Privacy Policy

Last updated 27 August 2026

The short version

There are no accounts here. We do not ask for your name, we do not ask for your email address, and we do not build a profile of you. We hold the website address you asked us to check, the result of that check, and your IP address for a short period so that nobody can overload the service.

What we collect

• The website address you submit. Stored as part of your report.
• The result of the check. The findings, the evidence we observed, and the instructions for fixing each one. Kept for 90 days if you paid for it, two days if you did not, then deleted.
• Your IP address. Used only to count requests so one person cannot run thousands of checks. Held as a short-lived counter, not attached to your report, and automatically discarded within an hour.

What we do not collect

• No account, username or password. There is nothing to sign up for.
• No email address. We never ask for one and there is no mailing list.
• No payment details. Whop handles payment and we never see your card.
• No advertising or cross-site tracking cookies.

If you pay

Payment is processed by Whop. They collect whatever they need to take the payment, including an email address for your receipt, and their own privacy policy governs that. What reaches us is a confirmation that a specific report has been paid for, nothing more.

Who else is involved

Running this service means a small number of other companies handle data on our behalf:

• Render, hosting. Sees requests to this site, including IP addresses, as any web host does.
• Upstash, stores your report for as long as it is kept.
• Whop, processes payments.
• Cloudflare DNS and Google DNS (cloudflare-dns.com, dns.google), for the public DNS records of the domain being checked: its mail servers, and the records that say who may send email as it.
• crt.sh and certspotter, the public Certificate Transparency logs. Every certificate ever issued for a domain is published there by design, and we read that public record to find subdomains you may have forgotten. We only ever read; we publish nothing.

The lookup services above receive only the domain name being checked. They never receive your report, your findings, or your IP address.

Our payment provider is the exception, and only when you buy a report. To send you back to the right report after paying, and to open it once the payment clears, they are given the link to that report and the domain it covers. That means the payment provider can reach the report you bought. They do not receive your findings in any other form, and no other company is given the link.

We do not sell data to anyone, and we do not share it beyond what is listed here. There is no analytics, no advertising, and no tracking of any kind on this site.

Your results are never published. Several well-known free scanners list recent scans publicly, complete with the site name and its grade. We do not, and there is no page on this site where one report can be found from another.

Your report is private by way of its link

Since there are no accounts, your report is protected by having an address nobody can guess. Anyone you give that link to can read the report, so treat it as you would any private document. Report pages are marked so search engines do not index them.

How long we keep things

• A report you paid for: 90 days, then permanently deleted. You bought it, so you should not lose it because you closed a tab.
• A scan nobody paid for: two days, then permanently deleted. It only has to last long enough to read and decide on.
• Rate-limit counters: up to one hour for anything counted against an IP address, and up to 24 hours for two counters that hold no IP address at all, one that spaces out re-checks of a report and one that stops a payment notification being processed twice.
• Server logs: retained by our host for their standard period.

Your rights

You can ask us to delete your report at any time before it expires. Send us the report link and we will remove it. Depending on where you live you may also have rights to access or correct data we hold. Because we hold so little, and none of it identifies you by name, these requests are usually resolved by deleting the report.

Children

This service is intended for people running a business or a website, and not for children.

Changes

If this policy changes, the date at the top changes with it.

Contact

Privacy questions: support@scan44.com.