Privacy Policy

• Account data: If you register, we collect your email address and a hashed password.
• Scan data: The URLs you submit, the scan results (scores and check details), and the timestamp of each scan.
• Usage logs: Server logs including IP address, user agent, and request paths. Logs are retained for 30 days.

We do not collect payment information (handled by Stripe when billing is enabled). We do not collect data from the sites you scan beyond what is needed to produce scan results. We do not track you across other websites.

• To operate the scan service and return your results.
• To improve detection accuracy and fix false positives.
• To send product update emails — only if you opt in explicitly.
• To detect and prevent abuse (rate limiting, spam scanning).

• Railway — hosts our API, scanner workers, and PostgreSQL database (US region).
• Vercel — serves our frontend and CDN.
• Stripe — processes payments when billing is enabled. We never see your card details.
• Resend — sends transactional emails when configured. Email sending is currently disabled.

Anonymous scan results are deleted after 30 days. Logged-in users retain their scan history until they delete their account. Account data is deleted within 30 days of account deletion.

You can request deletion of your account and all associated data at any time via the contact form. We will process deletion requests within 30 days.

We will update the effective date at the top of this page if we make material changes. For significant changes, we will send a notice to registered users by email.

Questions about this policy? Use our contact form.