Privacy Policy
Last updated:
In short: the container file is never uploaded to any server — the audit runs in your browser. We record basic data about audits and visits for statistics, and about your account if you create one.
1. What we do not collect
- Your container export file: it is read in your browser only and never sent to or stored by us.
- The full content of tags, code and settings.
2. What we collect
- Per audit: container ID and name, the domain inferred from it, type (web or server), score and issue counts, the types of issues found (issue code, severity and number of affected items, without tag names or any container content), and time.
- Per visit: traffic source (UTM parameters, referring site, and the type of ad click identifier such as gclid — not its value), landing page, device type, country and language.
- Random identifiers stored in your browser (browser and session IDs) so we can tell visits and audits come from the same person.
- If you build a container: the platform, domain, hosting type and tools you chose, the public IDs you entered (such as GA4 or pixel IDs and the server URL, which already appear in any site's code), and how many times the files were downloaded. We do not store the container files themselves or any token or key.
- If you create an account: name, mobile number, email, a hashed password (we cannot see it), sign-up and last login times, and reports you choose to save. A saved report contains the audit results and names of affected tags; any token is stored masked.
- If you request help: what you enter in the form, plus the report summary if you choose to attach it.
- Technical data: your IP address is converted into an irreversible hash used only for abuse prevention and rate limiting. We do not store the IP itself.
3. How we use it
- To run the Tool, save your reports and email them to you.
- If you request help: the request details and audit summary are shared with Google Tag Manager specialists we work with, so they can contact you with an offer for the paid service. Your account data and saved reports are not shared with them.
- Internal statistics to improve the Tool and understand where visitors come from.
- To protect the service from abuse.
We do not sell your data or use it for third-party advertising.
4. Cookies and browser storage
- A login cookie if you have an account (30 days).
- Local storage for the browser and session IDs, language and theme, and your last help-form details.
- We do not use advertising cookies or third-party trackers.
5. Third parties we rely on
- Cloudflare: hosting, database, and cookieless aggregate visit statistics (Cloudflare Web Analytics).
- Resend: sending emails (reports and password resets).
- Google Fonts and jsDelivr: fonts and platform icons.
6. Retention and deletion
We keep data while your account exists or as long as needed for the purposes above. You can delete any saved report yourself under "My reports". To delete your account and all your data, email .
7. Security
We use reasonable security measures such as password hashing and encrypted connections (HTTPS). No system is 100% secure, and we cannot guarantee absolute security.
8. Changes
We may update this policy; the last updated date is shown above.
9. Contact
Privacy questions:
10. CheckGTM Helper Chrome extension
- What the extension reads: when you click the extension icon, it reads the tracking setup visible on the page you have open: GTM containers, the dataLayer, Google tags, ad pixels, and the URLs of requests the page has made. This happens inside your browser.
- No data collection or transmission: results are shown in the extension popup only. They are not stored or sent to us or anyone else. The extension contains no analytics or tracking.
- What is stored on your device: only your language and theme (light or dark) preference, in the extension's local storage.
- Events panel (Data Layer): if you open the side panel, it reads the dataLayer events of that tab and shows them inside the panel only; the log is cleared when you close it. So events fired right before a page change are not lost, the latest events are kept briefly in that tab's own sessionStorage and removed as soon as the next page opens. If you choose "Follow this site", Chrome asks you for permission for that one site only, and you can remove it anytime in the extension settings.
- Pixels tab: reads the tracking requests the page itself sends (such as Meta, TikTok, Snap, GA4 and Google Ads) to show their events and parameters. This happens inside the page; requests are not modified or sent anywhere. If you enable "full tracking" for a site, reading starts from the first moment on that site's pages only, and only while the panel is open.
- Consent tab: shows the Consent Mode commands in the dataLayer and the names of tracking cookies visible to the page (such as _ga and _fbp) with a short part of their value, so you can see how the tools work. This is read on your device only and is not stored.
- Journey report: when you click "Download report", the file is created on your device and saved to your downloads only. The report contains no customer data values (such as email or phone), and you decide whether to share it.
- "Ask an expert": copies the notes summary (without customer data) to your clipboard and opens the help form on checkgtm.online with only the site's domain in the link. Nothing is sent to us until you complete the form and submit it yourself; the help request section above then applies.
- CheckGTM tab in DevTools: if you open the developer tools (F12), this tab reads the network requests of the page you are inspecting, with their real response status, while DevTools is open. Only tracking requests are shown; this happens on your device and is not stored or sent.
- Tag Assistant coloring: if you turn it on yourself in the extension, Chrome asks for permission for tagassistant.google.com only. The extension colors the tag cards by platform and status and adds a filter on that page; it does not read or send any data from it. You can turn it off from the same button at any time.
- Shopify stores: if the store has Custom Pixels, the extension reads the dataLayer events and tracking requests inside their iframes on the same page, under the same conditions as above.
- Permissions:
activeTab and scripting let the extension read the page you are on, only when you click it. storage saves your language and theme. The extension cannot access any page on its own.
- Links to the website: when you click "Run a free full audit" or "Build a container", the website opens in a new tab with UTM parameters so we know the visit came from the extension. From there, the sections above apply.