Privacy

What we collect, why, and what we do not do with it.

Last updated: 24 September 2026.

What we collect

• The website address you submit, and the pages our crawler reads from it. This is the analysis.
• The optional context you give us — what you want from search, your target market, and whether the site was built with an AI coding tool. We use these to weigh priorities. If you leave them blank we do not invent them.
• Your email address, when you buy a report or sign in. It is how we deliver the report and how you retrieve it later.
• Payment records — what was bought, when, and the payment provider’s reference. We never see or store your card details. The license key issued with a purchase is stored only as a one-way hash, which is why we cannot show it to you again or read it back to you: we genuinely do not have it.
• Rate-limiting counters. IP addresses are hashed before storage, not kept in the clear.

What we do with your site’s content

Crawled pages are evidence for your report and nothing else. We do not sell it, share it, publish it, or use it to build a database about other people’s websites.

Before any crawled text becomes part of a finding, a log, or the report, it is scanned for credential-like values — API keys, tokens, connection strings, private keys — and those are redacted. If your site accidentally exposes a secret in its HTML, we do not want a copy of it and we tell you it is there.

Who else is involved

Three companies process data on our behalf, and only for the job named:

• Stripe takes payment. They receive your email address and the amount. We never see or store your card details — those go directly to Stripe and never touch our servers.
• Resend delivers your report link and sign-in links. They receive your email address and the contents of those messages.
• Our hosting provider runs the application and stores the database and the generated PDFs.

That is the complete list. We use no analytics, no advertising, and no cross-site tracking — there is no third-party script on any page of this site. We do not sell or rent your data to anyone, and nothing here is used to train a model.

Accounts and sign-in

There are no passwords. Signing in means clicking a single-use link we email you. Session tokens are stored only as hashes, so a copy of our database would not let anyone sign in as you.

How long we keep things

These are the periods the software actually enforces, not intentions:

• Sign-in links: 20 minutes, and each one works once. Spent and expired links are deleted automatically.
• Sign-in sessions: 30 days, after which you sign in again. Expired sessions are deleted automatically.
• Rate-limiting counters: cleared automatically once their window has passed. The IP addresses in them are hashed, never stored as written.
• Your report and purchase record: kept indefinitely, so you can retrieve what you bought and so we have an accounting record — which we are required to keep for a period after the sale. Ask us and we will delete the report; see below.

Your rights

Depending on where you live, you may have some or all of these rights. We will honour them regardless of where you live, because drawing that line is not worth the complexity:

• Access — a copy of everything we hold about you.
• Correction — fix anything that is wrong.
• Deletion — remove your account and reports.
• Portability — your data in a machine-readable form.
• Objection — tell us to stop a particular use.

Write to [email protected] and we will action it. Deleting a report is irreversible and we will say so before doing it — and note that we may have to keep a minimal record of the sale itself for accounting purposes even after the report is gone.

If you think we have handled your data badly, you can complain to us first, and you can complain to the data-protection authority where you live regardless of what we say.

Who you are dealing with

The person or business named below decides what is collected here and why — in data protection terms, the controller — and is who to contact about any of it.

Contact

Privacy questions: [email protected].