Privacy Policy

Ditchplugins, Inc. ("Ditchplugins", "we", "us") is a Delaware corporation that makes Ditchplugins Migrate, a product that copies websites onto Astro. This policy explains what personal data we collect when you visit ditchplugins.com, use the product, or write to us, and what we do with it.

We are the data controller for that information. The easiest way to reach us about privacy is hello@ditchplugins.com — a real person answers.

Account details you give us — your name, work email, job title, the website URL you ask us to analyse, and anything you include when you write to us. If you sign in with GitHub or Google, we receive your name, email address and avatar from them; we never see your password.

Your website's public pages — to analyse and migrate a site, we fetch what it already shows the public web: pages, images, fonts, metadata. We never ask for your CMS credentials and never log in to your site. Those pages may contain personal data (author names, photos); we use them only for your migration.

Payment details — handled by our payment processor. We see the last four digits of your card, your billing details and your invoice history, never the full card number.

Usage analytics — we use PostHog to understand, in aggregate, how this site and the product are used. Until you accept cookies in the banner, analytics runs in a cookieless mode: no cookies are set and nothing identifies you personally. If you accept, PostHog sets a cookie so we can recognise your device across visits, and once you create an account we link that activity to your email so we can help you if something goes wrong. If you opt out, analytics stays cookieless and anonymous. Either way, we don't use advertising trackers and we never sell your data. To change your choice, clear this site's cookies and storage in your browser and the banner will appear again.

To analyse and migrate your website, to run your account and bill you, to email you when a migration is done, and to improve this site and the product. That's the whole list. We don't send marketing emails you didn't ask for.

If you are in the EU/EEA or UK, we rely on: your consent (when you submit a form or send us an enquiry — you can withdraw it at any time); performing our contract with you (to run your account and deliver your migrations); and our legitimate interest in keeping this site and the product secure and understanding, in aggregate, how they are used.

We rely on a small set of processors: GitHub (sign-in, and the private repository we create in your own account through GitHub OAuth, with your permission), Google (optional sign-in), Cloudflare (hosting this site and the product, and the one-click deploy of your migrated site if you choose it), our payment processor (cards and invoices), PostHog (privacy-first product analytics), and email. Each receives only the data needed to do its job, under its own privacy terms.

Some of these providers are based outside the EU/EEA (for example, in the United States). Where your data is transferred abroad, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses or an equivalent adequacy mechanism.

While a migration runs, the copy of your site lives on our servers, where it is built and checked. When the proof passes, you connect GitHub and we create a private repository under your own account and push the code there — it is yours from the first commit, and we keep no copy of the repository. We do keep the proof reports and the record of what was migrated, so that a re-run can charge you only for the pages that changed.

We keep the data you share to the minimum we need, limit access to the two of us, and rely on reputable providers with encryption in transit. No method of storage or transmission is ever 100% secure, but if a breach ever affects your data, we will tell you and the relevant authority as the law requires.

The captured pages and the build of your site: for as long as your account is open, so you can re-run it; close your account and they go with it. Proof reports and invoices: as long as the law requires us to keep billing records. Email correspondence: as long as needed for support and legal obligations. Analytics: aggregate only, indefinitely.

You can ask us at any time what data we hold about you, ask us to correct it or delete it, ask for a copy to take elsewhere, or object to or restrict how we use it. Where we rely on your consent, you can withdraw it at any time. Email us and we'll do it — no forms, no runaround.

Depending on where you live (e.g. the EU/EEA and UK under GDPR, or California under CCPA), these rights are also guaranteed by law. If you are in the EU/EEA or UK and think we have mishandled your data, you also have the right to complain to your local data protection authority — though we hope you'll email us first so we can put it right.

If we change this policy, we'll update the date at the top. For significant changes affecting an account, we'll email you directly.