Privacy Policy

Short version: we collect the minimum needed to run your scan and get you the report, we never sell it, and you can ask to have it deleted whenever you want. The long version is below, but that's the whole policy in one sentence.

What we collect: the website URL you submit, the email address you verify, the scan results (findings, severity, suggested fixes), and, if you choose to leave one, your feedback on whether the report was helpful. When you verify your email, we briefly store a 6-digit code against it, and once verified, a random token (not your email itself) in a cookie on your own browser so you're not asked to re-verify on your next scan.

Why we collect it: most importantly, a verified email is how we make sure this free tool is actually helping real people, not being drained by bots or scammers running up a scan bill on our end for nothing. Confirming it with a one-time code, rather than just taking your word for it, is what makes that verification real: anyone can type an address; a code sent to that inbox is what proves someone's actually there to receive it. A couple of quieter, invisible checks run alongside it too (confirming a submission wasn't a script), before a scan is even queued. Beyond anti-abuse, the email is also how your report reaches you and how the per-scan review link is scoped to you specifically, so no one else who uses this tool can see your findings. The IP address of each request is used briefly for rate limiting, the same reason any free public tool has to, to keep it usable and not overwhelmed.

How long we keep the technical bookkeeping: this is enforced automatically by the database itself (a Firestore TTL policy, for anyone checking), not just written here as a promise. Verification codes are gone within about an hour of being issued, whether or not you used them. Rate-limiting counters expire within a few days. The "remember this device" token expires after 30 days, after which you'll verify again. None of this needs any action from you. It deletes itself on schedule.

How long we keep your scan itself: a scan record (the URL you submitted, the findings, and the email address the report went to) is kept so your report link and your review link keep working when you come back to them, and so you can compare a re-scan later. We keep these for up to 12 months and then remove them. That window is longer than the bookkeeping above because the record is the thing you actually came here for; if you'd rather it went sooner, just ask (see "Your control" below) and it's deleted.

Where it lives: on Google Cloud infrastructure (Firestore and Cloud Storage), in a project separate from any other project the operator runs. Report emails and verification codes are sent via Resend, and if you email us, that lands in a Zoho mailbox. Both are the operator's own accounts, not shared with anyone else.

What we don't do: we don't sell your data, we don't use it for advertising, and we don't share it with anyone outside of what's strictly needed to run the scan itself (Google Cloud's AI models, used to analyze your site's public-facing pages) or deliver it to you (Resend, for email).

Your control: to request deletion of your scan history or email address before its automatic expiry, email hello@mad-platform.org directly. No form to fill out, no waiting period, just ask. Feedback marked "okay to use as a public testimonial" may be shared publicly; anything not marked that way stays private, full stop.