Security and data, in plain words.

What the widget sends

The widget is a script on your site, so it runs in your visitors’ browsers. Besides loading its own files from cdn.accessora.io, it talks to Accessora in three ways:

• Loading its settings. It asks for your site’s widget configuration. The only thing the widget puts in that request is your site ID.
• Counting usage. When the widget loads, opens or closes, and when someone turns on a feature, profile or language or presses Reset, it sends the event name, the feature involved and a random session ID. The events do not include the page address, names, emails or anything else from the page.
• AI alt text, only if you switch it on. For images on the page that have no alt text, it sends the page address and the image addresses, and gets back a description for each. The page address is not stored.

Text to speech uses the speech engine in the visitor’s own browser, and the automated fixes work inside the page. Neither sends page text or form input to Accessora. If you choose a font for the panel, the visitor’s browser downloads it from Bunny Fonts (fonts.bunny.net).

What it stores in the browser

The widget sets no cookies. It keeps three small items in the browser’s localStorage, which stays on the visitor’s device and which they can clear like any other site data.

With AI alt text on, the widget also caches the image descriptions it receives in the browser’s IndexedDB for three days, so it does not ask for them again on every page.

How usage numbers are kept

Each usage event adds one to a running total for your site and that day. The totals are written to the database as daily rows: how many impressions, how many panel opens, which features and profiles were used. Single events are never stored. The random session ID is kept per day so the dashboard can show unique visitors.

Like any web request, the event arrives with an IP address. We use it to rate-limit abuse. It is not stored in your analytics, and neither is the page address, referrer, browser, device or location. Delete a site and its analytics are deleted with it.

AI alt text and audits

AI alt text sends image addresses to Microsoft Azure AI Vision, which returns a short description in English. We store the description so you can review and edit it in the dashboard, and the widget adds it to the image when the page loads. The widget does not write anything back to your site’s files or CMS. In the Shopify app, publishing alt text saves it to your product images in Shopify.

Audits open the pages you add in a headless browser and test them with axe-core, the open-source accessibility engine. They load your pages the way any visitor would, without logging in, so they only see what is public. We keep the results: the issues, the score, and for each issue the affected element’s selector and a short snippet of its HTML. We do not take screenshots or keep copies of your pages.

Your account and payments

• You sign in with email and password or with Google. Passwords are hashed with scrypt before they are stored, and we never store the password itself.
• Sign-in sessions use secure, HTTP-only cookies on dash.accessora.io and expire after about a week without use. Sign-in attempts are rate-limited.
• Your team sees only your organization’s sites, and you choose who to invite and which sites each person can open.
• Payments run through Stripe. Stripe collects and stores your card details. We keep your Stripe customer ID, your plan, your subscription status and a record of each payment. On Shopify, billing goes through Shopify.
• The widget, the dashboard and this site work only over HTTPS, and the dashboard redirects plain HTTP to HTTPS. Our privacy policy covers encryption at rest by our hosting providers.

Services we use

A few companies run parts of the service for us. Fly.io hosts the dashboard and its API in the United States, behind Cloudflare. A managed Postgres provider stores account and site data, and Upstash runs the Redis cache that buffers usage counts and rate limits. Tigris stores the widget files served from cdn.accessora.io. Trigger.dev runs background jobs such as audits. Microsoft Azure AI Vision writes image descriptions. Stripe handles payments, Resend sends account emails and Sentry records application errors. Our privacy policy describes the data each kind of provider receives. We do not sell data to anyone.

The marketing site, accessora.io, uses Google Analytics. In Europe it runs only after you accept analytics cookies, and anywhere you can turn it off under Cookie settings at the bottom of the page. The widget on your site does not load Google Analytics.

Deleting your data

Deleting a site from the dashboard removes its settings, analytics, audits and alt text. Deleting your organization removes all of its sites. To delete your account, or to get a copy of the data we hold about you, email [email protected]. Our privacy policy sets out your rights and how long each kind of data is kept.

Reporting a security issue

If you think you have found a vulnerability in the widget, the dashboard or this site, email [email protected] with the steps to reproduce it. Please give us a chance to fix it before you share it publicly.