Privacy & Data

Scan activity. When a scan runs we log one row: the time, the website address you scanned, the chosen site type, the resulting score, level and security grade, whether it came from cache, and which surface requested it (the web form, the API, the MCP endpoint, or a badge). This is what powers our own usage statistics and the daily scan limit.

Your IP address. We use it briefly and in memory to rate limit abuse. Those counters live in a short-lived store and expire within minutes. In the scan log above we never store the raw address: we store only a shortened, keyed hash of it (an HMAC with a secret), which is used for rough visitor counting and cannot be reversed back to your IP. If that secret is not configured, no IP fingerprint is stored at all.

Your email, only if you ask us to help. If you submit the follow-up form on a report, we store the email you enter along with the context of that report (the scanned URL, score, level, site type and security grade) so we can reply. You choose to send this; it is never collected automatically.

Aggregate usage analytics. We use Cloudflare Web Analytics, a privacy-first, cookieless measure of page views and load performance (Core Web Vitals). It records no cookies, builds no visitor profile, and does not track you across other sites. The data is aggregate, not tied to you.

Theme preference. Your light or dark choice is saved in your own browser (localStorage). It stays on your device and is never sent to us.

Bot check. If the human-verification widget is enabled, Cloudflare Turnstile issues a one-time token to confirm you are not a script. It is handled by Cloudflare and is not stored by us.

• No advertising trackers, no analytics cookies, no cross-site tracking or profiling.
• We do not sell, rent, or share your data with advertisers.
• We do not store the raw content of the sites you scan beyond a short cache (see below).
• We do not store your raw IP address in the scan log.

• Rate-limit counters: they expire within minutes.
• Scan cache: a scan result is cached for about 12 hours, then discarded and re-run on the next request.
• Scan log: kept for product analytics. It holds the scanned site and result plus the salted IP hash described above, not your address.
• Lead emails: kept until you ask us to delete them.

The site runs on Cloudflare, which serves the pages and, as with any website, processes requests at its edge. Scan results and counters are held in Cloudflare storage (KV and D1). If you submit the follow-up form, that email is stored in Airtable. These providers process the data on our behalf to run the service.

To clear your theme preference, clear this site’s storage in your browser. To ask what we hold about a lead you submitted, or to have it deleted, email [email protected]. We will action deletion requests promptly.