Privacy

Draft, not in force. It describes the planned setup (P2-M4 to M7); controller and contact details and every statement are checked before launch.

When you scan a store

• We store the store's address, whether you asked for a full scan, and the report. Reports describe the store's public pages, not you.
• Reports are reachable by anyone with their link. The link contains a random ID, not the store or you.
• To stop abuse we limit how many scans one visitor can start. For that we keep a keyed hash of your IP address, with a key that changes every day, and delete it after 48 hours. We never store the IP address itself.
• Cloudflare Turnstile checks that a person submitted the form. Cloudflare processes your request for that.

When you visit the site

• We count visits with Umami Cloud, a cookieless analytics service run by Umami Software, Inc. It sets no cookies and we do not use it to follow you across sites.
• For each page view Umami receives the page path, the site you came from (only its address, not the full link), your browser, operating system, screen size and language. Result pages are sent as /scan/:id with a generic title, so Umami never sees which store you scanned or the report's link.
• We also send these events: scan started (full or partial, and whether a recent result was reused), scan completed (finished or failed, full or partial), recommendations shown (which rule groups), and clicks on a recommended app (which app, which rule group, and whether the link is an affiliate link). Events carry no store address, scan ID or personal data. Error pages are sent as /404 or /500, not the address you typed.
• Umami uses your IP address briefly to estimate your country and to tell visits apart; its policy says it does not store the IP address in analytics records. Our Umami data is stored in the EU.
• When you start a scan, this browser tab keeps the scan's ID in session storage so its completion is counted once. It is never sent and is gone when you close the tab.
• We set no tracking cookies and show no ads.

Where data is stored

• The website runs on Cloudflare.
• Scan reports are stored in a database in the EU (Supabase).
• Analytics data is stored in the EU (Umami Cloud).
• The scanner runs on a server in the EU (Hetzner).

Your rights

Under the GDPR you can ask what we store about you and ask us to delete it. Because we store no names, emails or IP addresses for scans, there is usually nothing linked to you. Store owners can ask us to delete reports about their store.