Privacy

At a glance

Crawlback helps you find archived web pages. There are no accounts, advertising, analytics scripts, or session recordings. If you allow browser storage, search history, settings, and saved captures stay in your browser; they are not synchronised to an account.

Local storage does not make a search anonymous: archive queries go to Common Crawl, and visiting this website requires technical access data to be processed by our hosting provider.

Last updated: 14 October 2026

Controller and contact

The controller for Crawlback is Alexander Nabert. The postal address is listed in the legal notice.

For privacy questions and requests, email nabert@pm.me.

Website delivery and hosting

This website is hosted by Vercel, Inc., United States. Requests can include your IP address, access time, requested URL, response status, and browser or referrer information. This data is used to deliver the site, diagnose faults, and protect it from abuse. Our legal basis is Article 6(1)(f) GDPR: our legitimate interest in operating a secure, reliable service.

Requested URLs can include search or capture parameters. Avoid putting confidential information into links you share. The app also temporarily groups API requests by IP address to enforce one-minute request limits; these counters are kept in server memory.

Hosting data may be processed outside the EEA, including in the United States. Vercel describes its processing roles and international transfer safeguards in its privacy notice and data processing terms. Log retention varies by service, plan, and configuration; see Vercel’s runtime log documentation. The app does not maintain a separate hosted database of your search history.

What happens during a search

• Archive queries. Your browser contacts Common Crawl’s index and archive-data servers directly. They receive your IP address, technical request information, and the searched URL, host, or domain or requested archive record. Their processing is covered by Common Crawl’s privacy policy.
• Robots.txt checks. If enabled, your target URL is sent to Crawlback’s server to check the target website’s robots.txt. That website receives a request from our server, rather than your browser’s IP address. You can disable these checks in App settings, before starting a scan.
• Opt-out registry. Our server retrieves the public Common Crawl opt-out list from a Google-hosted spreadsheet. Matching your target against that list happens in your browser; the registry request does not send your search target to Google.
• Archived pages. Captures are shown in a sandboxed preview that blocks archived scripts. Downloaded raw HTML can make external requests if you open it separately; read the warning shown before HTML exports.

These requests provide the archive search you ask for. Where personal data is processed, our basis is Article 6(1)(f) GDPR, our legitimate interest in providing this public research tool. External services apply their own retention rules.

Cookies and local browser storage

Crawlback’s own code does not set cookies. It uses browser storage to operate the features you use:

History, settings, and saved captures

IndexedDB holds your scan history, results, coverage, settings, and optionally cached HTML. A local identifier separates data inside this browser; it is not a login or a tracking identifier sent to us.

Search and request caches

Local storage holds source lists, robots checks, archive-query results, and scan coordination state. The background-scan service worker also caches Common Crawl index responses in the browser.

Storage choice

After you select “Allow browser storage,” a small versioned entry in local storage records that choice so the app can remember it. This record contains the consent version and grant status, not your search history. “No thanks” is remembered only in memory for the current page session.

Before you allow storage, Crawlback reads only the small consent record to check your choice. It does not read app history or settings. App storage features stay disabled until you explicitly choose “Allow browser storage.” This consent covers browser storage for the app features described above. For storing or accessing information on your device, the legal basis is your consent under Section 25(1) TDDDG. To the extent the associated processing involves personal data, the basis is Article 6(1)(a) GDPR. The app does not rely on the exception in Section 25(2)(2) TDDDG for these features.

History and preferences have no automatic time-based deletion. Source-list and opt-out data is normally refreshed after 24 hours, robots results after 48 hours, and archive-query results after seven days. These are freshness periods, not guaranteed deletion periods: stale entries and service-worker caches can remain until replaced or cleared. Cached HTML can be evicted when automatic pruning is enabled and the configured size limit is reached.

Your controls

Use App settings to control saved HTML and clear its cache. “Clear all” in the danger zone resets the app’s IndexedDB history, settings, and captures. It does not remove every local-storage entry or the service-worker cache.

Choose “Website settings” in the footer and turn browser storage off to withdraw consent. This removes the consent record, stops app features from accessing browser storage, unregisters the app’s service workers, and deletes Crawlback Cache Storage caches. It does not delete your saved IndexedDB history, captures, settings, or other app local-storage data from the device. You can use the browser’s site-data controls to remove remaining data, including local storage and IndexedDB. Exported files on your computer are separate and must be deleted there. You can allow storage again at any time.

When you contact us

If you email us, your address and message are processed to handle your request. The legal basis is Article 6(1)(f) GDPR for correspondence, or Article 6(1)(b) for steps relating to a contract. Correspondence is retained only as needed to resolve the matter or meet applicable legal obligations.

Your rights

Subject to the GDPR’s conditions, you may request access, correction, deletion, restriction of processing, and data portability. You may object to processing based on legitimate interests. If processing is based on consent, you may withdraw it with effect for the future. Contact us using the email above.

You can complain to a data protection authority, including the Berlin Commissioner for Data Protection and Freedom of Information. We cannot remotely access or erase data stored only in your browser; the controls described above let you manage it directly.

There is no profiling or automated decision-making with legal or similarly significant effects. Providing technical request data is necessary to deliver the website; you do not need to provide account details.