Privacy policy

What a capture stores

When a capture succeeds the service stores the image, a redacted form of the target address, the capture options, the size of the image, how long it took and the time it happened. The image is private. It is not publicly listed, and it is only reachable through a signed link that expires, or through your dashboard while you are signed in.

A capture that fails stores the same metadata plus the error code. It never stores the content of the page.

What is never stored

The service does not store page content, screenshots beyond the retention window, passwords, cookies for the pages it visits, authorization headers, or the raw value of an API key. API keys are stored only as a SHA-256 digest and are shown exactly once, when they are created.

Captures are never used for advertising, for model training or for any other product.

Accounts

An account stores an email address, an optional name and a salted password digest. The email address is used for the service itself and for billing. A session cookie is issued when you sign in; only its digest is stored, and it expires after 14 days.

The pages you capture

Submitting a URL causes the service to visit that page. The target site sees a request from the service, including an address and a user agent, exactly as it would from any visitor. That is inherent to the product and is why you should tell your users before you submit their pages.

Payments

Payments are processed by Dodo Payments, which acts as the merchant of record. Card details never reach the Aback servers. The service stores the payment identifier, the amount, the currency, the status and the product, so that the plan and the usage record can be reconciled.

How long data is kept

Captures and their images are deleted after one hour by default. Session records are deleted when they expire. Usage records are kept for the duration of the billing period plus 12 months, so that invoices can be reconciled. Account data is deleted within 30 days of a deletion request.

Your choices

You can request a copy or deletion of your account data at any time. You can revoke an API key at any time, and the key stops working on the next request. You can delete an individual capture from the dashboard or through the API.

Contact

Privacy questions go to the support address below. Include the request id from an API response if the question is about a specific capture, and never include a secret, a cookie or an authorization header.