Privacy Policy

Last updated November 5, 2026

This policy explains what Checkbox collects on this website, through the Checkbox API, CLI, MCP server and Elements, and in the Checkbox product, why, and for how long. Checkbox is a System1 company. Questions: support@checkbox.site.

Developers and coding agents

Accounts and keys: your email address, name and organization, how you signed in (email link, password, GitHub or Google), and your API keys (stored as hashes; secret keys are shown once).
Agent setup: when you approve checkbox init, we receive the project’s framework, file paths, the lines of checkout code that call your billing platform, and your site, checkout and policy URLs. We do not receive your source code or the values in your .env files. A Stripe test-mode key is sent only if you allow it on the approval screen; live keys are refused.
Preflight checks: the text, parameters, emails or HTML you send to /v1/checks are used to compute the result and are not kept as evidence. Request metadata (time, endpoint, key, result) is logged for rate limiting, security and support.
Your policies: we fetch the Terms, privacy, refund and cancellation pages you register so we can check them, and keep what we fetched with your site’s evidence.

Assistants, MCP clients and feedback

Connected apps: when you connect an MCP client (for example Claude or Cursor) with OAuth, we store the app’s registration, the scopes you approved and hashed access and refresh tokens. You can disconnect it under Connected apps in the dashboard at any time. Calls an assistant makes are logged like any other API request.
Feedback: if you send feedback from the dashboard or through the API or MCP server, we store your message, the page it was sent from and, only if you tick the box, a screenshot that is masked in your browser before it is sent. Screenshots are visible only to Checkbox staff and are deleted after 180 days.
Public previews: when you add a site, we fetch its public pages to show a preview. Previews and Add-site lookups are deleted after 30 days.
Checkbox app for the Stripe Dashboard: if you install it, Stripe sends us your Stripe account id and, when you open the app, the id of the Dashboard user and of the customer or subscription you are viewing. With the read permissions you approve in Stripe, we read your prices, products, subscriptions, Checkout Session settings and customer portal settings, and receive subscription and invoice events, to check renewal disclosures, notices and online cancellation. We store the link between your Stripe account and your Checkbox site and the events we record. The app never changes your Stripe account. Uninstalling it stops all access; you can delete the stored data from your Checkbox account.
No model training: we do not use your data, or your customers’ data, to train AI models.

Free checkout scan (retired)

We no longer offer the free public scan. For scans requested before it was retired, we keep the data below until it expires on the schedule described.

What you give us: the URL to scan, your email address, your consent, and whether you want product updates. We store the exact consent wording you agreed to with the time of your request.
What we collect automatically: a keyed hash of your IP address (not the address itself), used to limit abuse, and your browser’s user-agent string.
What the scanner stores: the result of each sign-up check, the page title and final URL, and one screenshot of the page as our browser saw it. We do not keep the page’s HTML. Scans are not added to any customer’s evidence vault.
How we used it: to run the scan, show you the report, email you its link, and — only if you opted in — send occasional updates about automatic-renewal law.
Retention: screenshots are deleted after 30 days and scan reports after 90 days. Your contact record is kept until you ask us to delete it.
Who can see a report: anyone with its link. Report links are long random identifiers that cannot be guessed; they never show your email address.

Checkbox customers

For customers, Checkbox processes the data needed to monitor their subscription programs: account and team details; pages captured by the synthetic shopper and the JavaScript snippet (with form inputs excluded); emails sent to the site’s capture address or to synthetic-shopper inboxes; synthetic test subscriptions run in the billing platform’s test mode; subscription settings and lifecycle events read from the connected billing platform; consent records created through Checkbox Elements (the disclosure shown, the shopper’s agreement, the time, and the reference the merchant supplies, kept for the customer’s chosen retention period, 4 years by default, and erasable on request); notices sent on the customer’s behalf; and the resulting findings and evidence. For data about their own subscribers, the customer decides what is collected and Checkbox processes it on the customer’s behalf. Billing-platform credentials are stored encrypted. Evidence is kept in a write-once store, for as long as the customer’s retention settings say (below). Customers are responsible for having a lawful basis to send us the emails and page data they route to Checkbox.

Customer data: ownership, retention settings and legal hold

Customers own the records Checkbox keeps about their sites. We hold them only to run the service for the customer, and only for as long as the customer’s retention settings allow. Each organization sets a default, and each site can set its own:

Records (consent receipts, disclosures as they were shown, passing check results and their captures, certificates, records of emails sent, confirmed cancellations and the evidence chain) are kept for 7 years by default. The customer can choose from 1 to 10 years.
Superseded check results (earlier check results that a later check replaced, with their page captures and change history) are kept for 30 days after they are replaced by default. The customer can choose from 7 days to 2 years. After that we keep only the summary counts needed for status history charts, without text, quotes or screenshots. Current check results are not deleted automatically.
Legal hold. An owner or admin can turn on a legal hold for the whole organization or for one site. While it is on, nothing is deleted automatically, and data cannot be deleted and retention cannot be shortened, until an owner or admin turns it off. We record who turned it on or off, and when.
How deletion works. Records are kept in write-once storage, locked for 7 years; if a customer chooses a shorter period, they leave the service when it ends and their stored copy is destroyed when the lock ends. Superseded check results are kept in separate storage without a lock, so when the retention settings delete them, they are deleted: it no longer appears in the dashboard, the API or evidence exports, and its content is destroyed. A deleted record keeps only its hashes in the evidence chain, so the other records can still be verified. Database backups keep copies for up to 35 days and then roll off, so deleted data is gone from backups within 35 days. Superseded check results stored before November 3, 2026 were written to the write-once storage; it is no longer available through the service once deleted, and its stored copy is destroyed when its lock ends. Consent receipts that identify a subscriber are also subject to the separate receipt retention (4 years by default) and to erasure requests.

Subpoenas and other legal requests for customer data

If Checkbox receives a subpoena, court order or other legal request for a customer’s data, we will tell the customer before we produce anything, unless the law or the request forbids us to, and give the customer a reasonable chance to object or to seek a protective order. Where we can, we will ask the requester to seek the data from the customer directly. We produce only what the request legally requires, and we can only produce what we still hold under the customer’s retention settings. If we were prevented from telling the customer beforehand, we will tell them once that restriction ends.

Service providers

We use hosting and database (Render), storage (Amazon Web Services), email-delivery (Postmark) and sign-in providers (GitHub and Google, if you choose them) to run the service, and, when enabled, a language-model provider (Anthropic) to help read disclosure text and an error-reporting provider (Sentry). They process data only on our instructions. The current list, with what each one processes, is on the Trust center; customers who need a Data Processing Addendum can find it at /dpa. We do not sell personal information and do not use it for cross-context behavioral advertising.

Security and retention

How we protect data is described on the Security page, and how long each kind of data is kept on the Trust center. Report a security issue to security@checkbox.site. Records are stored write-once, so personal data inside them (for example, a captured renewal email) cannot be destroyed before the storage lock period ends; deletion requests for that data are completed when the period ends. Superseded check results are stored without a lock and deleted on the customer’s schedule. Customer retention settings and legal holds are described under Customer data.

Cookies

The public site sets no tracking cookies and loads no third-party analytics. Signing in to the app sets a session cookie and a security (CSRF) cookie, both strictly necessary.

Your choices and rights

You can unsubscribe from updates using the link in any email, delete your account from the Account page, and ask us to access, correct or delete your information, or to stop contacting you, by emailing support@checkbox.site or replying to any email we sent you. If you are a shopper or subscriber of a business that uses Checkbox, contact that business first: it decides what is collected about you, and we will help it respond. Depending on where you live (for example California), you may have additional rights; we will not discriminate against you for exercising them.

Changes

We will update this page, and the date above, when our practices change.

Who is responsible for your data

Checkbox is operated by S1 Media Ventures LLC, a System1 company. These terms are governed by the laws of the State of California; disputes are resolved as described under “Disputes” (arbitration), and any dispute not subject to arbitration is heard in the state or federal courts located in Los Angeles County, California.