What this site and product do and do not collect

This public site

The public pages are static HTML with no analytics, no advertising or profiling cookies, and no third-party tracking scripts or fonts. Browsing publicly without an account works with cookies fully blocked.

Accounts and sign-in cookies

Creating an account is optional and only needed for saving scan runs and using the daily free trial attempts. Signing in requires one essential cookie: a secure, HttpOnly, SameSite session cookie that lasts seven days and is used only to keep you signed in. It is not used for advertising or profiling, and it is not shared with third parties.

Account sign-in supports email with password and, optionally, Google. For Google sign-in we store your Google email address and a stable Google account identifier so we can recognize you on your next sign-in. Google access and refresh tokens are not retained. Account passwords are stored only as salted hashes — never in plain text. When you request a new confirmation or password-reset link, we email one to the address on the account.

On the sign-in, registration and free-trial pages a Cloudflare Turnstile check may run; its script loads from Cloudflare and the resulting token is verified server-side to limit abuse. No advertising or profiling cookies are set by this.

Scans

Scans run against the fixed local fixture only — external public websites are never fetched in v0.1. A scan produces a report with load metrics, requests, console diagnostics and technology observations for the fixture. The public recorded demo dataset is sanitized: private ids, authentication rows, AI interpretations and evidence files were removed before it was published.

Evidence and authentication traces

Screenshots, console dumps and trace files collected during a scan are evidence artifacts. They are stored with the report and are not included in public exports. Authentication traces — login attempts, credentials and session material — are omitted from reports and exports entirely; credentials are stored encrypted in a short-lived server-side vault that expires, and are removed when the run finishes, is cancelled or the vault expires.

Optional AI interpretation

Where an AI diagnosis is requested, its output is attached to a report as a clearly labelled interpretation layer. Rule-based severities and confidence values are not upgraded by it. AI interpretation is optional and absent from the public recorded dataset.

Reports, trials and retention

If you create an account, your accepted scans are kept so you can open the same reports from another device, and each unique fixture gets a stable association with your account. Accepted free-trial attempts count against a daily limit stored with the account. Completed, failed and cancelled scan reports and their evidence artifacts are cleaned up after seven days; scans that are still active are never affected. Your account record itself — email, confirmed status, password hash, linked Google identifier and trial counter — persists while the account exists, along with the encryption keys the service needs to keep running.

What we do not claim

This prototype makes no compliance-certification claims and describes no account-deletion flow, because self-service account deletion is not part of this build. The private workbench uses the same-origin session cookie described above; this page describes what the build actually does, not a general consumer-service privacy policy.

Questions about this prototype's scope are best answered by reading the documentation, which lists exactly what is and is not collected.