Security and privacy

When you watch competitors and suppliers, what you watch is sensitive. Here's how ChangeGist protects your account, your data and the people you watch, in plain words.

Your data stays yours

• We never sell or share your data, and nobody else can see which pages you watch.
• Your pages and changes are never used to train AI.
• You can download everything as a spreadsheet, and deleting your account deletes your pages and history.
• ChangeGist is run from the UK, under UK data protection law. Our privacy policy explains exactly what we keep and for how long.

Your account

• Every connection to ChangeGist is encrypted (HTTPS only, with modern TLS).
• Passwords are stored as one-way hashes, never as text.
• You can turn on two-factor login with an authenticator app, so a stolen password isn't enough.
• Repeated wrong passwords lock the account for a while and warn you by email, and you can log out every other device by changing your password.
• Team members each have their own login. When someone leaves your team, their access, including any connected browser or phone, stops straight away.

Our servers

• The server that runs ChangeGist has no open ports to the internet. Visitors and our own admin access both come in through Cloudflare, which also shields the site from attacks.
• Security updates are installed automatically, and the database is backed up several times a day.
• The site uses a strict content security policy and other browser protections, so other sites can't frame it or inject scripts.

Keeping you safe from bad websites

• Before we visit any address, we check it against a list of known malware and phishing sites, and refuse the ones on it. That applies to every page you watch, every redirect, and our free tools.
• We never download files such as programs or archives, only web pages.
• Our checker can only reach public websites, never private or internal networks.
• Emails we send to an address that hasn't confirmed yet never repeat a page's title or link, so nobody can use ChangeGist to send scam messages to someone else.

Found a problem?

If you think you've found a security issue, please email [email protected] with the details. We take every report seriously and will reply quickly. Our security.txt file lists the same contact.

The full details are in our privacy policy and terms.