Privacy

What we collect

If you use the tool without signing in, we do not ask who you are and we keep no record of the URLs you audit. If you choose to create an account, we store the email address you enter and a salted PBKDF2 hash of your password — never the password itself. We also store the sites you save and the audit results generated for them, linked to your account. There is no newsletter and no comment system.

The URL you audit

When you submit a URL it is fetched and analysed to produce your results. If you are not signed in, it is then discarded: not written to disk, not queued, and not associated with anything. If you are signed in, it is saved to your account together with its results, and is visible on your dashboard so you can compare runs over time. The URL is always sent to the site you asked us to audit, and to Google’s PageSpeed API as described below.

The results page makes additional requests from our server to the audited site to render desktop and mobile previews. The fetched page runs in an isolated sandbox; some sites may still prevent the preview from loading.

Cookies and local storage

This site sets two cookies, both strictly necessary for the service to work and both marked HttpOnly so page scripts cannot read them:

• sess holds an opaque random session token that keeps you signed in. It is marked Secure and SameSite=Lax, and expires after 30 days. Signing out deletes it.
• saq holds a random token used to count your three free runs. It contains nothing about you and is only ever read as a lookup key.

Your browser’s local storage is used for one purpose: remembering whether you chose the light or dark theme, so the page does not snap back to a theme you did not pick. That value stays in your browser, is never transmitted, and is a single word. Clearing site data removes it.

Clearing your browser data does not reset your free runs. The count is kept on our server, so removing the saq cookie does not buy more audits.

How the free-run limit is counted

The limit exists so the service cannot be used for free at scale, and it is enforced by our server rather than by your browser. If you are signed in, the count is attached to your account, so signing out, signing back in or using a different browser does not reset it. If you are not signed in, the count is recorded against a keyed hash of your browser token and a keyed hash of your IP address, and a run is only allowed while both still have room. We store these hashes rather than the raw address or token, so the table cannot be read back into a visitor. A hashed address is still personal data, and is treated as such.

Third parties

An audit necessarily involves requests to services other than this one. When you run an audit, the following happen:

• The audited site receives a normal HTTP request, and so does any image, stylesheet or link the audit checks. Their operators will see a request from our infrastructure, as they would from any visitor.
• Google’s PageSpeed Insights API is queried with the audited URL to obtain the performance score, and Google receives that URL as part of that request.
• The site’s own robots.txt and sitemap.xml are requested from your site.

No font, script, image or stylesheet is loaded from a third-party CDN. Every asset on these pages is served from this domain. The one exception is Cloudflare Turnstile, the human-verification widget on the sign-up form, which is loaded from challenges.cloudflare.com and sets its own cookies. It is only requested once a Turnstile site key is configured for the site; until then no such request is made.

Server logs

This site is hosted on Cloudflare. Like any web host, Cloudflare processes connection logs such as IP address, timestamp and requested URL in order to serve requests, prevent abuse and apply rate limiting. Those logs are governed by Cloudflare’s own privacy policy, not by this one, and we do not add to them or inspect them.

Rate limiting is applied per request, in memory, using your IP address, and exists to stop the service being used to attack or overwhelm other sites. The free-run count described above is keyed to a hashed form of your address for the same reason. Neither is linked to your account, and neither is readable as a plain IP address.

How long we keep things

Account data is kept until you ask us to remove it. Saved sites and their audit history are kept with your account for as long as the account exists. Session records expire 30 days after sign-in or sign-up and are deleted on a rolling basis, so expired sessions do not accumulate.

Children

This service is a technical tool intended for adults. It is not directed at children, and we do not knowingly collect information from anyone of any age.

Your rights

You can delete a saved site from your dashboard at any time, which also deletes its audit history. To export, correct or erase your account data, or to withdraw from the service entirely, contact us and we will action it. If you never created an account, we hold no personal data about you; the free-run counter described above is the only record, and it is a count against a hashed identifier.

Changes to this policy

If this policy changes in a way that affects how information is handled, the updated version will be published on this page with a new date. Continuing to use the service after a change means you accept it.