Privacy Policy

Last updated: 7 October 2026

DiffiCat comes in two forms with very different privacy footprints: a desktop app that runs entirely on your machine, and a browser version at app.difficat.com that runs on our servers. This page describes both, plus this website and the Agent API.

DiffiCat is operated by Elena Kuprienko, Switzerland. For questions about this policy, use the feedback form. Messages sent through the Agent API feedback endpoint or the send_feedback MCP tool are delivered to the maintainers’ chat the same way as the feedback form, are read by a person, and are not stored by the service.

The desktop app

The desktop app collects nothing. It has no telemetry and no analytics, it never uploads your URLs, screenshots, or reports, and everything it produces stays on your own disk. Its only network activity is fetching the pages you ask it to compare and checking for app updates.

This website and the browser version

Both difficat.com and app.difficat.com load PostHog analytics, hosted in the EU (Frankfurt). It measures how the pages are used — page views, browser and device characteristics, and which features are used — for example that a comparison was started or a report was downloaded. It also records where on the page you click and move the mouse, as positions only, so we can draw heatmaps of which parts of a page get attention. It also records your visit as a replayable session, so we can see where people get stuck. In the web app the recording is a wireframe: all text, images and typed values are masked or blocked, so the addresses you compare and the reports you view are never recorded. On difficat.com the page text is visible but what you type is masked. The sign-in, account and prepaid pages are never recorded. It never records the text you click or type. These events carry counts, positions and short labels only, never the URLs you compare, the address you arrived from beyond its domain and path, or anything you type. The analytics sets no cookie: it keeps a random anonymous identifier in your browser's local storage, and we never link it to your name, email or account. We use this to understand which parts of the product people find and use; we do not sell or share this data. See PostHog's privacy policy for how PostHog processes it.

What the browser version stores

When you run a comparison in the browser version, the pages you name are fetched by our servers, and the resulting reports and screenshots are stored in Google Cloud Storage. Comparisons of a Pro account are saved until you delete them; for every other account they are kept for 30 days (at most 5) and listed in your history, so you can reopen them. Deleting a comparison from your history removes it from the app at once; the stored report files of an unsaved comparison are deleted on the same 30-day schedule.

• When sign-in is enabled, stored reports and screenshots are scoped to the account you signed in with, and are not readable by other users. You sign in with a Google, GitHub or Microsoft account, or with an email address, a username and a password. Through a provider we receive that account's basic profile (name, email address and, where the provider gives one, picture) solely to identify your session; we never see your provider password, and we keep no provider access token after the sign-in. For an email-and-password account we keep the email address, the username you choose and the password only as a salted scrypt hash, from which the password cannot be read back. Sign-up and password-reset links are sent to your address through Google Workspace's mail relay; the message holds only the link.
• When sign-in is switched off, runs are tied to an anonymous per-browser session cookie instead — no account holds them.
• A signed-in user can save a snapshot of a site: the text, the HTTP status and, unless the user chooses text only, a screenshot of each page they list, stored in Google Cloud Storage so a live site can be compared against it later. A snapshot is kept until its owner deletes it (up to 30 per account), is readable only by that owner and by the DiffiCat accounts or agent links the owner shares it with, and is deleted with the account. The owner can revoke a share at any time; a share link expires after at most 90 days. It holds the pages as they were served to the capture, including pages behind a login the user supplied; the login itself is never stored. A snapshot is never public and is not subject to the 30-day schedule above.
• Usage limits (comparison runs and page discoveries per hour, and a daily page budget) are enforced per session and per IP address; the counters store hashed identifiers, not raw IP addresses.

The URLs you submit are used only to run the comparison you asked for. In the browser version and the agent API, requests to localhost, loopback, and private-network addresses are refused; the desktop app fetches from your own machine and may reach the private hosts you enter.

Accounts and Pro

Signing in creates an account record holding the account identifier your sign-in provider (Google, GitHub or Microsoft) gives us, your email address, which provider you signed in with, your tier and, for subscribers, the Stripe customer and subscription identifiers and a hash of the account's API key. Subscription payments are processed by Stripe; the app stores no card data. An account stays until its owner deletes it from the account page. Deletion removes the account record, its jobs and reports, its saved snapshots and the link to the Stripe customer. What remains: invoices at Stripe; the API key's ledger of amounts and hashed identifiers, without name or email, kept for the ten years Swiss accounting law requires (Code of Obligations art. 958f); and screenshots until their existing 30-day deletion. A subscriber who deletes the account forfeits the remaining paid period. One account per person: each sign-in identity is stored as its own record naming your account, and a sign-in method is joined to your existing account only when the provider has verified that it holds your account's email address (Google and GitHub do; Microsoft never joins on its own) or when you add the method yourself on the account page, where you can also remove it. Identity records are deleted with the account.

Credentials for protected sites

If you supply HTTP basic-auth credentials for a site under test, the desktop app keeps them on your machine only. The browser version uses them for the duration of the run to fetch the protected pages and does not store them with the report.

Agent API jobs

An Agent API call paid with an anonymous prepaid key or a wallet collects no account, name or email address; a call paid with a Pro account's key is attributable to that account through the key hash for as long as the job record exists. A comparison job stores a job record holding the URLs, the status, the summary, a hash of the job token and a hash of the paying credential; the record expires 24 hours after its last update. The job's report data and screenshots are deleted 30 days after they are written. A job is readable only with its job token or with the prepaid key that paid for it.

Prepaid top-ups for the Agent API

Card payments for prepaid Agent API balances are processed by Stripe on Stripe's own checkout pages; see Stripe's privacy policy for how Stripe handles them. The app stores no card data and no buyer email address. Our records hold a hash of the prepaid key, its balance, its ledger of top-ups and debits, and the Stripe payment identifiers needed to credit or reverse a payment.

Your choices

• Turn on your browser's Do Not Track setting, which the analytics and the session recording honour by sending nothing, or block eu.i.posthog.com; the product works the same either way. Clearing site data only resets the anonymous identifier.

Changes

If this policy changes, the new version will be published at this address with an updated date.