Privacy notice

Draft, pending legal review · updated 29 October 2026

Free check (no account)

  • The domain you enter (and a DKIM selector, if you give one) is sent to our scanner on Cloudflare Workers. It queries public DNS through Cloudflare's 1.1.1.1 resolver and requests the domain's homepage from Cloudflare's network.
  • To check certificates and blocklists, the scanner also sends the domain (never anything about you) to crt.sh (public Certificate Transparency search), Google Web Risk (the homepage URL) and abuse.ch URLhaus (the hostname).
  • The report is returned to your browser. We do not store free-check reports or the domains you scan.
  • To prevent abuse we count scans per IP address for one minute, using a one-way hash of the address.
  • Your last five scans are saved in your browser's local storage. Use "Clear" under "Recent scans on this device" to remove them.

Monitoring beta (account)

If you create an account, we store:

  • How you sign in. If you use Google or LinkedIn, we receive and store the account ID that provider gives us, your email address (only if the provider says it's verified) and your name. If you use an emailed link, we store your email address. We never receive or store your Google or LinkedIn password, and we don't keep the provider's access tokens.
  • A sign-in cookie. After you sign in, your browser keeps a secure, HttpOnly cookie for up to 30 days so you stay signed in. We store only a one-way hash of it. Signing out deletes it.
  • Which Google account you used (Google sign-in only). So you aren't asked to choose an account every time, your browser keeps a secure, HttpOnly cookie with Google's account number for the account that last signed in here (never your email). It lasts up to 400 days, stays after you sign out so the next sign-in is quicker, and is deleted when you delete your account. "Use a different Google account" on the sign-in page ignores it.
  • An account key, if you use one, as a one-way hash. We can't see or recover the key. Your browser keeps it for the session, or longer if you tick "remember".
  • The domains you add and how you proved ownership.
  • The latest scan report for each verified domain, and a history of scores and issue codes, plus the alerts they produced, kept for your plan's period: 90 days on Free, 1 year on Pro, 2 years on Agency. After a move to a plan with a shorter period, older history is deleted 30 days later.
  • The results of the weekly checks of your domain's subdomains and pages: the hostnames and page paths checked and what was found on each, kept for 60 days.
  • Which account emails we've sent you. We email you about your own account: a welcome and at most one setup reminder (you can turn these off in Settings or with the link in each one), and emails about your subscription and failed payments (always sent while you have a paid plan). We store which email was sent and when, never its content, for 180 days. We don't send marketing email.
  • Your webhook URL, if you set one. Alert messages are sent to that provider (for example Slack or Discord).
  • From the server agent, if you install it: the names and versions of your CMS core, plugins, modules and themes, and for each flagged file its path, checksum, the rule that matched and a short excerpt (up to 300 characters). On WordPress, for each flagged database entry: the table, row ID, the rule, a short excerpt (up to 200 characters) and checksums; for administrator accounts that appear new, only the user ID and registration date. Only the latest report is kept.
  • A record of every action you approve (quarantine, restore, fragment removal, undo, Cloudflare changes) with the previous values, so changes can be reviewed and undone.

We never collect whole files, whole database values, user names, email addresses or password hashes of your site's users, passwords, hosting or FTP credentials, database credentials, WordPress administrator credentials or wp-config.php values (the agent reads database settings on your server and never sends them). Quarantined files and the previous content of edited posts are backed up on your own server and never uploaded. Your Cloudflare API token is used for the single request you send it with and is not stored.

If you turn on the status badge, a public page shows your domain, when it was last checked, and how many issues were found in each area, never the issues themselves. Turning the badge off removes it (copies already cached by visitors' browsers expire within 10 minutes).

Deleting your data

Deleting a site removes its history, weekly subdomain and page results, alerts, agent report and action log. Deleting your account ("Delete account" in the dashboard) removes everything, including your sign-in details and sessions. Expired sessions are deleted automatically; unused sign-in links expire after 15 minutes and are deleted within a day. To remove data from your server, uninstall the agent and delete its quarantine folder.

Other services involved

Cloudflare hosts the service and database. Domains being checked are looked up in crt.sh, Google Web Risk and abuse.ch URLhaus, as described above. Google or LinkedIn handle sign-in if you choose them. If you buy a paid plan, Stripe handles the payment and the purchase is sold through Link (Stripe's merchant of record service): they receive your payment details, billing address and email directly, and we receive only a customer reference, your plan, its status and renewal date. We never see or store card details. We send email (sign-in links and the account emails above) through Resend, which receives your email address and the message. The agent contacts WordPress.org to check files against official copies, and on Joomla or Drupal sites downloads the official release package from Joomla or drupal.org. We download public vulnerability data from Wordfence Intelligence, OSV.dev and the NVD; none of your data is sent to them.

Product analytics (our own, no third parties)

To learn which features help people and where they get stuck, the service records product events in its own database. No analytics company receives them, no extra cookies are set, and no tracking scripts are added.

  • What an event contains: what happened (for example "assessment completed", "website added", "report exported"), when, which feature, the outcome, how long it took, an approximate country code from Cloudflare (for example "DE"; not a city or precise location, and not a statement about where you live), and a few small counts such as the number of checks run.
  • When you're signed in, events are linked to your internal account and user IDs and, for monitored websites, to the website's internal ID. Your profile also keeps the approximate country of your most recent sign-in.
  • Free checks without an account are counted anonymously: outcome, approximate country and duration. The domain you check is not recorded.
  • Never recorded in analytics: IP addresses, passwords, keys, tokens, email addresses, the domains of free checks, and scan evidence.
  • Suggested next steps: the dashboard may suggest a feature based on your own account's setup (for example "set up alerts"). We record whether a suggestion was shown, opened or dismissed, so dismissed suggestions stay hidden.
  • Client reports (Agency feature): if your account creates branded client reports, we store the branding you enter (agency name, logo, colour, contact details and footer). For each client link we store a copy of the report as created, its expiry, and how many times it was opened. We don't store the link itself (only a fingerprint of it), and we don't record who opened it or their IP address. Anyone with a link can read that report until it expires or you revoke it.
  • Who can see it: the service's administrators, in an admin console that requires a signed-in administrator account. It shows account details (including email and your websites) for running the service, and every account view and export is logged.
  • How long: events are kept for 400 days by default (an administrator can set 30 to 730), then deleted. If you delete your account, your events lose every link to you (account, user and website IDs are removed) and only anonymous counts remain.

Logs and tracking

Our logs record errors only and never include domains, IP addresses, keys or tokens. We don't use third-party analytics, advertising or third-party scripts, and the only cookies we set are the sign-in cookies described above (one lasts 10 minutes while you sign in with Google or LinkedIn; one keeps you signed in; and, for Google sign-in, one remembers which Google account to use next time).

Contact

Questions: privacy@primedevforce.com.