For site owners
This crawler visited your site. Here is exactly what it did.
It walks a subscription signup flow the way a customer would and photographs each screen, to report where automatic-renewal disclosures appear. It stops at the card field. If you would rather it did not come back, the first section tells you how.
How to stop it.
-
robots.txt
It fetches and obeys
robots.txtbefore visiting a page, with no override anywhere in the code. Disallow it by name:User-agent: arlcompliancescanner Disallow: / -
Block the user agent
Every request it makes carries this string, and it does not vary it or fall back to another one when refused:
ARLComplianceScanner/1.0 (+https://arl.samdesignsoftware.com/crawler; observation-only; obeys robots.txt; stops at the card field) Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 -
Ask to be on the opt-out list
Write to samdesignsoftware@gmail.com naming the domain. It is added to a refusal list this server checks before every scan, and after that no visitor can scan it here at all — including one who owns it. No form, no account, no reason needed.
What it never does.
-
It never buys anything
The walk stops the moment a card-number field appears. It does not fill one in, it does not submit a payment, and it never clicks a control whose text reads as completing a purchase.
-
It never signs in
It holds no credentials for anybody's site and does not create accounts. Anything behind a login is simply out of its reach, and the report says so.
-
It never pays and never signs up
It clicks the primary call-to-action on a plan, which on many sites is a submit button — so a form may be submitted the way a browsing customer submits one. What it will not do is fill in a card, enter an email into a signup, or click a control whose text reads as completing a purchase. It creates no account and buys nothing.
-
It never runs two at once
One scan runs at a time on this server, globally — a cross-process lock, not a convention. Where free public scanning is switched on, the same target also has a cooldown before anyone can scan it again, and there is a ceiling on the total per day.
What it collects.
Screenshots of the pages it walked, the text on them, and the values it measured. That material goes into a report at a random URL which is never indexed and never listed publicly — but the URL is the only thing protecting it, so treat it as a secret rather than as access control.
It is not sold and not used to train anything. One thing may leave this server, and only if the operator has configured it: a second analysis pass can send the screenshots to a model provider to be described. Exactly what that is, and how to tell whether it is on.
Whoever asked for the scan gave an email address and confirmed they own the site or are authorized to assess it. That record is kept, which means a question about a particular scan has an answer. What is stored, and for how long.
Why it exists.
Automatic-renewal disclosure rules are a per-state patchwork in the US, and what they require is mostly about what a customer can see at the moment they agree to be charged. That is observable from outside, and this tool observes it — reporting what was on the page, never whether anything complies. The legal background · what it cannot see.