Privacy Policy for weetwiz
Last updated: November 3, 2026 ·
This Privacy Notice for A.B.Z., s.r.o. ("we," "us," or "our") describes how and why we might access, collect, store, use, and share your personal information when you use WeetWiz. WeetWiz is a passive security audit browser extension. It intercepts HTTP response headers on every page load and sends them to our Cloudflare server for analysis. It does not read page content, form data, or stored browser cookies.
WeetWiz PRO is meant for experienced internet users. It checks the security of the websites you use and share your personal data with, such as online shops, email or your bank, quietly in the background on every visit. Unlike the simple warning in the free edition, PRO shows you the details: the security score and what lowers it, the server IP address with a link to its network owner on ipinfo.io, and whether the score has gone up or down since earlier visits. With these details you can judge for yourself whether a page is the real one before you share your data with it.
Sections 1 to 16 describe the paid (PRO) edition. If you use the free Bank Free Check edition, section 17 lists everything that works differently for you.
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with these policies and practices, please do not use the Services.
Table of Contents
What information do we collect?
How do we process your information?
What legal bases do we rely on?
When and with whom do we share your information?
Cookies and tracking technologies
How long do we keep your information?
How do we keep your information safe?
Do we collect information from minors?
What are your privacy rights?
Controls for Do-Not-Track features
United States residents — specific rights
Do we make updates to this notice?
How can you contact us?
How can you review, update, or delete your data?
Technical approach and browser permissions
Cookie Policy
Bank Free Check (free edition)
1.What information do we collect?
Personal information you provide When registering, you provide your email address via the in-extension onboarding flow. It is sent to our Cloudflare server, which starts a Stripe checkout session. Your email is used to create your WeetWiz account, deliver your API key, and send account-related communications. No marketing emails are sent without explicit consent. (Free edition signup: see section 17.)
Information collected automatically On every main-frame browser navigation, the extension automatically sends a request to our Cloudflare server containing:
URL of the page visited, without its query string and fragment (the parts after "?" and "#") Protocol (https: or http:) All HTTP response headers returned by the server Cookie names and their security flags (Secure, HttpOnly, SameSite) from Set-Cookie response headers. Cookie values are never sent, and cookies stored in your browser are not read Server IP address resolved by Chrome for the request Your API key (as a request header for authentication) Answers to the short in-panel questions, if you answered any (question id + your answer; for a "false alarm" answer also the scanned hostname)
Bank check If you have chosen your bank in the extension, then on that bank's pages, and on pages whose address carries the bank's name (possible look-alikes), the extension also sends our Cloudflare server the page's hostname, the server IP address, and the redirect chain that led to the page (hostnames only). The server compares them with the bank's known values and returns the verdict. For other websites, no bank check data is sent. The bank list and your chosen bank's page addresses are downloaded without your API key.
Report fake site Only when you press "Report fake site", the extension sends our Cloudflare server the reported hostname, its server IP, and the redirect chain (hostnames only). Your API key is sent with the request only to block spam. The stored report has no API key, email or user ID.
When scanning is turned off with the power button in the popup, nothing is sent.
Note: The extension does not read page HTML, JavaScript, CSS, rendered content, form inputs, or cookies already stored in your browser. On mail.google.com a small script only notices when the address in the tab changes (Gmail switches views without reloading the page), so the page can be checked again; it does not read your emails.
Payment data If you choose to make a purchase, payment data (card number, security code) is handled and stored entirely by Stripe. We do not receive or store your payment instrument details. See Stripe's privacy policy: stripe.com/en-sk/privacy. Information not collected
Page HTML, JavaScript, CSS, or any rendered content Form inputs or user-typed data Stored browser cookies Browsing history (each scan is independent) Location data (your own IP address is not stored; Cloudflare tells our server only your country, see section 4) Information about you from third parties
2.How do we process your information?
We process your information to provide, improve, and administer WeetWiz. Specifically:
Security scoring: URL, headers, cookie names and flags, and server IP are sent to our Cloudflare server to compute a security score for the visited site and return results to your extension. Bank check: hostname, server IP, and redirect chain of your bank's pages are compared with the bank's known values to tell a real bank page from a fake one. Fake site reports: anonymous reports are kept for a short time to spot fake sites that many users meet. In-panel questions: your answers help improve the checks and the texts shown. Site statistics: an anonymous per-site average score (not linked to you) shows how sites change over time. Account management: your email is used to create your account, issue your API key, and communicate account-related information. Payment processing: your email is shared with Stripe to initiate a checkout session. Transactional email: your email is shared with Resend solely to deliver your API key token and account notifications. (Free edition keys: see section 17.) We do not use your information for advertising, profiling, or any purpose beyond what is listed above.
3.What legal bases do we rely on?
We only process your personal information when we have a valid legal reason to do so under applicable law.
Consent: where you have given us permission to use your information for a specific purpose. Contract performance: where processing is necessary to fulfill a contract with you (providing the WeetWiz service you have subscribed to). Legitimate interests: where processing is in our legitimate interests and not overridden by your rights (e.g., ensuring security and fraud prevention). Legal obligation: where we must comply with applicable law. If you are located in the EU or UK, this section applies to you under the GDPR and UK GDPR. If you are located in Canada, this section applies to you under PIPEDA.
4.When and with whom do we share your information?
We share information only with the following third-party services, strictly for the stated purposes: Service |Purpose| ( Data shared) [Privacy policy]
Cloudflare |Hosting of our server: security scoring, bank check, DNS lookups| (URL, HTTP response headers, cookie names and flags, server IP, redirect chain hostnames, API key; Cloudflare also tells our server the country of the request) [cloudflare.com] IPinfo ipinfo.io |Identifying the network owner of a website's server| (Only the website's server IP address, nothing about you. If you click the IP address in the popup, the ipinfo.io website opens in a new tab and their own privacy policy applies) [ipinfo.io] Stripe |Payment processing| (Email address, payment details (handled entirely by Stripe)) [stripe.com] Resend resend.com |Transactional email delivery (API key tokens)| (Email address) [resend.com] Brevo and Cloudflare Turnstile are used by the free edition only (see section 17). Business transfers We may share or transfer your information in connection with a merger, sale, financing, or acquisition. You will be notified via the email address associated with your account.
No advertising or analytics We do not permit third parties to use tracking technologies on WeetWiz for advertising or analytics purposes. No advertisements are shown in the PRO edition. The free edition is paid for by us and shows advertising in the form of a static logo tile, without any tracking (see section 17). No user profiling for marketing purposes is performed.
5.Cookies and tracking technologies
WeetWiz is a browser extension, not a website. The extension itself does not set tracking cookies in your browser.
The WeetWiz website (weetwiz.com) may use cookies strictly necessary for its operation (e.g., session management). No advertising, analytics, or third-party tracking cookies are used on the website.
You can configure your browser to block or remove cookies. This will not affect extension functionality.
6.How long do we keep your information?
We keep personal information only for as long as necessary for the purposes described in this notice or as required by law.
Security scan data (URL, headers, server IP): sent to our Cloudflare server to compute a score and not stored persistently after the score is returned. Only an anonymous per-site aggregate is kept (hostname, average score, number of scans, time of the last scan), never linked to you or your key. Bank check data (hostname, server IP, redirect chain): used for the verdict and not stored. Fake site reports: anonymous (hostname, server IP, redirect chain), deleted 7 days after the site was last reported. In-panel question answers: kept while your key is active; a new answer to the same question replaces the old one. Stored with your key and your country, never with your IP address or email. Email address: retained while your account is active. Deleted upon account deletion request. API key: retained until account deletion. Revoked immediately upon deletion request. Local scan results (browser session storage): cleared automatically when the browser is closed. Local settings (browser local storage): retained until the extension is uninstalled. See section 15.
7.How do we keep your information safe?
We have implemented appropriate technical and organizational security measures to protect your personal information. All data transmitted between the extension and our Cloudflare server is sent over HTTPS. Requests are authenticated with your API key. However, no electronic transmission over the Internet can be guaranteed 100% secure. Transmission of personal information to and from the Services is at your own risk. You should only access the Services within a secure environment.
8.Do we collect information from minors?
We do not knowingly collect data from or market to children under 18 years of age. By using the Services you represent that you are at least 18 years old. If we learn that personal information from users under 18 has been collected, the account will be deactivated and the data deleted promptly. If you become aware of any such data being collected, please contact us at [email protected].
9.What are your privacy rights?
EEA, UK, Switzerland, and Canada In these regions, under applicable data protection laws (GDPR, UK GDPR, PIPEDA), you have the right to:
Request access to and a copy of your personal information Request rectification or erasure of your personal information Restrict or object to the processing of your personal information Request data portability Not be subject to automated decision-making with significant effects Withdraw consent at any time (where processing is based on consent) To exercise these rights, email us at [email protected]. We will respond within 30 days.
If located in Switzerland: you may contact the Federal Data Protection and Information Commissioner.
Account deletion You may request deletion of your account and all associated data (email, API key) by emailing [email protected]. Upon deletion the API key is revoked and the email address removed from all systems within 30 days. Local extension data can be removed at any time by uninstalling the extension.
10.Controls for Do-Not-Track features
Most browsers include a Do-Not-Track ("DNT") feature. WeetWiz does not track users across third-party websites for advertising purposes, so DNT signals have no material effect on its behavior. The security scan performed on each page navigation is a functional feature of the extension, not tracking.
11.United States residents — specific privacy rights
If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have additional rights under applicable state privacy laws (including CCPA/CPRA).
Categories of personal information collected (past 12 months)
Category |Examples| [Collected]
Identifiers |Email address, unique account identifier (API key)| [Yes]
Commercial information |Subscription status| [Yes (via Stripe)]
Internet / network activity |URLs visited, HTTP response headers, server IP; on your bank's pages also hostname and redirect chain| [Yes, for security scoring and the bank check only]
Geolocation data |Precise physical location| [No (country only, from Cloudflare, stored with question answers)]
Biometric information Fingerprints, voice, face No
Inferences / profiling Profiles drawn about a consumer No
No sale or sharing of personal information
We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information belonging to users in the future. Your rights
Right to know whether your personal data is being processed Right to access your personal data Right to correct inaccuracies in your personal data Right to request deletion of your personal data Right to obtain a copy of personal data you previously shared Right to non-discrimination for exercising your rights Right to opt out of the sale or sharing of personal data (not applicable, because no sale or sharing occurs) How to exercise your rights To exercise any of the above rights, email [email protected]. We will respond within the timeframe required by applicable law (generally 45 days, extendable by another 45 days with notice).
12.Do we make updates to this notice?
We reserve the right to update this Privacy Notice at any time. Changes will be reflected by updating the "Last updated" date at the top of this page. For material changes, we will notify registered users by email. Continued use of WeetWiz after changes constitutes acceptance of the revised policy.
13.How can you contact us about this notice?
If you have questions or comments about this notice, you may contact us:
A.B.Z., s.r.o., Leopoldov majer 20, 84106 Bratislava, Slovakia, IČO 31358357
14.How can you review, update, or delete your data?
Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how it has been processed, correction of inaccuracies, or deletion of your personal information. You may also have the right to withdraw your consent. To submit a request, email [email protected]. Requests are processed within 30 days.
15.Technical approach and browser permissions
WeetWiz is built to collect only the data needed for a security audit. That data is processed on our Cloudflare server and kept there only as described in section 6. The goal is to help you check a website before you share your own data with it. Browser permissions
webRequest: read the HTTP response headers and server IP of the page you open (main frame only). webNavigation: notice redirects made by page scripts or meta-refresh, so the redirect chain is complete. storage: keep your settings and the latest results in the browser. activeTab: show the result for the tab you are looking at. Host access to all sites: needed to read response headers on any site you visit. Content script on mail.google.com: only notices address changes inside Gmail (see section 1).
Data kept in your browser
Your API key, your settings, your chosen bank with its page addresses, your pending answers to in-panel questions, and the sites you reported yourself (so the same site is not reported twice). The latest result for each tab is kept only until the browser closes. All of it is removed when you uninstall the extension.
16.Cookie Policy
WeetWiz is a browser extension, not a website with advertising or analytics. This section clarifies how cookies are handled across all parts of the WeetWiz service.
Extension: no cookies set
The WeetWiz browser extension does not set, read, or modify cookies in your browser. It does not use tracking pixels, web beacons, or any equivalent technology.
What "cookies" means in WeetWiz scans
When the extension audits a website, the cookies field sent to our Cloudflare server contains only cookie names and their security flags from the Set-Cookie response headers returned by that website's server. Cookie values are never sent, and cookies stored in your browser are not read. This data is used exclusively to check cookie security flags (HttpOnly, Secure, SameSite) and is not retained after the security score is returned.
weetwiz.com website
The WeetWiz website (weetwiz.com) may use cookies strictly necessary for its operation (e.g., session management). No advertising cookies, analytics cookies, or third-party tracking cookies are set on the website.
Your controls
You can configure your browser to block or delete cookies at any time. Doing so will not affect the security audit functionality of the extension. Most browsers offer cookie controls under Settings → Privacy.
Bank Free Check is meant for people who are less sure of themselves online, such as older family members who use internet banking. You can install it for them and choose their bank. On their bank's login pages, the extension checks whether the page really belongs to the bank or is a fake look-alike, so they can check before typing their login details. If the page is a fake, they see a red warning and know not to log in there. It is free and simple to use, and it can help them stay safer.
The free edition checks only your bank's pages. It does not score other websites. Everything in sections 1 to 16 applies, except where this section says otherwise.
Free service and fair use
Bank Free Check is free for you because we, A.B.Z., s.r.o. (weetwiz.com), pay for it. We offer it to support safer internet banking and bank payments. Because it is free, it shows advertising: currently the logo tile described below. The advertising never tracks you and sends nothing about you to anyone.
The free service follows a fair use rule, much like a mobile tariff: you get the service as described, but you may not misuse its conditions. Bank Free Check is meant only for checking your own bank's login pages before you log in.
We have the right to cancel any free key at any time, at our own discretion, if we find it is used against this policy or against the purpose of the service. Examples include automated or bulk requests, sharing one free key widely, signing up many keys for the same person, or trying to get around the bank lock or the limits. The list is not complete. A cancelled key stops working at once, and we may refuse a new free key for the same person. Your data is then kept and deleted as described in this policy.
What is sent
Only on your chosen bank's pages, and on pages whose address carries the bank's name (possible look-alikes): the page's hostname, the server IP address, the redirect chain (hostnames only), your API key, and answers to in-panel questions if you gave any. These go to our Cloudflare server. On other websites the extension sends nothing: no URL, headers or cookies. The bank check works the same way as in the PRO edition, limited to one bank and a number of checks per day and month.
Signup and email
You sign up on the WeetWiz signup page with your email address only. No payment is involved, so Stripe is not used. The page uses Cloudflare Turnstile, a bot check that takes the place of a CAPTCHA. Your key is emailed by Brevo (brevo.com) from [email protected]. Brevo receives your email address only to deliver that message.
To stop abuse, each signup attempt is logged with your normalized email address, a salted hash of your IP address (never the IP itself), and the result (new key / key re-sent / refused). This log is deleted after 30 days.
Daily limit
Free keys can run a limited number of bank checks per day and per month. To count them, your key record keeps the day and month counters and the last counted bank with its time, so that moving around the same bank within a few minutes counts as one visit. This entry is overwritten each time; no history is kept.
Bank choice
The free edition checks one bank. After your choice is confirmed it is locked, so one free key can't be used for many banks. To check all available banks, you can upgrade to the PRO edition.
Logo tile
The free edition shows a tile with the WeetWiz logo and, if your bank has agreed to it, your bank's logo. The pictures are downloaded from our Cloudflare server and kept in the browser. The tile is only a picture. It has no link, sets no cookies, and sends nothing about you to the bank. The PRO edition shows no logos.
How long data is kept
Your email and free key are kept while your account exists; free keys do not expire. You can ask for deletion at any time, as in section 9. Bank check data is not stored, as in section 6. The browser also remembers when your bank choice was locked, the logo pictures, and when your daily or monthly limit runs out, until you uninstall the extension.
© 2026 A.B.Z., s.r.o. · IČO 31358357 · Leopoldov majer 20, 84106 Bratislava, Slovakia · WeetWiz · [email protected] · [email protected] (Bank Free Check) · [email protected] · [email protected]