Privacy
What we hold, and for how long
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Hashed IP address of an anonymous scan | Rate limiting and abuse handling on a free, unauthenticated endpoint | Legitimate interest in keeping the service available | Cleared 30 days after the scan |
| Email address supplied to unlock a scan breakdown | Delivering the requested breakdown and, separately, alerts the person subscribed to | Performance of a contract, and consent for anything beyond it | Until the person asks us to delete it |
| Directory and listing measurements | The published index | Legitimate interest; the data is factual metadata about public pages | Kept indefinitely, this history is the product |
| Workflow run logs | Operating and debugging the crawler | Legitimate interest | Pruned after 90 days |
The short version
A scan you run without giving us an email is recorded so we can rate limit the endpoint. The IP is hashed when it is written, never stored raw, and the hash is deleted after 30 days. The row stays, because the count of scans is how we know whether the thing works.
If you give us an email, we use it for what you asked for. Anything beyond that needs your consent separately, and you can have it deleted by asking.
Everything else we store is measurements of public pages: which directory links to which product, what the link's rel attribute said, whether the page is in Google's index. That is factual metadata about pages anyone can visit, and it is kept indefinitely because the history is the product.
Our crawler
It identifies itself, respects robots.txt, and fetches politely. If a site blocks us we record the block and publish it rather than working around it. We store the links we parsed, not copies of anyone's pages. See the methodology for how each number is produced.
Asking us to delete something
Email the address on the account page and we will remove your personal data. Measurements of public directory pages are not personal data and stay.
This page describes what the system does. It has not yet been reviewed by a lawyer, and it says so rather than implying it has.