ValidateHTML
Your sites

Privacy Policy

Last updated: October 15, 2026

1. Introduction

ValidateHTML.com (“we”, “our”, or “the Service”) provides free online validation tools, an optional free account, and a paid accessibility monitoring subscription. This Privacy Policy explains what we collect, why, and how long we keep it.

The short version: using the tools requires no account and leaves nothing behind. An account stores your email address and a record of the checks you run. A subscription adds what Stripe needs to bill you and what we crawl on the sites you ask us to watch.

2. Information We Collect

Without an account, when you are simply using a tool:

  • Code: HTML, CSS, JSON or XML you submit is processed and immediately discarded. We never store it, whether or not you have an account.
  • URLs: When you submit a URL we fetch the content, validate it, and discard it.
  • Analytics: Vercel Analytics collects anonymous usage data such as page views, browser type and country. PostHog records which tools you use and the steps you take; see Cookies and Tracking for when it uses a cookie.

If you create a free account:

  • Your email address. That is the entire account. There is no password, no name and no profile.
  • Your validation history. For each check you run while signed in we keep the tool used, the URL if you checked one, the counts, the score and the findings. We do not keep the code you submitted, in any mode: the findings are the useful part and the source is not ours to hold.
  • Sites you register. The address and the name you give it.

If you ask us to email you about the crawl:

  • Your email address, on a mailing list held by Resend. It is one list, whether you joined it from the study page or from a report you asked us to send. Signing in never puts you on it.
  • Only if you ask. There is a box next to each of those two asks, it is never ticked for you, and leaving it alone changes nothing else.
  • One click to leave. Every email carries an unsubscribe link, and using it removes you from the list without touching your account, your sites or your reports.

If you subscribe to monitoring:

  • Billing. Stripe collects and holds your payment details. We never see or store a card number. We store your Stripe identifiers, your plan and its status.
  • Audits. For each site you ask us to watch we store the pages we read, the findings on each, and the resulting report.

3. Cookies and Tracking

There are no advertising cookies and no ad networks on this site. The sponsored and featured sites shown beside the tools on wide screens are plain links with logos served from our own domain: nothing is loaded from those companies until you click. If you buy one of those cards, we keep what the card shows, your logo, the email Stripe collected and the Stripe ids needed to manage the subscription, for as long as the card runs and as our accounting obligations require. We use four things:

  • A session cookie, set only when you sign in. It holds a random token, is HttpOnly so scripts cannot read it, and expires after 30 days. Signing out deletes it here and on our server.
  • A fix-pack cookie, set only when you buy automatic fixes without an account. It holds a random token (we keep only its hash) so this browser can spend the fixes it paid for, is HttpOnly, and lasts a year. Stripe collects your email at checkout; we keep it with the pack only so that signing in later with that address moves the fixes and the invoice to your account.
  • Vercel Analytics, for anonymous usage statistics, without cookies.
  • PostHog, hosted in the EU (Frankfurt), to see how the tools are used and where they get in the way. With analytics allowed it sets one first-party cookie (ph_…_posthog, one year), follows your journey across visits and records your session with every input, editor and code block masked. Without it, PostHog only counts visits, without any cookie or storage on your device: an identifier is computed on its servers from your IP address and browser with a key that changes every day, then the IP address is dropped.

Who is asked. If your browser points to the European Union, the United Kingdom or Switzerland (time zone or language), a banner asks first and nothing beyond the cookieless count runs until you accept. Elsewhere, analytics are on by default. Everyone can change the choice at any time with the “Cookie settings” link at the bottom of every page; the choice is kept 13 months.

Retention. Session recordings are deleted after 30 days, PostHog statistics after 25 months at most.

Reports shared through a private link never load PostHog.

4. Third-Party Services

There are no advertising partners and no affiliate links. Both existed in the past and were removed.

5. Data Security and Retention

  • All connections are encrypted via HTTPS.
  • Sign-in links and session tokens are stored as one-way hashes, never in a readable form. A sign-in link works once and expires after 15 minutes.
  • Report links are long random URLs. Anyone holding one can read that report, so treat it as the document it is. They are excluded from search engines and are not listed anywhere public.
  • Validation history is capped at your 200 most recent checks. Older ones are deleted automatically as new ones arrive.
  • Audit reports are kept for as long as your account exists, so a report you were sent keeps working.

6. Your Rights (GDPR)

If you have never signed in, we hold nothing that identifies you by name or email. Declining in “Cookie settings” removes the PostHog cookie from your device, and we delete the analytics tied to it on request.

If you have an account you can ask us to show you everything we hold about you, correct it, or delete it entirely. Deleting your account deletes your history, your sites and your reports. Write to contact@validatehtml.com and we will act on it.

You can also remove any site yourself from your account at any time, and cancel a subscription from the billing portal without contacting us.

7. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected in the “Last updated” date.

8. Contact

Questions? Contact us at contact@validatehtml.com.