How SlopDox handles your information.

Who we are

SlopDox (slopdox.com) is run by [Company name] LLC, a United States company (“we”, “us”). We’re responsible for the information this policy describes.

Questions about privacy: [privacy email to be confirmed], or use our contact form.

The short version

• We never ask for or store your passwords. SlopDox records where each login lives and which email address controls it, never the password.
• No advertising, no tracking. We don’t sell your information, use it for advertising, or run analytics or advertising tools.
• Your records are yours. You can download them, correct them, or ask us to delete them.

What we collect and why

Your account. Your email address and name, time zone, currency, financial year, plan, and the day you signed up. We use them to sign you in, show your records the way you want, send your reminders and apply your plan.

Your records. What you add about your websites: names and addresses, services and providers, costs and renewal dates, the account name or email you use at each provider, notes, compliance answers and handover details. For the cards that pay your bills: a label you choose, whether the card is personal or business, and, if you add them, its last four digits and expiry date. Never a full card number or security code. When you add services and cards, SlopDox refuses to save text that looks like an API key, a login token or a full card number.

People you add. If you invite someone, we keep their email address, their role and when they joined. If you name a buyer in a handover dossier, we keep the name and email you enter. Please only add other people’s details when you’re allowed to.

Payments. If you pay for a plan, Stripe collects your card details on its own page. We receive your plan, its status and renewal date, and Stripe’s customer reference. Never your card number.

Live checks. Each day SlopDox looks up the domains you’ve recorded in the public domain records (through rdap.org and each registry) and connects to your websites the way a browser does to read their security certificates. Only the domain or web address is sent. We keep the latest result.

Looking up a website while you add it. When you add a website by typing its address, SlopDox looks up that address in public records: who the name is registered with (RDAP, the current form of WHOIS), where the address points (DNS), and who appears to run the hosting and the email. If this server’s own address lookup doesn’t answer, the same question is sent over HTTPS to Cloudflare’s and Google’s public DNS, and to Team Cymru’s public list of who runs an address. Only the address is sent. SlopDox also opens that website’s public homepage once, the way a visitor’s browser would, to see what it is built with and which services it loads (a website builder, a mailing-list form, a payment button), and reads the security certificate it serves. It doesn’t sign in anywhere and doesn’t keep a copy of the page. What we find is written into your ledger. A typical price from a public price list is marked as an estimate.

Receipts. When you add a bill from a receipt, the file or text is read on your own device, in your browser. It isn’t uploaded to SlopDox. We save only what you confirm: the company, the amount, how often it is charged and the next date.

Registrar connections. If you connect Porkbun or Cloudflare to import your domains, you paste a key. We use it for that one request to read your domain list, then discard it. It is never stored or logged.

AI connections. If you connect your own AI app (such as Claude or ChatGPT), we keep the app’s name, the web addresses it signs in from, when it was last used, and scrambled fingerprints (hashes) of its access tokens or connection keys, never the keys themselves. For a connection key we also keep its last four characters, so you can tell your keys apart. The app can look up your records but never change them. What it reads goes to that AI company under your agreement with them.

Ask SlopDox. We don’t keep the text of your questions or the answers; the conversation stays in your browser tab and is cleared when you close it. To apply fair-use limits, we count each question with a scrambled code made from your network address that changes every day (never the address itself), your account number if you’re signed in, and how much text the AI used. When AI answers are switched on, your question and the last few messages are sent to Anthropic to write the answer, without your name or email. Please don’t type personal or sensitive details. If you talk instead of typing, your browser turns speech into text; some browsers send the audio to their maker to do this. We never receive the audio.

Contact form. Your name, email, what you’re writing about, business name if you give it, and your message; for enquiries about more than 50 websites or a bigger team, also how many websites and people you have. We use them to reply to you.

Abuse protection. To stop floods of messages, invitations and look-ups, we keep short-lived counters linked to a scrambled code made from your network address, or to your account number. Our host keeps brief technical logs (such as IP address and the page requested) to run and protect the service.

Where the GDPR or UK GDPR applies, we use your information to provide the service you signed up for, to keep SlopDox secure and prevent abuse (our legitimate interests), and to meet legal duties such as keeping tax records.

The services we use to run SlopDox

• Clerk runs sign-in. It holds your email address, name, sign-in method and session details (such as your browser and IP address). If you sign in with Google, Apple or GitHub, Clerk receives your name and email from them. If your sign-in uses a password, Clerk keeps it; SlopDox never sees it.
• Stripe takes payments and manages subscriptions.
• Resend sends our emails: renewal reminders, team invitations, and contact-form messages to us.
• Vercel hosts SlopDox and runs its daily reminders and checks.
• Neon runs our database.
• Anthropic writes Ask SlopDox’s answers, only when AI answers are switched on. Otherwise answers come from our own help pages.

Each gets only what it needs to do its job, under its own privacy terms. We may also share information when the law requires it, or to protect SlopDox and its users from fraud or abuse. If [Company name] LLC is sold or merged, your information would pass to the new owner under this policy.

Where your information is stored

Our database (Neon) and hosting (Vercel) are in the United States, in the US East region (Washington, D.C.). The services above may also process information in other countries. If you use SlopDox from outside the United States, your information is transferred to the United States. [Safeguards for transfers from the EU and UK, such as Standard Contractual Clauses, to be confirmed.]

How long we keep it

• Your account and records: while your account is open. Deleting a website removes its records straight away. When you delete your account (Settings › Account), we delete your account and records straight away, cancel any paid plan and remove your login; copies in our providers’ short-term backups expire on their own.
• Ask SlopDox counts: about 90 days.
• Abuse-protection counters: up to 8 days.
• AI connections: until you disconnect them. Connection keys stop working after a year at most, and expired tokens are removed a week later.
• Team invitations: the link works for 14 days.
• Contact-form messages: until we’ve dealt with your enquiry. [Retention period to be confirmed.]
• Billing records: as long as tax and accounting laws require.

Your choices and rights

You can see and correct almost everything in SlopDox yourself. You can also:

• Export: download everything in your account at any time, on any plan, from Settings › Account › Download everything: a spreadsheet for each kind of record and a complete backup. Each website’s ledger and, on paid plans, the spending report also download as CSV files.
• Correct: edit your records at any time, or ask us.
• Delete: delete any website from the bottom of its Overview page. To delete your account and everything in it, open Settings › Account › Delete my account; it happens straight away. People you invited lose access to your account but keep their own.
• Ask or object: ask what we hold about you, or object to how we use it.

Depending on where you live, you may have extra rights. People in the EU and UK (under the GDPR and UK GDPR), in California (under the CCPA) and in many other places can, for example, access, correct, delete or export their information, limit or object to some uses, and complain to their data protection authority. We’ll answer requests from anyone, wherever they live, [within 30 days, to be confirmed], and won’t treat you differently for making one. We don’t sell or share personal information as California law defines those words.

Cookies

SlopDox only uses cookies it needs to work. No advertising, analytics or tracking cookies.

• Clerk’s sign-in cookies (such as __session and __client_uat) keep you signed in and protect sign-in. They’re set on every page, even before you sign in, because sign-in loads with each page.
• slopdox_account remembers which account you’re working in if you’ve been invited into more than one. It lasts a year.

A few features save things in your browser only (not cookies, and never sent to us): your Ask SlopDox conversation (cleared when you close the tab), whether you turned voice on, your answers in the 10-minute check-up, and what you enter in the free tools (the card renewal checker and the website handover checklist). Stripe sets its own cookies on its checkout and billing pages.

Children

SlopDox is for website owners and businesses. It isn’t meant for anyone under 16, and we don’t knowingly collect information from children under 16. If you think a child has given us information, contact us and we’ll delete it.

Keeping it safe

Connections to SlopDox are encrypted. Invitation links, AI tokens and connection keys are stored only as scrambled fingerprints, so a copy of our database wouldn’t reveal them. No system is perfectly secure; if a breach affects your information, we’ll tell you as the law requires.

Changes to this policy

We’ll update this page when SlopDox changes, and change the date at the top. If a change matters, we’ll email account owners before it takes effect.

Contact us

[Company name] LLC: [privacy email to be confirmed]. Or use our contact form. Our Terms explain the rules for using SlopDox.