# Privacy Policy > How NoCodeExport collects, uses and protects your data: accounts, exports, payments, analytics with your consent, and the providers that process it. Canonical: https://www.nocodeexport.com/en/privacy Last updated: 2026-10-15 How we collect, use, and protect your data ## Overview NoCodeExport provides website export tools, previews of an export before you pay, hosting of exported sites, subscriptions, a one-time Site Pass, and support for people who want more control over their website code and hosting. This policy describes what personal data we collect, why we collect it, how long we keep it, who helps us process it, and the choices you have when you use our website, product, support channels, and marketing forms. ## Chrome extension When you click the extension icon, it reads the address of the active tab to fill in the site to export and may add a toolbar to that page, which you can close. The extension sends an address to NoCodeExport only when you start a scan, and your export choices only when you start an export. A site being public lets us scan it; it does not give anyone permission to copy it. To connect, you sign in on our website and allow the extension on a consent screen. It then receives an account token that expires after 12 hours without use and after 7 days at most; using it extends it within that limit, signing out of the extension revokes it at once, and “Disconnect the Chrome extension” in your account settings signs it out in every browser and makes every browser ask you again. When you allow the extension, we set a first-party cookie on our website that remembers that choice for your account in that browser for up to 180 days, so reconnecting does not ask again; clearing our site’s cookies forgets it. The extension keeps the token only in Chrome’s session storage, which Chrome clears when the browser restarts; while a sign-in is in progress, its one-time verifier is kept there for at most 30 minutes. On your device, not synced and removed with the extension, it keeps your language; a draft for each open window (the site address, the pages and titles the scan found, your selection and options), kept after the window closes only when it holds a scan or a selection, at most 10 drafts for up to 14 days each; your recent exports for each account (an opaque account identifier, the export’s ID, site address, request and status, and for a failed export the reason we gave), at most 20 per account, each for 30 days after its last change; and a consent proof, a value we give the extension when you allow it, which it sends only to us when it reconnects, so that a reconnection that skips the consent screen is accepted from this extension alone (it is not an account token and grants nothing by itself; a new one replaces it each time you allow the extension). Signing out keeps drafts, recent exports and the consent proof so you can resume after signing in again. The extension saves a ZIP itself, so the token never appears in Chrome’s download history. Buying a Site Pass or a plan opens Stripe Checkout in a new tab. If you already subscribe, your billing page on our website opens instead; the extension cannot change your subscription and never sees payment details. NCEHost publishing and custom domain setup go from our servers to NCEHost’s. The extension has no third-party analytics SDK. The extension’s use of the information it handles complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We use that information only to provide and improve the features described in this section. We do not sell it, we do not use it for advertising or to determine creditworthiness, and we do not use or transfer it for any purpose unrelated to those features. ## Who controls your data NoCodeExport is the controller for the personal data described in this policy. If you need help with a privacy request, contact [hello@nocodeexport.com](mailto:hello@nocodeexport.com). We operate from the United States and use service providers that may process data in the United States or other countries where they maintain infrastructure. ## Data we collect - Account and identity data, such as your name, email address, username, and authentication identifiers. - Billing and transaction data, such as your selected plan, checkout status, Stripe customer and subscription references, invoices, and payment-related metadata. We do not store full card numbers. - Export and project data, such as submitted URLs, detected pages, configuration choices, export artifacts, webhook settings, and delivery records. - Preview data, such as the email address you enter to receive a preview of your export. If no account uses that address, we create an unverified account for it. If an account already uses it, we record a separate guest preview instead, which becomes part of that account only when its owner signs in with a confirmed email from the same browser. - Guest purchase data, when you buy a plan or Site Pass without signing in: the email address you pay with, what you bought, and the Stripe references for the payment or subscription. - Support and contact data, such as contact form submissions, support messages, hosted form submissions, and chat transcripts. - Newsletter and marketing data, such as your email address, signup source, locale, consent record, and subscription or unsubscribe activity. - Technical and usage data, such as IP address, browser details, device information, page views, referral data, feature usage, and cookies or similar identifiers. ## How we use your data - To provide, secure, and improve the export product, previews, hosting, paid plans, and customer support. - To create and manage accounts, authenticate users, process payments, prevent abuse, and enforce plan limits. - To generate exports, host temporary artifacts, deliver files, and support deployment or hosted-form features you request. - To build a preview of your export before you pay, publish it at a temporary address, and email you when it is ready or ask you to confirm your email address. - To attach a purchase made without signing in to the account that signs in with the same confirmed email address, and to review purchases that are not claimed. - To respond to contact requests, support tickets, and hosted form submissions. - To send service emails such as account access links, export status updates, invoices, subscription notices, and operational alerts. - To send newsletters or marketing emails when you subscribe, and to honor your opt-out choices. - To measure site usage, understand product performance, and maintain site security. - To comply with legal obligations, resolve disputes, and protect NoCodeExport, our users, and third parties. ## Legal bases we rely on - Contractual necessity, when we need your data to provide the services, exports, billing, or support you request. - Legitimate interests, such as improving the product, preventing fraud, securing the platform, and understanding how customers use the service. - Consent, when you choose optional analytics, support chat, or marketing communications where consent is required. - Legal compliance, when we must keep records, respond to lawful requests, or meet tax, accounting, or regulatory obligations. ## Cookies, analytics, and support tools We use cookies and similar technologies to keep you signed in, remember consent choices, measure traffic, and offer support. Google Analytics loads only after you accept analytics cookies. Support chat loads after you accept them or when you open the chat yourself. - Essential cookies for sign-in, checkout, and preview access. The cookie that lets you see a preview without signing in lasts up to 7 days and is removed when you sign out. - Google Analytics for traffic measurement and engagement reporting, only with your consent. - Chatwoot for customer support chat, inbox routing, and support history. - Cloudflare Turnstile on the form where you enter your email for a preview, to tell people from automated abuse. - YouTube, only when you press play on a video in one of our guides. Until then the page loads nothing from YouTube; the player is YouTube’s privacy-enhanced one (youtube-nocookie.com). - Speed measurement, only with your consent: Cloudflare Web Analytics, and our own report of how fast each page loaded and answered your clicks (the timings, the page address without its query, and the page element and script involved). Neither sets a cookie or sends an identifier. - Local storage or similar client-side storage for consent state, saved export settings, checkout assistance, and product UX continuity. ## Service providers and subprocessors We use third-party vendors to operate the service. Depending on the feature you use, these may process personal data on our behalf. - Cloudflare for application hosting (Workers), file storage for exports (R2), image resizing, database connections, bot protection (Turnstile), and, with your consent, speed measurement (Web Analytics). - Trigger.dev for background jobs that run exports and send scheduled emails. - Stack Auth (Hexclave) for authentication and account access. - Stripe for subscription and one-time payments, customer portal access, and invoice data. - Resend for transactional and newsletter email delivery. - Google Analytics for traffic measurement, with your consent. - Chatwoot for customer support chat. - ncehost (ncehost.com) for hosting previews and the sites you choose to host. It receives the site files, an account identifier, and your plan, not your email address. ## When we share data We do not sell your personal data for money. We share data only as needed to run the service, fulfill your requests, comply with law, or protect rights and safety. - With service providers that process data on our behalf. - With payment providers when you initiate checkout, subscribe, or use the billing portal. - With infrastructure or deployment providers, such as GitHub or Netlify, when you explicitly connect them. - Previews and hosted sites are public. Anyone with the link to a preview at an ncehost.page address can open it until it is removed, 72 hours after it is published. A hosted site is public at its address until you stop hosting it. An Agency client delivery page is public unless you set a password. - If required by law, regulation, subpoena, court order, or to protect users, NoCodeExport, or the public. - In connection with a merger, acquisition, financing, or asset sale, subject to appropriate confidentiality protections. ## Retention - Account, subscription, and billing records are retained for as long as needed to provide the service and meet legal, tax, or accounting obligations. - Export artifacts are deleted automatically after your plan's retention window: 7 days on Free, 30 days on Pro and, for a Site Pass export, 30 days (Site Pass), 60 days (Site Pass Plus) or 90 days (Site Pass Max). Agency exports are not deleted automatically. - A preview built before you pay is kept for 7 days. If you buy a plan or Site Pass for it, that plan's window applies from the purchase. A preview bought without signing in is kept for at least 7 days after the purchase so it can be claimed. - Temporary preview sites on ncehost are removed 72 hours after they are published. - Guest purchase records are kept as billing records, like any other purchase. - Contact messages and support records are retained for as long as needed to respond, operate the business, and keep a reasonable business record. - Newsletter data is retained until you unsubscribe or we determine the address is inactive or no longer needed. - We may keep limited logs or evidence for security, fraud prevention, legal defense, or compliance reasons. ## Your privacy choices and rights Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, and to object to or restrict some processing. You can also withdraw consent for optional analytics or chat, unsubscribe from marketing emails, and request deletion of account-related data where applicable. - To make a privacy request, email [hello@nocodeexport.com](mailto:hello@nocodeexport.com) from the address associated with your account or request. - We may need to verify your identity before completing certain requests. - Some information may be retained where required for billing, fraud prevention, security, or legal compliance. ## Security We use reasonable administrative, technical, and organizational measures to protect personal data against unauthorized access, loss, alteration, or misuse. No online system is completely secure, and we cannot guarantee absolute security. ## Children NoCodeExport is not directed to children under 13, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will investigate and remove it where appropriate. ## Changes to this policy We may update this policy from time to time. If we make material changes, we may update the effective date, post the revised policy on the site, or provide additional notice where appropriate. ## Related - [View Terms of Service](https://www.nocodeexport.com/en/terms)