err.day is a home for small web tools. We respect your privacy and only collect what we need to run the site.
Storefront Accessibility Check (/a11y)
The accessibility check landing page uses first-party analytics. No third-party tracking scripts run on this page.
What we collect
- Lead form: If you request a report, I store your store URL, email address, and any optional note you leave. I also save when you submitted and how you found the page (referrer, landing URL, UTM tags, and a coarse device type). I queue an automated storefront scan that runs on my own computer (it pulls work from the server; your store is not contacted by a public inbound worker).
- Visitor ID: A random identifier stored in your browser's localStorage. It persists until you clear your browser data.
- Session ID: A random identifier stored in sessionStorage. It is cleared when you close the browser tab.
- Page activity: Anonymous funnel events such as page views, when you start the form, submit attempts, successful submissions, and validation errors. I also record scroll depth, time on page, and FAQ interactions.
- Referrer and UTM parameters: Where you came from and any campaign tags in the URL (for example
?utm_source=instagram&utm_medium=reel).
- Device info: Browser type and device type (desktop, mobile, tablet), parsed from your user agent string. Obvious bots are filtered out and not stored.
- IP hash: Your IP address is hashed with a secret salt before storage on page views. I store a 16-character truncated hash, not the raw IP.
How we use it
I use this data to send accessibility reports, understand where visitors come from, and see where people drop off in the lead form funnel. There are no third-party analytics scripts on this page. The site owner may receive a push notification when someone visits or submits the form (via ntfy.sh). Those alerts include source, device type, and (for leads) the store URL and email you entered.
Retention
Page view records are automatically deleted after 180 days.
Opting out
Add ?notrack=1 to the URL, or set a cookie named notrack to any value. No data will be recorded.
Legacy Tracker (/legacy)
The legacy habit and nutrition tracker is available for existing accounts.
What we collect
- Account email: Required for login.
- Password: Stored as a bcrypt hash, never in plain text.
- Your content: Habits, check-ins, and nutrition entries you choose to enter.
- Session cookie: Used to keep you logged in.
Third-party services
The legacy tracker may load Google Analytics if the site owner has configured it. This is the only third-party analytics on the site.
Account deletion
You can delete your account from the legacy settings page. This permanently removes your email, habits, check-ins, and nutrition entries.
Security
All traffic uses HTTPS. Passwords are hashed with bcrypt. IP addresses are hashed before storage. No method is 100% secure, but we take reasonable steps to protect your data.
Contact
Questions about privacy? Email support@err.day.