Privacy Policy

Last updated 7 September 2026

The short version

There are no accounts here. We do not ask for your name, we do not ask for your email address, and we do not build a profile of you. We hold the website address you asked us to check, the result of that check, and your IP address for a short period so that nobody can overload the service.

What we collect

• The website address you submit. Stored as part of your report.
• The result of the check. The findings, the evidence we observed, and the instructions for fixing each one. Kept for 90 days if you paid for it, two days if you did not, then deleted.
• Nothing out of your database. One of the checks asks your database whether a single row would come back, using only the public key your own page hands to every visitor, because that is the one way to tell a database that is protected from one that is not. The row itself is never fetched, so nothing that is in it ever reaches us. What the report records is the name of the table and the fact that it answered.
• The first few lines of any file we found downloadable. If something like a .env file was reachable without a login, the report quotes the opening of it, because that quotation is the proof it was reachable and there is no honest way to tell you otherwise. It can therefore contain live passwords and keys. Treat the link to your report the way you would treat that file: it is kept for as long as the report is, and anyone holding the link can read it. Rotating what was exposed is the first step in the fix for that finding, and it is the right one.
• Your IP address. Used only to count requests so one person cannot run thousands of checks. Held as a short-lived counter, not attached to your report, and automatically discarded within an hour.

What we do not collect

• No account, username or password. There is nothing to sign up for.
• No email address. We never ask for one and there is no mailing list.
• No payment details. Whop handles payment and we never see your card.
• No advertising or cross-site tracking cookies.

What your own browser keeps

Because there are no accounts, the link is the only way back into a report. So your browser keeps a short list of the reports you have run on this device: the site name, the date, and the link. It appears under the box on the front page so you can find your way back if you close the tab.

This never leaves your device. It is not sent to us, it is not shared with anyone, and it is not used to recognise you. You can clear it whenever you like with the “Clear this list” button underneath it, and clearing your browser data removes it too. If you are on a shared computer, that button is worth knowing about.

If you pay

Payment is processed by Whop. They collect whatever they need to take the payment, including an email address for your receipt, and their own privacy policy governs that. What reaches us is a confirmation that a specific report has been paid for, nothing more.

Who else is involved

Running this service means a small number of other companies handle data on our behalf:

• Render, hosting. Sees requests to this site, including IP addresses, as any web host does.
• Upstash, stores your report for as long as it is kept.
• Whop, processes payments.
• Cloudflare, which sits in front of this site and passes requests through to it. Like any such service it sees every request and every visitor address, ours included.
• Cloudflare DNS and Google DNS (cloudflare-dns.com, dns.google), for the public DNS records of the domain being checked: its mail servers, and the records that say who may send email as it.
• crt.sh and certspotter, the public Certificate Transparency logs. Every certificate ever issued for a domain is published there by design, and we read that public record to find subdomains you may have forgotten. We only ever read; we publish nothing.
• rdap.org and the registry it forwards us to, the public register of domain names. We ask it one question about the domain being checked: when its registration runs out. A domain that quietly expires takes the site and the email with it, and it can then be registered by somebody else.

The lookup services above receive domain names and nothing else: the one being checked, its subdomains, and the misspellings of it we test for so the report can tell you which ones somebody has registered. They never receive your report, your findings, or your address.

Some of those lookups go through the normal internet naming system rather than through the two services named above, which is how any program on any computer resolves a name. That means whichever naming service your host uses sees them.

Our payment provider is the exception, and only when you buy a report. To send you back to the right report after paying, and to open it once the payment clears, they are given the link to that report and the domain it covers. That means the payment provider can reach the report you bought. They do not receive your findings in any other form, and no other company is given the link.

We do not sell data to anyone, and we do not share it beyond what is listed here. There is no analytics, no advertising, and no tracking of any kind on this site.

Your results are never published. Several well-known free scanners list recent scans publicly, complete with the site name and its grade. We do not, and there is no page on this site where one report can be found from another.

Your report is private by way of its link

Since there are no accounts, your report is protected by having an address nobody can guess. Anyone you give that link to can read the report, so treat it as you would any private document. Report pages are marked so search engines do not index them.

How long we keep things

• A report you paid for: 90 days, then permanently deleted. You bought it, so you should not lose it because you closed a tab.
• A scan nobody paid for: two days, then permanently deleted. Two weeks if you got as far as opening the payment page, so that a payment arriving days later still finds the report it was for. It only has to last long enough to read and decide on.
• Rate-limit counters: up to one hour for anything counted against a visitor, and up to 24 hours for a counter that holds no address at all, which caps how many times one report can be re-checked in a day.
• The order number from your payment, stored beside your report for 90 days. It is what lets us find your report if you write in having lost the link, and it is the only thing we keep that came from the payment provider.
• Server logs: retained by our host for their standard period.

Your rights

You can ask us to delete your report at any time before it expires. Send us the report link and we will remove it. Depending on where you live you may also have rights to access or correct data we hold. Because we hold so little, and none of it identifies you by name, these requests are usually resolved by deleting the report.

Children

This service is intended for people running a business or a website, and not for children.

Changes

If this policy changes, the date at the top changes with it.

Contact

Privacy questions: support@scan44.com.