Privacy note

Who we are

The controller of the information described in this note is Jared James, trading as EveryShopper. Write to hello@in.everyshopper.co.uk. We do not publish a postal address yet; when we have one, it will appear here, and this sentence will be removed at the same time.

If you ask for early access

The form asks for your email address, which is required, and three optional things: which of the descriptions fits you, a store or client address, and a note. A fourth thing — which tier you are asking about — is always sent, because the form always has one tier selected. It also records which page you sent it from.

Your request is written as one line of text in one file on the server that serves this site (data/early-access/submissions.jsonl). There is no database, no CRM and no mailing list in this path. The line holds: when you sent it, your address in lower case, the description and tier the form had selected, the address you typed if you typed one, your note if you wrote one, and the page you were on. It holds no IP address, no cookie and no browser fingerprint.

If the same address is already in the file, nothing is written a second time and the page tells you so.

Nothing reads that file to send you anything. There is no automated email, no newsletter and no mailing list; nothing is sent when you submit, so there is no inbox to check; and no reply and no time frame is promised — that can mean never.

No part of the program deletes those lines. What removes them is a publish of this site, which replaces the files that serve it — a line here is not promised to survive one. An entry otherwise comes out only when a person edits that file, and we do not promise when, or that anyone will. You can ask, using the address at the end of this note.

If you email us

Monitoring mail is sent from an address on our sending subdomain, send.everyshopper.co.uk, under the sender name EveryShopper Monitoring, and replies go to hello@in.everyshopper.co.uk, the address a program polls.

A program reads that mailbox: it polls it, reads the message and records metadata about it, never the body of it — when it arrived, the address it came from and the name on that address, the subject line, how long it was, whether it arrived as HTML only, the filenames of any attachments, which of our own rules it matched and whether its acknowledgement went out. The record also holds the addresses on our side it was delivered to, how long the body was after any quoted text was removed, what we decided the message was and why, and whether the message was passed on to a person. No part of the body you wrote is copied into those records or into our code repository — the subject line is kept, so a reply can carry it — and no message anyone sends us is ever quoted back to anybody. The message itself sits in the mailbox at our mail provider until it is deleted, and we have not verified how long that provider holds it.

For each human reply we attempt one automatic acknowledgement, in the same thread, which says what the program did. None is sent if the address is already on our stop list, if the message is a bounce, an automated or away reply, or comes from this mailbox's own address, or if the run that read it could not send mail — no read key, sending switched off for that run, no usable address in your message to reply to, or the mail service refusing the message or failing to take it. The run records which of those happened — unless the program could not read the message at all: then nothing is recorded for that message and nothing is sent in answer to it, and the next run tries the message again. An acknowledgement is an attempt to answer, never a promise that one reaches you. The program polls the newest 250 messages in that mailbox on each run; a message older than those 250 is not listed, so it is not recorded and not answered. It states plainly that no person wrote it and that no person is on a rota to answer the mailbox, it promises no reply and it promises no time frame. A message that looks like it needs a person — a question, a complaint, an expression of interest, a request to stop, or anything else a person wrote — is passed on to a person, with the message's own text, so that a person can see what was written, when our own internal alert address is set. If that address is not set, or is unusable, nothing is passed on, and the run that handled the message records that it was not. A bounce, a spam complaint, an automated or away reply, or a message we sent ourselves is never passed on, and nothing is promised to come back from that. A message from an address already on the stop list is not answered at all, not even once.

If your message asks us to stop — for example "stop", "unsubscribe", "remove me", "no more emails", "do not email", "opt out" — or reads like a complaint — for example "how did you get my address", "GDPR", "complaint", "lawyer", "solicitor", "legal action", "data protection" — the address it came from goes on a stop list, which is the file data/monitoring/suppressions.json in our code repository (the repository is private). Those patterns are deliberately broad: the cost of missing one is mail still arriving to somebody who asked us to stop. The run that sends monitoring email reads that list once, before it sends anything, and an address on it is never sent to again: not an alert, not a digest, and no further acknowledgement.

The check happens when a run starts, and scheduled runs are best-effort — a run can start hours late, or be dropped. So nothing here is instant, and we promise no time by which the next run will have started. A message from a machine — a bounce, a delivery failure, an away reply — is never answered and never suppresses anything.

If you scan a page (free)

We fetch the address you type, once per redirect hop, up to four hops, with a 12-second limit, and read the HTML the server sends. We identify ourselves on every request as EveryshopperAccessibilityScanner/0.1 (+https://everyshopper.co.uk/checks); we do not run JavaScript, we do not pretend to be a browser, and we do not load images, scripts or stylesheets. The only other addresses we fetch are, at most, the first 3 privacy or terms links the scanned page itself publishes — the first 3 in document order, one request each, with an 8-second limit. Every outcome is reported as what it was — a status, a timeout, a refusal, or "could not be checked". We never probe an address a page does not publish, and we never crawl the rest of the site.

The report is produced when it is asked for and is not stored by us: no account, no history, nothing on disk. A report link such as /r/example.com re-runs the scan each time it is opened, so the address of the page it is about, not yours, is what appears in it.

Measurement

One cookieless page count, Cloudflare Web Analytics, is the only measurement on this site. It sets no cookie and stores nothing on your device. It records that a page was loaded — the path, with the query string removed — so a report link we hand out appears in the count as that path. It tells us a report was opened; it cannot tell us who opened it or whether they read past the first screen. Like any web request it carries the routine facts of a visit (your browser's language and version, an approximate country), and nothing that identifies you. There is no Google tag, no session record and no per-visitor profile here. What the count holds, and what it cannot tell us, is set out on the /checks page.

A visit to a report page

Nothing about this visit is stored about you: no account, no cookie, nothing written to your device, and no record that says who you are. The site's one measurement is a cookieless page count, and because a report page's address names the store it is about, that count records which store's report was opened — along with the routine facts any web request carries.

No account

There is no login and no account anywhere on this site: nothing asks you to sign in, and there is nothing to sign in to.

Who else is involved

Our mail is sent and read through Resend's API. Our pages are served by the platform this site is published on; our own code writes only the files described above. There is no checkout, no cart and no card field anywhere on this site, so no payment details are ever collected here — a payment account is open, but nothing is for sale.

Reaching us

hello@in.everyshopper.co.uk. A program reads that mailbox: it records what arrived and answers once automatically. No person is on a rota and no reply is promised.