Privacy

Scan results of public sites. When a URL is scanned we fetch pages the site serves to anyone — the homepage, robots.txt, llms.txt, OpenAPI documents, and similar well-known files — and store the derived check results, scores, and a short machine-written summary. We store what your site publishes, not private content.

Hashed requester IPs. To enforce rate limits we store a salted hash of the IP address that requested a scan. The raw IP is never written to the database, and the hash cannot be reversed to an address without the server-side salt.

Account data. If you sign in, we store your email address, your organization's name and plan, and — if you subscribe — a Stripe customer reference. Payment card details live with Stripe, never with us.

No tracking. We run no advertising, no third-party analytics, and set no tracking cookies. Cookies are used only to keep you signed in.

Delisting. Verified owners can delist a domain from the leaderboard, directory, and badges at any time via Dashboard → Privacy & danger zone. Reports stay reachable by direct URL; relisting is one click.

Robots-based exclusion. Our scanner honors your robots.txt at scan time. Disallow our fetches and we won't read the disallowed paths.

Erasure. Account holders can delete their entire account — login, organization, API keys, monitors, and claims — from the same danger zone page. For anything else, use the report-issue control on any scan report page.

Ephemeral scans (previews and disposable hosts) auto-delete after roughly 7 days. Scan event streams — the live progress log behind each report — are kept for 7 days, then removed. Stored scan results for real domains persist so score history and trends work; delisting removes them from every public listing.