Who we are
RedFlag ("we", "us", "our") is an accessibility auditing tool operated by Qern Pty Ltd, based in the Australian Capital Territory, Australia. Our website is redflagstatus.com.
What data we collect and why
Account data. When you sign up, we store your email address. We use it to authenticate you, send password-reset emails, and very occasionally notify you of important service changes. We do not send marketing emails.
Scan results. When the extension scans a page it automatically saves accessibility violations to your dashboard. This includes CSS selectors, HTML snippets, axe-core rule IDs, WCAG criteria, and the URL of the scanned page. This data belongs to you. You can delete it at any time from your dashboard.
AI Label Review. If you run the optional "Review Labels" feature, the extension sends each reviewable element to our server using only five fields: CSS selector, HTML tag name, ARIA role, accessible name, and any associated <label> text. We run deterministic checks on the full set, then forward only the subset that still needs human-style judgement to Google Gemini. Page URLs, page indices, and full element HTML are never sent to Gemini. Flagged results, along with any verdict or note you add, save to your dashboard.
Payment data. Pro plan subscriptions are processed by Stripe. We never see or store your card number, CVV, or bank details. Stripe shares a subscription status and customer ID with us so we know which plan you're on. Stripe's privacy policy is at stripe.com/privacy.
Usage data. Our hosting provider, Netlify, collects standard server logs including your IP address and the pages you visit.
Product analytics. We use PostHog to understand which features are used so we can improve the product. On the website, analytics run only if you consent via the cookie banner (see our Cookie Policy). When you are signed in to the Chrome extension, it sends product usage events to our server, which relays them to PostHog. These events include the event name (for example "scan completed"), your account ID, your plan, the scan type, page and violation counts, and failure reasons. They never include page URLs, page content, or scan findings. The extension sends no analytics events when you are signed out. We do not use analytics data for advertising and we do not sell it.
How scans work
The Chrome extension runs axe-core entirely inside your browser. No page content is transmitted to our servers during a scan. Violation results are automatically saved to your dashboard after each scan so you can track issues over time. You can delete your scan data at any time.
Who we share data with
We do not sell your data. We share it only with the sub-processors needed to run the service:
- Supabase - our database and authentication provider, with data stored in the Sydney, Australia region.
- Stripe - payment processing.
- Netlify - web hosting and serverless functions.
- Google Gemini - AI processing for the optional Label Review feature, limited to the element fields listed above.
- PostHog - product analytics, limited to the usage events described above.
- Cloudflare - bot and abuse protection via Turnstile.
Each sub-processor processes data only as instructed and under confidentiality obligations.
Bot protection
Our login and sign-up pages use Cloudflare Turnstile to protect against automated abuse. Turnstile runs a privacy-preserving challenge in your browser. It does not use tracking cookies or display an image puzzle. Cloudflare may process your IP address and browser signals to verify the challenge. This data is governed by Cloudflare's privacy policy.
Browser storage
The Chrome extension uses chrome.storage.local to store your authentication session and in-progress crawl state. This data stays on your device and is cleared when you sign out or uninstall the extension. We do not use cookies in the extension itself.
The web dashboard sets a session cookie issued by Supabase Auth to keep you signed in. It is a secure, HTTP-only cookie and is cleared when your session expires or you sign out.
Data retention
We keep your account data for as long as your account is active. If you delete your account, all associated domains, violations, and scan history are permanently deleted within 30 days. Payment records are retained by Stripe for their required period for tax and compliance purposes.
Scan history access by plan. Free plan users can view violation data from the last 3 days in their dashboard. Older data is stored but not displayed until you upgrade. Pro plan users have access to their full, lifetime scan history with no time restriction. Data is never deleted based on plan. Only access in the dashboard is limited.
Your rights
You can request a copy of your data, correction of inaccuracies, or deletion of your account at any time by emailing us. If you are located in the EU or UK, you have additional rights under GDPR/UK GDPR. If you are in Australia, the Privacy Act 1988 (Cth) applies.
Changes to this policy
If we make material changes, we will update the "Last updated" date above. Continued use of the service after a change constitutes acceptance of the updated policy.
Contact
Questions? Email us at support@qern.com.au.