MobileReady — Privacy Policy

New customers do not need or create a website account: plans are bought and managed in the extension through Stripe. Accounts created before this change remain supported behind the scenes. For those existing accounts we store your email address, a securely hashed password (if you use email sign-up), and optionally a display name and avatar URL. You can also sign in with Google; in that case Google shares your email address and basic profile details with us to create or match your account. Password-reset and sign-up confirmation emails are sent to your email address.

Authentication and the account database are provided by Supabase (through Lovable Cloud). Sign-in sessions are stored in your browser's localStorage so you stay logged in.

Payments are processed by Stripe through Stripe Checkout and the Stripe billing portal. Card and bank payment credentials are entered on Stripe's pages and handled only by Stripe; MobileReady never receives or stores your card number or bank details, and does not store card brand or last four digits. We keep only the plan and transaction metadata listed below.

Checkout starts from the extension (see “Extension checkout” below). For legacy website accounts, checkout sent Stripe the account email and internal user ID. From Stripe we retain:

• your Stripe customer ID and subscription ID,
• plan, price ID, price, currency, billing interval, status, current billing period and cancellation dates,
• invoice records: amount, currency, description, and links to Stripe-hosted invoice/PDF pages.

Stripe notifies us of subscription and invoice changes via verified webhooks.

Pairing codes are no longer part of the purchase journey. For legacy accounts that paired the extension with your account, we store each device's random device ID, device token, a name and coarse browser/OS labels, and when it was last seen. Pairing codes are stored with their expiry time. We keep a daily count of screenshots per account to enforce plan limits (a number only — never the screenshots). You can remove devices from your account page.

For security and abuse prevention, pairing and plan-check requests are logged with the action, result, device ID, pairing code, plan and seat information, and the requesting IP address and browser user-agent. You can view your own entries through your account.

You subscribe from inside the extension; no website account is involved. The extension's random install identifier (device_id, generated by the extension and not derived from your hardware or personal details) is sent to us and to Stripe as the checkout reference, so we can link that install to the resulting Stripe customer and subscription.

For each linked install we store: the device ID, a device token we issue, the Stripe customer ID and subscription ID, the plan tier, subscription status, current billing-period end, whether it cancels at period end, and the email address you entered at Stripe Checkout.

Why: to unlock the paid features you bought on that install and let you manage billing from the extension. Retention: kept while the subscription is active and afterwards as long as needed for billing, tax and dispute records. Disconnect or delete: cancel from "Manage billing" in the extension (Stripe billing portal); to have the device link and stored email deleted, contact us using the details below with the email used at checkout. Removing the extension deletes the device ID from your browser.

Checkout never sends page URLs, page content, screenshots, CSS values, credentials or form data.

Contact form: your name, email, optional company and message are emailed to our team inbox and a confirmation is emailed to you. The message is not stored in our database; we keep a delivery log (template name, recipient email, status, time).

Newsletter / notify signup: we store your email, the page it came from, and whether you're subscribed, and send one confirmation email. Emails sent by the website (legacy account, contact, newsletter, and the licensing codes/invitations you request) are delivered by Lovable's email service, which also maintains an unsubscribe/suppression list.

The website is hosted on Lovable, which provides built-in website analytics. It records page views and aggregate visit information such as pages visited, referring site, device type (desktop/mobile/tablet), country, and visit duration. We use it to understand traffic in aggregate. We do not add any third-party advertising scripts to the website.

Optional Google Analytics (website only). If you click Accept analytics, the website loads Google Analytics 4 on public pages only (not on admin, checkout-return, restore, code or other sensitive pages). It then records page views and clicks on extension install buttons (which browser store and which button placement). Page addresses and referrers are sent without query strings or fragments. Google receives this information along with standard technical data such as your IP address, browser and device type, and sets first-party _ga cookies. We disable Google signals and ad personalization and do not send emails, form contents, licensing or billing identifiers, checkout session IDs or tokens. Nothing is loaded unless you accept; you can decline, or later withdraw, using Analytics settings in the site footer, which stops further collection and deletes the _ga cookies on this site. This website setting is separate from the extension's own opt-in usage telemetry described below.

As with any web service, our hosting and backend providers process technical request data (such as IP address and user-agent) to deliver pages, operate the service and keep it secure.

• localStorage: a sign-in session, only for legacy account holders and the site owner's admin sign-in.
• sessionStorage: a short-lived flag used to recover from failed page loads.
• localStorage: your website analytics choice (accepted or declined).
• Cookies: Google Analytics _ga cookies, only after you accept website analytics.
• We do not set advertising cookies.

• Supabase (via Lovable Cloud) — database and backend functions (and legacy account authentication); receives the subscription, install, licensing and log data described above.
• Stripe — payments and billing; receives the install reference, the email and payment details you enter at Checkout (and, for legacy accounts, the account email and user ID).
• Google — Google Analytics for the website, only if you accept it (page views and install-button clicks as described above); and sign-in for legacy accounts that used Google sign-in.
• Lovable — website hosting, analytics and email delivery; receives request data, analytics events and email recipients/content.

We do not sell personal data.

• Simulation, inspection and screenshots process page content and the page structure (DOM) locally on your device; this content is not uploaded to MobileReady. Loading a tested website still makes normal browser requests to that website.
• An unassociated Free installation makes no automatic licensing requests. Opening plans fetches the public plan catalog, and checkout, restore and Team actions you request make the network requests described below, even before any purchase succeeds. Requested PageSpeed actions are described below.
• The extension can send optional, pseudonymous (not anonymous) product-usage telemetry, which is off until you opt in (described below). It does not use third-party analytics, tracking, or error-reporting services.
• The extension does not upload your browsing history, keystrokes, form data, or the content of the pages you view to MobileReady.
• Screenshots and inspected styles are created on your device and are shared only if you choose to save or copy them.

1. Licensing / subscription (only if you buy or restore a paid plan). When you buy from the extension, or for a legacy paired install, the extension sends to our licensing provider (Supabase):

• a random device_id the extension generates (not derived from your hardware or any personal identifier),
• for legacy installs only, the pairing code that was entered,
• a durable device_token returned by the server on subsequent checks,
• coarse technical labels or an optional label to name the install (e.g. "Chrome 126", "macOS").

Associated installations verify their plan daily and when the simulator opens or regains focus or you take a relevant licensing action, subject to any Firefox licensing consent that applies. If you request checkout, purchase restoration, Team joining or an invitation, the extension sends the entered email (where applicable), installation identifier and necessary verification information to the licensing service, even if the purchase or request does not complete. These actions are separate from optional analytics. If you do not request checkout, restore, Team joining or an invitation, and your installation is not associated with a plan, no licensing requests are made. (Server-side logging of these requests is described in the website section above.)

2. Performance measurement (on request). When you click Measure performance or Open report in Webpage Specs, the extension sends the URL of the selected page to Google (the PageSpeed Insights API or report page). In version 1.2.21 and later, both actions first display the sanitized target, remove the query string and fragment, refuse URLs containing credentials and known local host names or non-public IP addresses, and require any applicable Firefox browsing-data consent; if consent is denied or cannot be requested, the action does not run. The origin and path are still sent, and a path may contain identifiers. These checks do not resolve DNS, so they cannot guarantee a host name points to a public address. Older installed versions may send the full URL, including query string and fragment. Google receives the selected URL only; the extension does not upload screenshots or the inspected page content (DOM) for PageSpeed. This happens only when you click one of those actions.

3. Restore purchase and team seats (only when you request them). This is licensing, not analytics, and works without a website account. When you choose Restore purchase or Join a team, the extension sends your device_id, the email address you type, the 6-digit code you enter and an optional install label to MobileReady. We email the code to that address, and when an Expert Team owner adds a teammate we send that teammate an invitation email. We store a hash of each code (expires after 10 minutes), the invited emails, and the list of activated installs (device ID, role, email, label, hashed device token, created/last-seen times) so we can enforce seat limits and let the owner remove installs. These emails are sent only because you asked for them; they are never used for marketing and are not part of the optional usage telemetry below. Delivery is handled by Lovable's email service.

4. Local settings. Your preferences, the license or pairing token, the cached plan, and a daily screenshot counter are stored in your browser's local extension storage. They are not synced to any account and never leave your device except as described above.

To understand which features help people and to improve the product, the extension can send a small set of pseudonymous (not anonymous) usage events to MobileReady. Telemetry is off until you opt in, and you can turn it off at any time in the extension's settings; when it is off, no telemetry events are sent.

• Events: extension activated, first simulation, device switched, screenshot captured, upgrade prompt viewed, D1 and D7 return visits. "Checkout started" is recorded by our server only after a Stripe Checkout session is created, with the plan and the name of the feature that prompted the upgrade.
• Details sent with events: browser type, extension version, plan tier, device category (for example phone or tablet), capture mode and whether it was HD, and the name of the feature behind an upgrade prompt.
• Identifier: a random installation ID generated by MobileReady. In version 1.2.21 and later, the extension does not attach a legacy account sign-in to telemetry events and does not send the analytics installation ID with checkout. Events sent by older versions may have been linked to a legacy account, and we do not promise that previously stored events are unlinkable. Your identity is never placed inside the event details.
• Purchases: completed checkouts are recorded from Stripe's verified notification (plan, amount, currency and Stripe transaction ID).
• Never collected: page URLs, page titles, website content, screenshots, CSS values, email addresses, pairing codes, device tokens, passwords, browsing history, keystrokes, form input, or raw error text.
• Processor: Supabase stores these events. Retention: events are deleted after 6 months.

• No advertising trackers, tracking pixels, fingerprinting, or error reporting; the only usage data is the optional telemetry described above.
• No uploading of browsing history, page content, keystrokes, or form input to MobileReady; page content is processed only locally.
• Apart from the websites you choose to load, the only third parties that receive data from the extension are Supabase (plan catalog, licensing, restore/team, and optional telemetry), Stripe (only when you open checkout or billing), Lovable email delivery (codes and invitations you request) and Google PageSpeed Insights (the selected page URL, if you click Measure performance or Open report).
• No remote code: all extension code is bundled at build time.

The use of information received from Google APIs and browser extension permissions will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use extension data only to provide and improve MobileReady's single purpose (simulating and inspecting web pages on device viewports) and its licensing. We do not sell it, do not use or transfer it for advertising, personalized ads, creditworthiness or lending purposes, and do not let humans read it except with your consent, for security or abuse investigation, or as required by law.

• Subscription, invoice, install and usage records (and any legacy account) are kept while the subscription or account exists, and deleted within 90 days after it ends, except where billing or legal records must be kept longer.
• Licensing request logs (used for rate limiting) are kept for up to 90 days. Security/pairing logs, email delivery logs and newsletter records are kept until removed.
• Restore/join codes expire after 10 minutes and the code records are deleted within 90 days. Activated-install and team-invite records are kept while the subscription exists, and deleted within 90 days after the subscription ends or the owner removes them.
• Extension data lives in your browser until you disconnect your plan, clear the extension's storage, or uninstall. An owner removing an install in the extension (or a device on a legacy account page) invalidates it server-side. If an Expert Team plan is downgraded or ends, all teammate invitations and installs are revoked and must be re-invited.
• Stripe retains payment records under its own policies and legal obligations.

Purchase owners manage, change or cancel their subscription through “Manage billing” in the extension (Stripe billing portal), and can remove installs and teammates in the extension. Legacy account holders can also use their existing account page. There is no self-service deletion of server records; to request access, correction, export or deletion of your data, or to unsubscribe, contact us below and we will respond as required by applicable law. Newsletter and notification emails include an unsubscribe link.

Our providers may process data in countries other than your own, including the United States. By using the website you understand that your data may be transferred to and processed in those locations.

Licensing and billing records are accessible only to our server, install tokens are stored hashed, and legacy account data is protected so users can read only their own records; payment webhooks are signature-verified; and card data is handled only by Stripe. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

MobileReady is a professional tool and is not directed to children. We do not knowingly collect data from children.

We may update this policy as the product changes. We will revise the "Last updated" date above when we do.

Questions or data requests: email info@kentonwd.com or use the contact page.