share it for cross-context advertising.
Why we are allowed to use your data (EEA, UK)
If the EU or UK GDPR applies to you: we provide the account and history under a contract with you (Art. 6(1)(b)); we keep the daily-limit counters, security measures and feedback under our legitimate interest in running a safe, working service and improving it (Art. 6(1)(f)). You can object to processing based on legitimate interests. The service is operated from the United States, so your data is transferred there; Google and Cloudflare each describe the safeguards they use for international transfers in their own terms.
Your rights
Everyone can, free of charge: download the data in their account (Account panel, "Download my data"), clear their history, and delete their account and history (Account panel, "Delete account"). For anything else, including data we may hold that you cannot reach yourself (for example a feedback message), send a privacy request. We will respond within 30 days and will not charge you or treat you differently for asking. If you disagree with our answer, reply and ask for a review; we will re-examine it and answer within 60 days.
Because the counters are one-way hashes, we cannot match them back to a person, and so cannot retrieve or delete one for you on request; they expire on their own.
- Iowa. The Iowa Consumer Data Protection Act (Iowa Code ch. 715D, in force January 1, 2025) gives Iowa residents the rights to confirm and access personal data, delete it, obtain a copy, and opt out of its sale. It applies to businesses that handle the data of 100,000 or more Iowa consumers a year, or 25,000 or more while earning over 50% of revenue from selling personal data. We are far below that and may not be covered, but we honor these rights for everyone. We do not sell personal data. Iowa residents may also contact the Iowa Attorney General.
- California. The California Consumer Privacy Act applies to businesses above certain revenue or data-volume thresholds (for example, over $25 million in annual revenue, or buying, selling or sharing the data of 100,000 or more California residents or households). We are below them and may not be covered, but we treat requests to know, delete, correct and opt out the same way. We do not sell or share personal information, and do not use or disclose sensitive personal information for purposes beyond running the service.
- EEA and UK. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your local data protection authority.
Do Not Track
We do not track you across websites or over time, and we do not collect data for third parties, so there is nothing for a Do Not Track signal to change. We treat every visitor the same way.
Children
The service is for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13, and an account requires you to be at least 13 (or the minimum age in your country, if higher). If you believe a child has given us personal information, send a privacy request and we will delete it. This approach follows the U.S. Children's Online Privacy Protection Act (COPPA).
Security
The site is served only over HTTPS with a strict content security policy. Sign-in is handled by Google Firebase Authentication; account passwords never reach our server. Daily-limit identifiers are salted hashes. History is protected by database rules that allow only your confirmed account to read or write it, and our server verifies your sign-in token cryptographically before applying any account limit. No system is perfectly secure. If a breach affects your personal information, we will notify you as the law requires (in Iowa, Iowa Code ch. 715C).
Changes
If we change this policy in a way that matters, we will update the date above and, for a material change to how we use your data, say so on the home page. Earlier versions are available on request.
Contact
Use the privacy request form. Operator: DHSeaDev, Iowa, United States (dhseadev.online).