Privacy policy

Colorit (colorit.website) lets you preview color palettes and fonts on a public website and export a theme. This page explains what we collect and why. We collect as little as we can.

Websites you capture

• When you enter a website address, our server fetches that public page so it can be shown in the preview. The page content is sent back to your browser. We do not store the page or the address you entered, unless you choose to save a project (see below).
• When you are signed in, we keep a one-way hash of each captured page for up to six hours. It lets us confirm that a page you save as a project is exactly what Colorit captured for you. It cannot be turned back into the page.
• We keep a one-way hash of the address on paid captures so a repeated request is not charged twice. It cannot be turned back into the address.
• When you create a Pro export, your browser sends us the palette, fonts, website address and a short summary of the colors and fonts the page used. We use it only to write the export and do not store it.
• If you copy a share link, the link itself contains your palette, font and the website address you chose. Anyone you give the link to can see them.

Without an account

• You can preview palettes and fonts on the example site without signing in. Capturing your own website needs a Google sign-in.
• To limit abuse we store a keyed, one-way hash of your network address (not the address itself), changed every day. These records are deleted after about a day, when later captures are made.

With an account

• You sign in with Google. We request only your basic profile (openid email profile). We store the Google account ID, your email address and your name. We never see your Google password and do not keep Google access or refresh tokens.
• Signing in sets a session cookie for up to seven days. Only a hash of the session token is stored, so it can be revoked on sign-out.
• Your free trial captures are counted against your account, and that count is kept for as long as the account exists so the trial cannot be repeated. We store a record of your purchases (payment ID, product, credits, amount and currency) and of each credit spent on a capture, with its time and result.
• Payments are handled by Dodo Payments. We never receive or store your card details.
• After a purchase we send one confirmation email to your account's email address, through Cloudflare's email service. We do not send newsletters or marketing email.

Projects and review links (Pro)

• If you save a project, we store the captured page, its address, your look and a title until you delete the project. Deleting a project also deletes every review link made from it.
• A review link stores an optional note, an optional password (kept only as a salted hash) and an end date of 7, 14 or 30 days. Anyone with the link can open it without an account. The page is shown as a snapshot with scripts, links and forms switched off, and the link is not indexed by search engines.
• We count how many times a link is opened. We do not identify viewers. When a viewer enters a password, a keyed one-way hash of their network address is kept for up to a day to slow down password guessing.

Visits to our pages

• To see how people find Colorit, we count page visits ourselves, without cookies. For each visit we store the page (never the ID in a review link), the site you came from or a campaign tag such as ?ref=, your country and a visitor code. The visitor code is a keyed one-way hash of your network and browser that changes every day, so it cannot identify you or follow you across days.
• These visit records are deleted after 90 days. Visits from automated browsers are not counted.

Other services that see some data

• Cloudflare hosts Colorit and its database, renders pages for capture and may protect forms with bot checks. Like any host, it sees request details such as your IP address and keeps operational logs.
• Cloudflare Web Analytics counts visits to our pages: the page, the site you came from, your country, browser and device type, and how fast the page loaded. It sets no cookies, does not track you across sites and does not identify you.
• Google provides sign-in. Font previews also load fonts from Google Fonts, which can see your IP address.
• Dodo Payments processes payments and sends us confirmation of them.

We do not sell personal data, show ads or use third-party advertising or analytics cookies.

How long we keep it

• Account and purchase records are kept while your account exists and as long as accounting rules require.
• The person running Colorit can see usage totals and the email addresses of accounts, to support you and keep the service running.
• Sessions expire after seven days. The network hash stored with free-trial records is cleared after about a day; the count of trial captures you used is kept while your account exists.
• Our operational logs and capture records note that a capture happened, whether it worked, why it failed and how long it took, not the page, its address or who made it. Capture records are deleted after 90 days.
• When you try a palette on a captured page, we record the palette name and how much of the page's text stayed readable, to improve how Colorit restyles pages. Not the page, its address or who you are. These records are deleted after 90 days.

Your choices

You can ask us to show or delete the data we hold about you, or close your account, by writing to hello@colorit.website. Deleting an account removes your profile and sign-in; we may keep purchase records that the law requires. You can also delete cookies in your browser at any time, which resets the free-allowance cookie.

Children

Colorit is not meant for children under 13, and we do not knowingly collect their data.

Changes

If we change this policy in a way that matters, we will update the date above and, where we can, tell you.