What our script can do to your page, and what it can't.

The script

One line: <script src="https://150strangers.com/cro/s.js" data-site="…" async></script>. It is about 14 KB (under 6 KB compressed), served from our own domain through Cloudflare, and browsers keep it for 5 minutes. It reads one configuration file for your site, https://150strangers.com/cro/c/<site>.json, which is cached for a minute.

It fails open. If the configuration doesn't arrive within 300 ms the page shows as it is, and if our service is down your page is simply your page. The script hides the page for at most those 300 ms so visitors don't see the original flash into the changed version.

What it can change

A fixed list of operations on elements you can see in your HTML: set text, replace words, set or add markup, set an attribute, set a style, add or remove a class, hide, move, or add CSS. Nothing else.

Markup is limited to an allowlist: the tags a b br div em i img li ol p small span strong ul, the attributes alt aria-label class href rel src style target title, links and images only to https:, mailto:, tel: or a relative address, and no CSS that loads anything (url(), @import and the like). Our server refuses a configuration that breaks these rules, and the script checks them again in the browser before anything reaches your page. A configuration therefore cannot run JavaScript on your site.

The script itself is our code. Whoever controls it controls what it does, which is why the next sections say who can change a site and how we protect our own accounts.

Who can change your site

• Only your account approves changes before they reach visitors. We propose; you decide, by email or on the dashboard. On Grow you can choose to let new rounds or test rollouts go ahead automatically, and switch back at any time.
• Every change is versioned, and each one can be switched off on its own.
• One switch turns everything off: every visitor gets the original page within about two minutes. Removing the script line does the same, permanently.

What it stores and sends

Applying approved changes sets no cookie and sends no events. The script keeps a copy of your configuration in the browser's local storage so changes apply before the network answers on the next visit.

During an A/B test, and by default only after your consent banner signals consent, it sets one first-party cookie (_150s_vid, a random id, 12 months) and sends two events to PostHog in the EU (or to your own PostHog project, if you connect one): that the visitor saw the page under test, and whether they completed the page's main action. Each carries the random id, your site's id, the test's id, which version was shown, and the page address without its query string or fragment. IP addresses are discarded. No profile is built and the id is not linked across sites. Details: Privacy.

Content Security Policy

If your site sends a CSP, add:

• script-src https://150strangers.com
• connect-src https://150strangers.com https://eu.i.posthog.com
• style-src 'unsafe-inline' if you want style changes to apply. Without it the script still runs and changes text and markup, but your browser blocks the styles it adds.

The script's address doesn't change between versions, so it can't carry a Subresource Integrity hash today. A pinned, versioned address is planned; tell us if you need it.

Where the data lives

• Cloudflare serves the script and configuration (and sees visitors' IP addresses in those requests).
• PostHog, EU region, stores the test events, with IP addresses discarded.
• Supabase, EU (Ireland), stores your account, your configuration and our work on your pages.

The full list of subprocessors, and what happens to the data when the service ends, is in the data processing agreement.

AI

To propose and build changes, AI models read your public page: its text, screenshots, and a recording of how it loads, plus anything you tell us about your business and what a web search finds about it (Serper). They never see your visitors' data. The models run through OpenRouter (OpenAI and DeepSeek models) and Anthropic.

Our own security

Secrets are kept in a secrets manager and in our hosting providers' secret stores, never in code. We have no SOC 2 report yet.

Reporting a vulnerability

Email [email protected]. We acknowledge reports within two working days. See also security.txt.