Privacy policy

What we collect, why, how long we keep it, and your choices.

Who we are

Accessible Index is run by Dynamosys Inc., a Virginia corporation, under the trade name Accessible Index (“we”). This policy covers accessibleindex.com and the emails we send.

The short version

We check public web pages, not people.
We set one cookie, and only when you unlock or claim a report.
We never sell personal information or share it for advertising.
We keep what we need for as long as we need it, and delete your information when you ask, except what a published result or the law needs us to keep.

What we collect

When you check a website: the address you entered and the results of the check, including cropped screenshots of that site’s public pages where a problem was found.
When you unlock or keep a report: your email address, when you confirmed it, and which reports you unlocked or claimed.
When you claim a government’s page: your work email address, and the status you set for residents, which is published as the government’s, never under your name.
When you write to us: what you send us, and your email address if you give it.
When you check a PDF: the file is read in memory and thrown away; we keep only a daily count of checks and pages. A PDF you give us by link is fetched once. Your own browser keeps a copy of the files you check, on your device, for up to a day, so you needn’t choose them again if you order a repair; it reaches us only if you do.
When you ask for a batch order: what you tell us on the form (your organization, name, work email and the documents’ size), and the PDFs you add on the batch’s private page, kept to count them for the quote.
When you order PDF repair: your files, kept while we work and deleted 30 days after delivery, and the billing details for your invoice: your name, organization, billing email and address, and any purchase order number. Stripe takes your card on its own page; we never see the card number. If you ask us to email you the links to your orders, we use the email you enter only to look them up and send the links there, and we note the time so we send them at most once every 15 minutes. We may also keep a short note of our own on your email address to help with your orders, such as how you pay; it is never published.
Government contacts: to tell a government its page is published, we collect work contact details the government itself publishes, such as the name, job title and work email address of its ADA coordinator. We never publish them.
Technical information: Cloudflare, which hosts the site, handles your IP address and browser details to deliver pages and protect the site from abuse. We use your IP address for a moment to limit how many checks one visitor can start, and never store it with a report.
Visitor counts: Cloudflare Web Analytics counts visits without cookies and without collecting personal information. We also count, each day, how many visits arrive through a link marked with where it was placed, and keep only those totals.

How we use it

To run checks and show reports.
To send the emails you asked for: a link to keep your report, and the recheck every three months, which carries an offer from Dynamosys to fix what it finds. One click stops them.
To answer your messages and disputes.
To tell a government about its page: a few emails at most, stopping when asked.
To keep the site secure and stop abuse.
To publish statistics, such as how many county websites have a critical barrier. They come only from the governments in the index; a business’s report is never published or named.

A report’s address is long and hard to guess, but it isn’t secret: anyone you share it with can see the report’s summary.

Cookies

We set one cookie, ai_session, and only when you unlock a report with your email or open a sign-in link we sent you. It keeps you signed in on that browser, for 30 days after unlocking a report or 90 days after claiming one, and holds nothing else. We set no advertising or tracking cookies.

Spam protection

Our forms, the scan box and the PDF check use Cloudflare Turnstile to keep out spam and automated abuse. It runs invisibly, with nothing to click or solve. To tell people from bots it looks at signals from your browser, such as your IP address and the kind of browser you use, and Cloudflare uses them only for that and to improve it. Cloudflare’s Turnstile Privacy Addendum sets out how.

We never sell personal information or share it for advertising. These companies handle it on our behalf, only to provide their service to us:

Cloudflare: hosting, our database and storage, the browser our scanner uses, visitor counts, and spam protection on our forms (Turnstile).
Resend: sending our emails.
If you order PDF repair: Stripe for payment, including a batch order’s invoices, which it emails to you, and Adobe and Anthropic for parts of the repair work, as our PDF service terms explain.

Researchers can get bulk access to the index’s results, which are about government websites and hold no personal information, under a signed agreement that forbids contacting anyone in it or reselling it.

If you ask Dynamosys for a quote from a report, its contact form receives the report’s reference code and the site’s address, and what you choose to send. We disclose information when the law requires it. If Dynamosys or Accessible Index is ever sold or merged, the information would pass to the new owner under this policy, and we would tell you first.

How long we keep it

A business report nobody keeps: deleted after 90 days, screenshots included.
A report someone keeps: its summary stays as long as the report is kept; the raw results and screenshots for 12 months.
A government’s page in the index: the raw results and screenshots behind a published score are kept for three years, so any finding can be shown as the scanner saw it.
A batch order’s PDFs: 30 days after you last add one, if no order follows; the request itself stays with our messages.
A PDF repair order: your files and the repaired copies, 30 days after delivery. The order’s record, with your billing details and invoice, seven years after the end of the year you paid, as tax records need; then we delete it. An order that was never paid is deleted 30 days after it was started.
Our note on your email address: as long as we keep anything else for that address, then deleted with it.
Your messages to us, from the contact or batch order form: one year after you last wrote to us or we last dealt with your message, then deleted. A dispute about a published result is kept as below.
Your email address: until you ask us to delete it. If you unsubscribe, we keep only a scrambled fingerprint of your address, so we never email it again by mistake.
Anything tied to an open dispute or a legal matter is kept until it closes, and a year beyond.
Our database keeps restore points for 30 days, so something deleted can remain in them until they expire.
Our email provider keeps a record of each email it sends for us, the address it went to included, for 30 days.
An email to you that can’t be sent at once is kept to try again, and deleted once it goes, or after 7 days at most.

Your choices

Stop our emails with the one-click link in each of them.
Ask us what we hold about you, ask us to correct it, or ask us to delete your email address and the reports you kept. Once we have confirmed the request comes from you, we act on it within 30 days, and usually much sooner.

Deleting your information doesn’t remove a government’s public page or the evidence behind its published score, which belong to the public record, or the record of a paid PDF repair order, which we keep for tax purposes as above, and we keep the scrambled fingerprint that stops us emailing an unsubscribed or deleted address again. Copies in our 30-day restore points expire on their own.

Some US state privacy laws give you these rights by law, and we give them to everyone. We don’t sell personal information or share it for targeted advertising, as those laws define the terms, and we don’t use it to make decisions about people.

Use our contact form. We answer every request within 30 days.

Children

Accessible Index is not meant for anyone under 16, and we don’t knowingly collect information from children. If you believe a child has given us information, tell us and we will delete it.

Do Not Track

We don’t track visitors across websites, so we treat every browser the same whether or not it sends a Do Not Track signal.

Security

The whole site uses an encrypted connection. Sign-in links expire, and only we can reach the data behind the site. Security has the details.

Where your information is handled

Accessible Index is run from the United States for a US audience. Our service providers may handle information in other countries, under their own safeguards.

Changes to this policy

We post any change here with a new date. If a change affects how we use your email address, we tell you by email first.

Contact

Use our contact form.

Last updated November 2, 2026.