Privacy · updated 4 September 2026

What we keep, and for how long.

Short, because there is not much. The scanner has no accounts, no analytics, and no third-party trackers — but a scan does send the address you enter to Google, and that is set out below.

What a scan stores

4 things

url

The URL you submitted

Held with the scan result so the report can show what was scanned.

results

The findings and the score

The output of the checks, including the raw result the report page renders.

A one-way hash of your IP address

Used for one purpose: counting scans in the last hour so the five-per-hour limit can be enforced. The address itself is never stored — it is hashed with a secret that is regenerated every time the service restarts, which makes the stored value useless for identifying anyone. It is not used for analytics, profiling, or anything else.

An email address, only if you give one

Submitted to unlock a crawl of more pages on a report. Nothing on the single-page report is withheld, and the scan works without ever giving an email. Unlike everything else here, an address you give is forwarded out of the scanner to Netlify Forms, where it is kept so we can contact you about the product. Netlify processes it on our behalf and does nothing else with it.

How long it is kept

not long

A report is deleted the moment it reaches your browser. Scans live in the memory of the running process, are never written to a database, and the findings and the screenshot of your site are erased in the same request that hands them to you. After that the only copy is the one in your browser tab.

What briefly outlives it on our side is the address you scanned and the list of links found on it, because a crawl needs them if you unlock one. That goes as soon as the crawl finishes, and a scan nobody comes back for is swept within fifteen minutes.

The hashed rate-limit record lasts one hour, because that is the window the limit is measured over. The one thing we deliberately keep is an email address you chose to give, which is forwarded to Netlify Forms and held until you ask us to delete it.

Who can see a report

you

Only the browser that ran the scan

A report is delivered once and then deleted, so the link is not a shareable document — opened anywhere else there is nothing left to serve. To show a report to someone, export it as a PDF from the report page.

tab

It lives in that tab, not on our servers

Your browser keeps the report in session storage, which it clears when the tab closes. We cannot read that copy and it is never sent back to us.

Who else sees the address you scan

2 companies

A scan does not stay entirely between your browser and us. To measure things that need a real rendering engine, we ask Google to load the address you entered, and we ask a public DNS resolver about its domain. We send the address and nothing else — no email, no IP, nothing that identifies you.

google

Google PageSpeed Insights and the Chrome UX Report

The address you enter is sent to Google, who load the page on their own infrastructure and return a Lighthouse report: Core Web Vitals, a screenshot, and how real Chrome users have experienced that address. This is what the “Verified by Google Lighthouse” and real-user panels in the report are built from. Google handle that request under their own privacy policy.

dns

Cloudflare or Google public DNS

To check SPF, DMARC and DKIM we look up the domain’s public TXT records over DNS-over-HTTPS, asking Cloudflare first and Google if Cloudflare does not answer. That is a lookup of public DNS records for the domain, and carries nothing about you.

scanned

The site you scanned

As before, the site itself sees ordinary web requests from our scanner, which identifies itself in its user agent.

What we do not do

none of it

never

No analytics or tracking scripts

There is no third-party script on this site. No page-view tracking, no session recording, no fingerprinting. The scanner does not inject anything into the pages it scans either — it used to load a measurement script from a public CDN into every page it visited, and no longer does.

counts

We do count how often the scanner ran

Not analytics in the sense above, but worth saying plainly: the API keeps running totals of how many scans started, finished or failed, so we can tell when something is broken. They are bare numbers. No address, no domain, no email and no IP goes into them, and there is nothing in them that could be traced back to a person or a scan.

never

No advertising cookies

The site sets no cookies for advertising or measurement.

never

No selling or renting of email addresses

An address given to unlock a report is used to unlock that report and to contact you about this product. It is never sold or rented. The only company that sees it is Netlify, which stores the form submission for us and acts on our instructions alone.

never

No accounts

There is nothing to sign up for, so there is no password, no profile, and no login history.

Scanning a site you do not own

The scanner requests pages the way any browser would, identifying itself in its user agent, and stays within a strict budget: the entered page free under a sixty-second budget, up to ten more if a crawl is unlocked under ninety, following only same-origin links. On the free scan it reads the page and a capped sample of the stylesheets, scripts and images it declares. It does not attempt to log in, submit forms, or reach anything a normal visitor could not.

If you operate a site and want it excluded, or you want a report deleted, or you want an email address you gave us erased, write to [email protected] with the URL or the report link.