Privacy policy
Last updated October 15, 2026
This policy explains what Webgrep collects when you use this site, what it collects from the public web with its crawler, why, and what you can do about either. Questions go to hello@example.com.
Who is responsible
Webgrep is the controller of the personal data described here. You can reach us at hello@example.com.
If you use the site
- Your account. When you sign in with Google we receive your name, email address and profile picture. We use them to identify your account and to show who is signed in.
- Your searches. We log searches (the query, how many results, how long it took, and your account if you are signed in) to run daily limits, find slow queries and improve the service. Logs are deleted after 90 days.
- Visitors who are not signed in. To apply the guest search limit we keep a one-way hash of your IP address for a day. We do not store the address itself.
- Watches. The searches you ask us to watch, the sites they matched each day, and the emails we send you about them. Each email has a link that stops it.
- Removal requests. The site, your email address and what you wrote, so we can act on the request and answer it, and a hash of your IP address to stop abuse of the form.
- API tokens. We store only a hash of your token and its last four characters.
- Payments. Payments are handled by Whop, which acts on its own account under its own privacy policy. We receive your plan, its status and a membership reference, never your card details.
The legal basis is the contract with you (to provide the account and service you signed up for) and our legitimate interest in running and protecting the service (logs and limits).
Cookies
We use only the cookies the site needs to work: a session cookie that keeps you signed in, and a security token that protects forms. Your light or dark theme choice is kept in your browser's local storage. There are no advertising or analytics trackers, and no third-party cookies.
What the crawler collects
Our crawler, WebgrepBot, reads public websites the way a browser does and keeps what any visitor could see by viewing the source: the page's HTML and response headers, the files a site publishes for machines (robots.txt, ads.txt, security.txt, sitemaps, favicons), its public DNS records and the details of its TLS certificate. It obeys robots.txt and noindex, and does not sign in, submit forms or collect anything behind a login.
Public pages sometimes contain personal data, most often business contact details such as an email address, a phone number or a social profile. We process them because indexing the public web for research into how sites are built is a legitimate interest, and we limit it: contact details are shown only to signed-in users, and any site can be removed.
Your choices and rights
- Remove a site. Ask us to remove a site from the index. Once a request is granted, the site's pages, archive and related records are deleted and the site is not crawled again.
- Stop the crawler. Block WebgrepBot in your robots.txt, as described on the crawler page.
- Delete your account. From your account page, at any time. Your watches, their history and your token are deleted with it; search logs are kept without your account for what is left of their 90 days.
- Depending on where you live you may also have the right to access, correct, restrict or object to processing of your data, to data portability, and to complain to your data protection authority. Write to hello@example.com and we will answer within a month.
Who else handles data
Our hosting provider stores the service's data. Google provides sign-in, Whop processes payments, and an email provider delivers the emails we send. Each processes only what it needs for that purpose. Data may be processed outside your country; where the law requires, transfers rely on appropriate safeguards such as standard contractual clauses.
How long we keep it
Account data until you delete your account. Search logs for 90 days. Crawled data for as long as it is useful for the index and its history, unless a site is removed. Backups are overwritten on a rolling basis.
Changes
If this policy changes in a way that matters, we will say so on this page and, for account holders, by email.