Privacy statement
The short version: a scan is a measurement. The results exist so you can read them, and for nothing else.
Last updated
A scan is a measurement
When you scan a URL, we request that page the way a browser does, run our checks against it and store the outcome so you can open the report again later. That is the entire purpose of the data.
It is not used for marketing. We do not sell it, we do not share it with third parties, we do not build profiles from it and we do not use it to target anyone with anything. There is no advertising on this site and no plan to add any.
What is stored
Per scan, and per account if you create one:
- The scanned URL, the timestamp, the scores and the findings — everything you see in the report.
- If you have an account: your email address, a hashed password and, if you turn it on, your two-factor secret. Passwords are stored as a bcrypt hash and can never be read back.
- A salted hash of your IP address, so a daily scan limit can be enforced without an account.
- If you leave a review: your rating, your text and the display name you chose.
About IP addresses
Your IP address is never stored as-is. It is combined with a secret salt and hashed with SHA-256, and only that hash is written to the database. The hash cannot be turned back into an address. It exists to count how many scans came from the same visitor in a day, and to stop abuse.
Administrator access
An administrator can see which sites were scanned by which account. This exists for one reason: to stop the service being used to scan sites in bulk or to probe systems that do not belong to the person scanning them. It is not used to look at what you are working on, and it is not passed to anyone.
How long it is kept
Scan results are kept until they are deleted. There is currently no automatic clean-up: a report stays available until you remove it or ask us to.
You can delete any of your own reports yourself, with the delete button on the report page. That removes the scan and everything measured with it.
Third parties
Analytics run on our own Matomo installation and only after you agree to it in the cookie banner. Nothing is sent to Google Analytics, and there are no advertising or tracking scripts from anyone else. Fonts are served from our own server, so visiting the site does not tell any third party that you were here.
Your rights
You can ask what is stored about you, have it corrected, or have it deleted. An account can be deleted along with everything attached to it.