Privacy
This is the privacy notice for the WebFixScore scanner. It describes this installation, not a separate company dashboard.
What you send us
A scan requires a public URL, an email address, and a confirmation that you own the site or are allowed to test it. We store those, plus the time, a hash of the network address for rate limits, the score, and the written findings. We do not show the email on the public report.
What the scan reads
The scanner requests the homepage, a limited number of same-site scripts and links, robots.txt, a sitemap, llms.txt, a few well-known filenames such as /.env, DNS TXT records, and optionally Google PageSpeed. It follows redirects only to public hosts on ports 80 and 443.
What we do not keep
We do not keep the homepage HTML, script bodies, or source maps. If a public Supabase anon key or Firebase URL is already in the page, we check whether data is exposed. We store a table name and a row count, or whether Firebase denied the read. We do not store rows, keys, or file contents. Secret matches are reduced to the type of key and the file path.
Payments and email
If Stripe is configured, Stripe processes the $9 payment and we store the checkout session id and the time it was paid. If Resend is configured, we email the report link and up to three follow-ups. Follow-ups stop after the report is unlocked. If those services are not configured, we skip them and say so on the report. We do not sell the email list.
How long it lasts
Reports stay until the operator of this installation deletes them. Without a database, a preview server keeps scans in a local file that disappears when that machine does. Report links are unlisted. Do not share an unlocked link if you do not want the fixes to be read.
Asking for a deletion
Email the operator of the site where you ran the scan, from the same address you used, and ask for that scan to be deleted. If email sending is configured, that operator address is the From address on the report email.