Know what happens to your audit.

Public website information

When you submit a URL, the scanner requests public website pages and records audit evidence, URLs, scores and scan timestamps. Do not submit URLs containing private access tokens, personal information or confidential query parameters. You do not need to provide website administrator credentials.

Guest audit access

A secure, HttpOnly browser cookie keeps your guest audit linked to your browser for up to 30 days. Clearing the cookie or changing browsers may remove your access to an unclaimed guest audit. Staying in the same browser allows your existing scan to be retained when you sign in.

Accounts and purchases

Sign-in uses a single-use email link delivered through Resend. Login links expire after 15 minutes and must be confirmed in the browser that requested them. Hashed session tokens protect account-owned reports; the session cookie lasts up to 14 days. We store the account email and account identifier, but no password. When checkout becomes available, it will send your account email and report reference to Stripe to create a checkout session. Card entry takes place with Stripe; this application does not collect card numbers.

Saved records and access

Audit records and purchase references are stored in the application database. Guest previews contain only the overall score and basic report details. Category scores, evidence and downloads require the signed-in purchaser and a verified payment. A report ID by itself does not grant access to its full contents.

Deletion and scan limits

You can delete a report you can access from the dashboard. Deleting a report removes its audit record; purchase references and rate-limit records are separate and may remain. Reports with a checkout in progress cannot be deleted until the payment is resolved. Hourly scan limits use the account or guest identifier and, where available, a hashed IP address with the hourly time bucket.

Current early-access scope

AI report processing, subscription monitoring and email summaries are not active. The application relies on Cloudflare infrastructure, Resend for sign-in emails, Stripe for payments and public DNS resolution. Essential cookies provide guest access and secure sign-in; these are not advertising cookies. A final privacy policy and contact arrangements will be completed before a public commercial launch.