Scan reports are public by link
Every scan gets a shareable URL such as /r/abc123. That link is unlisted, not secret: anyone who has it can open the report, and we do not check who they are. The home page also lists the most recent scans by host name, so scanning a page publishes the fact that the page was scanned.
Do not scan a page you would not want a stranger to see a report about, such as a staging site behind a guessable URL or a page holding personal data.
What a scan stores
- The URL you submitted and the URL it redirected to.
- The page title, the time of the scan and the engine version.
- The accessibility findings, including short snippets of the page's own HTML for each failing element, and the CSS selector pointing at it.
- The accessibility overlay vendor detected on the page, when there is one.
We load the page the way a visitor's browser would. If that page happens to show personal data to anonymous visitors, a snippet of it can end up in the stored report, which is one more reason to scan pages that are already public.
What we never store
- No cookies and no browser storage. The site sets none, so there is nothing to consent to and nothing to opt out of.
- No IP addresses. Your address is used in memory to limit how many scans and AI fixes one client can run per hour. It is hashed with a key that is regenerated each time the server restarts, and it is never written to disk.
- No third-party trackers or analytics. Our own analytics are daily counters, such as "12 scans on 25 July". They record no visitor, no session and no address, so they cannot be tied back to a person.
Email addresses
If you join the waitlist we store the address, which page you signed up from, and the scan it related to. We use it for one thing: to tell you when paid monitoring opens. We do not sell it, share it, or add you to a newsletter. Ask us and we delete it.
The AI fix feature
When you press "Fix this with AI", the snippet of failing HTML, the rule that failed and its description are sent to Anthropic's Claude, which returns a suggested rewrite. Nothing else about you goes with it: no address, no email, no other part of your page. If you would rather that snippet never leaves this server, do not use the button. The rest of the report works without it.
Where the data lives
Reports and waitlist entries sit in a SQLite database on a single server in Helsinki, Finland, rented from Hetzner. Backups run nightly to that same server and are kept for fourteen days. Traffic reaches the server over HTTPS only.
Deleting your data
You can ask us to delete a scan report or your waitlist entry, and we will. The request address is being set up and will be published here; until then, reply to whatever message brought you to this site and the request will reach us.
Changes
If this page changes in a way that affects what we collect, we will change the date at the top and say what moved.