Privacy

Who is responsible

RoastFast (roastfa.st) is run by Kornel, a solo developer based in Hungary. For data protection law (GDPR) Kornel is the data controller. Contact details are at the bottom of this page.

What we collect

• Account (email sign-up): your email address and a password. The password is hashed by our authentication provider (Supabase) and is never visible to us in plain text.
• Account (Sign in with Google or GitHub): your email address, your name and the URL of your profile picture, as shared by Google or GitHub. We never receive your Google or GitHub password. From Google we only request the basic sign-in scopes (openid, email, profile). We do not access your Gmail, Drive, Calendar, contacts or any other Google data.
• Websites you roast: the address you submit, and for every check the score, the roast line, the three fixes, the five category scores and the time. The address is saved without anything after a “?”.
• Daily usage: how many checks your account ran today, to enforce the limit of 5 per day.
• Technical data: your IP address and browser type. We use them briefly for abuse prevention and rate limiting, and our hosting provider keeps standard server logs.
• Visit statistics: page views and basic device, browser and country information, plus a few anonymous actions (starting a roast, copying the fix prompt, hitting the daily limit), collected by our analytics tool (DataFast). These never include the website address you submit or any personal data. When a known AI or search crawler requests a page, DataFast also logs that request (the crawler's user agent, its IP address and the page path), so we can see which bots read the site; ordinary visitors are not logged this way.

How we use it

• To create and secure your account, and to sign you in.
• To show your profile picture next to your account menu if you signed in with Google or GitHub.
• To open the page you submit, generate your roast and save it to your history, so a later check can be compared with an earlier one.
• To limit usage to 5 checks per day and to prevent abuse.
• To send the emails your account needs: confirming your address and resetting your password. No marketing emails.
• To count visits and see which pages are used, so we can improve the site.

We do not use your data for advertising, profiling or training AI models, and we do not sell it.

Google user data

The information we receive from Google (your email address, name and profile picture) is used only to sign you in and to show your picture in the account menu. It is not shared with anyone except the processors listed below that run the service, it is not used for advertising, and no person reads it except where needed for security, to comply with the law, or with your consent.

RoastFast's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The page you submit and OpenAI

We open the page in an automated browser, take a screenshot of its first screen and read its visible text. That screenshot and text are sent to OpenAI, which writes the roast. We ask OpenAI not to store the request. The screenshot and text are discarded once the response is sent.

To keep repeat requests fast, the finished roast of a public page (score, line, fixes and categories, not the screenshot) is cached for up to 12 hours, keyed by the page address. It is not linked to your account.

Sharing a roast

Nothing you roast is public. If you press Share, we publish a page for that one roast with the website address, the score, the roast line and the five category scores. Anyone with its link can open it, but it is not listed or indexed by search engines. It does not include your name, email, the fixes or anything else from your account. It disappears when you delete that check, your saved history or your account.

Who we share data with

We only use these service providers to run RoastFast, and they process data on our behalf:

• Vercel: hosting.
• Supabase: accounts, sign-in and the database that stores your roast history.
• OpenAI: writes the roast from the page you submit.
• Resend: delivers the confirmation and password reset emails.
• DataFast: visit statistics.
• Google and GitHub: only if you choose to sign in with them.

We do not sell your data. Some of these providers process data outside your country, including in the United States, under their own data protection safeguards.

Cookies

The cookies we set keep you signed in. They are necessary for the service to work. We use no advertising cookies. Our analytics tool, DataFast, may set its own identifier to tell visits apart; it does not track you across other sites.

How long we keep it and how to delete it

• Your account and roast history stay until you delete them.
• In Settings, “Delete saved history” removes every saved check. “Delete account” permanently removes your account and everything saved with it, including your daily usage record.
• The 12-hour cache of public-page roasts expires on its own.
• Hosting logs are kept by our hosting provider on its own schedule.

Your rights

Under data protection law you can ask us for access to your data, correction, deletion, a copy of it, or object to how it is used. Most of this you can do yourself in Settings; for anything else, contact us below and we will reply. You can also complain to your local data protection authority; in Hungary that is the NAIH (naih.hu).

Security

Traffic is encrypted with HTTPS. Each account can only read and delete its own saved roasts, and passwords are stored only as hashes. No system is perfectly secure, so please use a strong, unique password.

Don't submit private pages

RoastFast only works with public websites. Please don't enter URLs that contain personal data, secrets or access tokens.

Children

RoastFast is not meant for people under 16, and we do not knowingly collect their data.

Changes

If we change how your data is handled, such as adding a new provider, we will update this page and the date above.

Contact

Kornel, RoastFast
Hungary
Email: private.halmi@gmail.com