Privacy

Your email address, so we can sign you in. We use a magic link rather than a password, which means we never receive or store a password from you.

What you tell us to audit — the website or store URL you submit, and any company or product details you choose to add.

The audit we produce for you, including the public pages and public discussions it measured, and the report generated from them.

How you found us. If you arrive through a campaign link, we keep the five short campaign tags that link may carry (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the address of the page that referred you without its query string, and which page of ours you landed on. Against your account we keep only the referring site’s hostname, not its path. These values are read from your browser at the moment you submit one of our forms and travel inside that form; if you never submit a form, nothing about how you arrived is recorded. We set no cookie for this, create no advertising or cross-site identifier, and send it to no analytics or advertising provider.

An optional question. Once, inside your account, we may ask how you heard about us and offer a short list to choose from. Answering is optional and skipping is a complete answer; either way we record that you responded and do not ask again. A skip records only that you skipped.

We do not ask for, and have no use for, payment card details, government identifiers, or any special category personal data.

Audits read public sources only: pages your site serves to anyone, public discussion on Reddit, X and public forums, and the answers public AI assistants give to buyer questions. We do not log in to anything, we do not send direct messages, and we do not read content behind a login or a paywall.

When a page or a source could not be read, the report says so. We never present something we could not check as something we checked.

Running an audit means sending queries to third parties. Each one receives only what it needs to answer:

• Supabase — database, file storage and authentication. Your account and your audits live here.
• Vercel — application hosting and request logs.
• OpenRouter — the language models that analyse public text.
• Tavily — public web search.
• Bright Data — retrieval of public AI assistant answers and public social posts.
• Stripe — payment processing. Nothing is publicly purchasable during this beta, so Stripe is currently configured but unused for public sales. If that changes, Stripe receives your payment details directly and we never see them.

We do not sell your data, and we do not share it with anyone for advertising.

Your account and your audits are kept while your account exists, so you can return to a report you paid for or requested. Ask us to delete them and we will delete them.

How-you-found-us information attached to your account, including your answer to the optional question, is deleted automatically when your account is deleted. We also keep one contact record per email address, which exists whether or not an account was ever created and holds the campaign tags and referring page from the first form that address submitted; that record is not removed by deleting an account, and we delete it when you ask us to.

You can ask us for a copy of your data, ask us to correct it, or ask us to delete your account and everything attached to it. Send the request through our contact form and a person will handle it.

You can skip the “How did you hear about us?” question, and you can ask us to delete the contact record described above even if you never had an account.

Audits are readable only by the account that owns them, enforced in the database itself rather than only in the interface. Reports are served through an authenticated route that checks ownership on every request.

If this page changes materially we will update the review date above. Questions about any of it go through our contact form.