Privacy Policy

Last updated: October 5, 2026

1. Overview

UXLens ("we", "us", "our") operates a software-as-a-service platform that analyzes the user experience and user interface of websites. This Privacy Policy explains what data we collect, how we use it, and the choices you have. By using UXLens, you agree to the practices described here.

2. Data We Collect

  • Account data: the email address and password you provide when you sign up. Passwords are hashed; we never store them in plain text.
  • Audit data: the URLs you submit for UX/UI analysis, screenshots and rendered HTML captured from those pages, the AI-generated audit findings, scores, and any notes you add.
  • Usage and analytics data:information about how you interact with UXLens, collected through standard server logs as well as a product analytics tool (PostHog). This includes pages visited, in-app clicks, timestamps, and session recordings — a replay of your on-screen interactions on UXLens, used to understand how people use the product and improve it. Analytics and session recording are only enabled for visitors outside the European Economic Area and the United Kingdom, where consent is not required; see Cookies & Local Storage below.
  • Billing data: the email and limited transaction metadata needed to process payments. We do not store full card numbers.

3. How We Use Your Data

  • To provide, operate, and maintain the UXLens service.
  • To run UX/UI audits on the URLs you submit and return results to you.
  • To authenticate you and keep your account secure.
  • To process payments and manage credits or subscription plans.
  • To send service notifications, security alerts, and support responses.
  • To improve our models, scoring, and product features in aggregate form.

4. Third Parties We Rely On

We do not sell your data. We do share the minimum data required with the following service providers to operate UXLens:

  • Supabase - authentication and primary database storage for accounts and audit records.
  • OpenRouter - the AI model provider used to generate audit analysis. The page content and audit prompt are sent to OpenRouter to produce findings.
  • Fly.io - the cloud hosting provider where the UXLens application runs.
  • PostHog - the product analytics provider we use for usage analytics and session replay. PostHog receives your in-app events and, when session recording is enabled, a replay of your interactions on UXLens. Text you type into form fields is masked. Because a session replay captures what is shown on your screen while you use UXLens, it may include content displayed in the app, such as URLs you have submitted for auditing. We do not intentionally send PostHog any data beyond analytics events and session replays. PostHog's privacy practices are governed by their own policy.

Each provider processes data on our behalf under their own privacy and security commitments. We encourage you to review their policies.

5. Data Retention

  • Audit results are retained for as long as your account is active.
  • When you delete an audit, it is removed from our database within 30 days.
  • When you close your account, all associated data is deleted within 30 days, except where retention is required by law.
  • Server logs are retained for up to 90 days for security and debugging purposes.

6. Your Rights

You can exercise the following rights at any time by emailing info@uxlens.io:

  • Access - request a copy of the data we hold about you.
  • Export - receive your audit results in a portable format.
  • Correction - update inaccurate account information.
  • Deletion - request that your account and data be deleted.
  • Withdrawal - opt out of non-essential communications.

We respond to verified requests within 30 days.

7. Cookies & Local Storage

UXLens uses a single authentication token, stored in your browser's localStorage, to keep you signed in. Our analytics provider (PostHog) sets first-party cookies and uses local storage to recognize returning visitors and to capture usage events and session recordings. These are not third-party advertising cookies and we do not use them for ad targeting, but they are analytics cookies.

Visitors in the European Economic Area and the United Kingdom (where GDPR and UK-GDPR apply) are detected by their region and are not subject to analytics collection or session recording — PostHog is not initialized for them. If we can't determine your region, we default to no tracking. Everyone else can opt out by emailing info@uxlens.io, or by blocking PostHog cookies in your browser settings; doing so will not affect your ability to use the Service.

8. Security

We use industry-standard measures to protect your data, including encrypted transmission (TLS), hashed passwords, and access controls. No method of transmission or storage is fully secure, but we work to protect your data using reasonable safeguards.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and notify you of material changes through the app or by email.

10. Contact

Questions about this policy? Email us at info@uxlens.io.