Privacy policy
This page explains what happens to data when you use Czech Th!s Report — what is stored, why, for how long, and who else sees it. It is deliberately short, because the tool deliberately collects very little.
Last updated
Who is responsible
The controller is Ondřej Huk, operating as Czech Th!s (https://czech-this.com). Company ID (IČO) 88259081, Bendova 28, 301 00 Plzeň.
For anything in this policy — including a request to see or delete your data — write to ondrej.huk@gmail.com. You will get an answer within 30 days.
The address you submit for an audit
When you run an audit we fetch the address you entered and everything publicly available at it: the page HTML, robots.txt, sitemap.xml, llms.txt and the HTTP response headers. We only read; nothing on the audited site is changed.
The resulting report is stored under a random identifier and is readable by anyone who has the link. It is not listed anywhere on this site and search engines are asked not to index it (robots.txt), but treat the link as semi-public and share it accordingly.
Reports are deleted automatically 12 months after they are created. If you want one removed sooner, send us the link. Exception: reports of a site registered in a signed-in account are its history and are kept for as long as the site stays in the account; after it is removed, the normal period applies.
The contact form
If you write to us through the form, we process the name, e-mail address and message you type, plus the identifier of the report you had open, so the reply makes sense. The purpose is answering your enquiry and, if it leads to one, agreeing a job.
That message is stored on our server and forwarded to us by e-mail. We keep it for 3 years so we can look up what was agreed, then delete it.
What we do not do
This site runs no analytics, no advertising pixels and no third-party tracking of any kind. The fonts are served from our own server, not from Google Fonts.
The only cookie is a sign-in cookie, and it is set only if you sign in to the account area (currently a closed test). It holds a random session key, is strictly necessary for staying signed in, and expires after 30 days or when you sign out.
Your IP address is held in the server's memory for a few minutes purely to enforce the rate limit (a cap of 10 audits per 10 minutes). It is never written to a database and disappears when the server restarts.
The “mark as resolved” ticks in a report are saved in your own browser (localStorage). They never reach our server and we cannot read them.
The account area (closed test)
Signed-in owners can add their own websites. For those sites we store weekly audit reports and, if the owner installs our measuring code, visitor statistics of that website: pages viewed, the referring site, campaign tags, screen size and conversions. IP addresses are not stored — an anonymous visitor is counted through a hash with a salt that is deleted daily; a random identifier is kept in the visitor's browser only after they consent to cookies on that website. For these statistics the website's owner is the controller and we process them on their behalf. They are deleted after 25 months, or immediately when the site is removed.
If the owner installs the optional crawler log, their server reports visits of search engine and AI robots (robot name, page, response code). The robot's IP address is used only to verify it is genuine and is not stored.
If the owner connects Google Search Console, we keep an encrypted access key to read their search data and to submit their sitemap. Disconnecting deletes it.
Who else the data reaches
Railway (hosting) runs the server and therefore stores the database on our behalf.
Resend (e-mail delivery) transmits messages sent through the contact form.
Google (Search Console API) — only for owners who connected it, to read their own search data.
OpenAI — in the account area only, it receives the public content of the owner's homepage, their questions, and search terms from their statistics, to check citations in ChatGPT and suggest topics. No visitor data is sent.
Google PageSpeed Insights receives the address you submitted — that is how the loading-speed measurement is taken. Nothing about you personally is sent with it.
Nobody else. We do not sell data, share it for advertising, or use it to train anything.
Your rights
Under the GDPR you can ask us for a copy of your data, for it to be corrected or deleted, for processing to be restricted, and you can object to processing based on legitimate interest. Where processing rests on your consent, you can withdraw it at any time.
Write to ondrej.huk@gmail.com — no particular form is needed. If you believe we have handled your data badly, you can complain to the Czech data protection authority, Úřad pro ochranu osobních údajů (uoou.gov.cz).