Privacy

What we keep, and why.

Last updated September 24, 2026.

EverThread watches websites and emails their owners in plain English when something needs fixing. This page lists everything we collect to do that, who else touches it, and how to have it removed. If anything here is unclear, ask us.

When you use the free check

• The website address you type, the result we found, and when.
• A one-way scrambled version of your internet address, not the address itself. We use it to stop one person from running hundreds of checks.
• Which page or tool you came from, for example our home page, the command-line tool, or an AI assistant.

We keep results so we can show the same answer again during the week instead of checking a site over and over.

When you create an account

• Your email address and a scrambled form of your password. We never store the password itself.
• The websites you ask us to watch and the email addresses you want alerts sent to.
• Whether you agreed to occasional product emails, and when.
• Where you signed up from, so we know which channels help people.

What we look at on your website

Only what any visitor's browser sees: the certificate, security headers, the scripts, forms, links, frames and redirects on the page, a short sample of the page text, a screenshot, and a fixed handful of well-known files. We never log in, guess passwords, or try to break anything. Results are kept in your account and in an encrypted, tamper-evident audit log.

If you install our WordPress plugin

The EverThread Connect plugin is optional and only for the Agency plan. It sends us:

• What the people chosen on its settings page do in WordPress: pages and posts published, edited or removed (by title), images added, design, menu and widget changes, plugins turned on or off, a handful of site settings, user accounts added or removed (by role only), and comments moderated.
• A snapshot of the site: WordPress, PHP, database, plugin and theme versions, waiting updates, a few security settings, user and content counts, and the site's address.

It never sends the text of pages or posts, anyone's name, email address or password. We use this only to write that site's monthly report.

Cookies and tracking

• The dashboard (security.everthread.live) sets cookies to keep you signed in, and one that remembers a browser you've already confirmed for 30 days so you aren't asked for an email code every time. Signing out removes them.
• Our website and dashboard load advertising and measurement tags from Google Ads, X (Twitter) and Whop. They tell us whether an ad led to a visit or a sign-up. Those companies may set their own cookies under their own privacy policies.
• We count page views per hour. The counter stores numbers only, nothing about who visited.
• Your browser remembers small preferences, like whether you chose the plain-English or technical wording.

Who else handles data

• Whop takes payments. They hold your card details; we never see them.
• Our web host runs the website, dashboard, database and email.
• Fly.io runs the browser that looks at websites.
• OpenRouter passes what that browser saw on a public page to AI reviewers (Anthropic's Claude and TypeSafe's Jev) to judge whether it looks tampered with. They receive website evidence only, never your account details.
• Google, X and Whop receive the measurement signals described above.

We don't sell data, rent it, or share one customer's results with another.

Emails from us

Alerts go to the addresses you choose. Product news goes only to people who ticked the box at sign-up, and every one of those has an unsubscribe link.

Security alerts. If you sign up for security alerts, we keep your email address, when you signed up and confirmed, and the page you signed up from. We only send alerts after you confirm by email. An alert can include a short note about EverThread and, if you have an EverThread plan, a link to your dashboard. Every alert has a one-click unsubscribe, and unsubscribing stops them straight away.

Keeping and deleting

We keep account data while your account exists. If your paid plan ends, your account continues on the Free plan. Deleting a site removes its findings and alert history with it.

To delete everything, use Delete account in your dashboard. It removes your account, sites, findings, alert history and recipients straight away. Two things stay: records of payments and plan changes, which we keep for accounting, and the tamper-evident log of past checks, which records the addresses of the sites that were checked and can't be edited by design. If you can't sign in, email us from the address on the account and we will delete it for you within 30 days.

Contact

hello@everthread.live. EverThread is run by PB Digital LLC.