Short version: we collect the minimum needed to run your scan and get you the report, we never sell it, and you can ask to have it deleted whenever you want. The long version is below, but that's the whole policy in one sentence.
What we collect: the website URL you submit, the email address you provide, the scan results (findings, severity, suggested fixes), and, if you choose to leave one, your feedback on whether the report was helpful.
Why we collect it: the email is how your report is delivered and how the per-scan review link is scoped to you specifically, so no one else who uses this tool can see your findings. It's also the only way we have of finding out whether this free tool is actually helping real businesses. The IP address of each request is used briefly for rate limiting and basic anti-abuse checks — the same reason any free public tool has to, to keep it usable and not overwhelmed — not stored long-term or linked to your identity beyond that. We also run a few invisible, automated checks (like confirming a submission wasn't a script) before a scan is queued, purely to keep this free tool working for real people instead of bots; these checks don't collect anything beyond what's already listed here.
Where it lives: on Google Cloud infrastructure (Firestore and Cloud Storage), in a project separate from any other project the operator runs.
What we don't do: we don't sell your data, we don't use it for advertising, and we don't share it with anyone outside of what's strictly needed to run the scan itself (Google Cloud's AI models, used to analyze your site's public-facing pages).
Your control: to request deletion of your scan history or email address, contact the operator directly (see the FAQ for how) — no form to fill out, no waiting period, just ask. Feedback marked "okay to use as a public testimonial" may be shared publicly; anything not marked that way stays private, full stop.