What this tool stores

What is stored

Each scan writes one directory to disk containing:

• The URL you entered, and every URL the walk reached.
• Screenshots of the scanned pages, as full-page PNG images, one per step. These are retained. If the pages you scan display personal information — a name carried through from an earlier step, an email address prefilled into a form, an order summary — that information is captured in the image and stored on disk exactly as it appeared.
• The captured page content: title, visible text, links, and the labels, checked state, computed type size, colour and position of every checkbox, radio and submit control.
• The text of up to three linked terms pages that the scan fetched.
• The computed signals and their provenance, and the findings, undetermined items and manual checks derived from them.
• Timestamps: when the scan ran.
• The states you selected when scoping the scan.

In paste mode, whatever you paste is what is stored: the markup, the terms text, and any screenshots you upload. Paste only what you are comfortable having written to disk.

Where it is stored, and for how long

Everything is written to the local filesystem of the machine running the scanner, in a scans/ directory beside the application. There is no database, no cloud storage and no backup. Nothing is transmitted to the people who wrote this tool.

There is no automatic retention limit and no expiry. Scans stay on disk until someone deletes the directory. Deleting a scan's directory removes the report, its screenshots and its stored data permanently; the report URL then returns a not-found page. If you run this tool on a shared or multi-user machine, treat the scans/ directory as readable by anyone with access to that machine, and remember that anyone who can reach the server can open any report URL — reports are not access-controlled.

What the scan form itself collects

Where free self-serve scanning is switched on, starting a scan needs an email address and a ticked box confirming you own the site or are authorized to assess it. Both are recorded, alongside the connecting IP address, the URL you gave, the time, and the id of the report the scan produced.

That record exists so a question has an answer. A scan makes real requests to somebody else's server. When the owner of a scanned site asks who sent an unfamiliar crawler at their checkout, the alternative to this record is a shrug, and sending traffic at people with no way to say who asked for it is not a defensible thing to do.

• Kept for one year by default, then deleted. The figure is configurable by whoever runs the instance; deletion happens on write rather than on a schedule, so it cannot quietly stop happening because a cron entry was never installed.
• Not shared, not sold, not published, and not added to any mailing list. It is the record of who asked for a scan, so that a question about a particular one can be answered. No mail is sent to it — not a report link, not a receipt, not anything. Your report's address is shown on screen when the scan finishes, and keeping it is up to you.
• No confirmation email is sent to verify the address. The address is checked for shape and for whether its domain accepts mail at all, which is a DNS lookup and sends nothing.
• The operator can read this list. Nobody else can: it sits behind credentials on a page that is never indexed, and it is not in any backup or third-party service, because there are none.

Ask to have your record deleted and it will be, without conditions. If you would rather leave nothing at all, paste mode needs no address and makes no requests to anybody.

If your site was scanned by somebody else

A site can be scanned by anyone who says they are authorized to assess it, and this server records who said so. What the crawler does, what it never does, and three ways to stop it — including an opt-out list that refuses every scan of a domain, including one requested by its owner.

What is sent elsewhere

One thing leaves the machine, and only if you configure it. If an API key for the model provider is set, the visual-prominence pass sends each screenshot together with that step's structured page capture to the provider for analysis, and receives a short structured description in return. Without a key, that pass does not run and no data leaves the machine at all.

Separately, a URL scan necessarily makes requests to the site being scanned — that is what scanning is. Those requests carry a user agent that identifies this scanner. Paste mode makes no requests to the target site whatsoever; the pasted markup is rendered with all network requests blocked.

What is never collected

• No cookies are set by this site, and no analytics or tracking of any kind is present.
• No accounts, passwords or credentials — the scanner cannot log in to anything.
• No payment details. The scanner has none to enter and stops at the card field.
• No personal information about you is requested at any point.

Scanning sites you do not own

Scanning a site you do not own or control may be inconsistent with that site's terms of use, and storing screenshots of a third party's pages carries its own considerations. Please scan sites you own or are authorized to assess. See terms.

Security

This is demonstration software with no authentication, running wherever you chose to run it. It offers no protection against someone with access to that machine or to its network reading stored scans. Do not expose it to an untrusted network, and do not scan pages carrying information you could not afford to have read by anyone who reaches the server.