What we collect, and what we do with it.
Written from what the system actually does, so you can check it against the behaviour rather than against a template.
This is a working draft, not a published policy. The factual descriptions below reflect how the system behaves. The legal framing has not been reviewed by counsel and this page must not be relied on as a privacy policy until it has been.
The short version
- We store the crawl results and the fixes we generate for you. That is the product.
- We do not resell crawl data.
- We do not train models on your content.
- We do not keep repository or CMS access beyond the scopes you grant.
- Revoke access at any time and the associated data goes with it.
The free scan specifically
You can run a scan without an account, and the design tries hard not to accumulate anything about you in the process.
- The requesting address is never stored raw. It is stored as a keyed HMAC, truncated: enough to recognise a repeat caller, not enough to be a log of who visited.
- Results expire after 30 days, including any share link, and a share link never exposes the findings regardless of who opens it.
- An email address is only collected if you choose to unlock the findings, and the verification token is stored hashed.
Content sent to model providers
Some checks in the rubric are model-judged, and those are labelled Model everywhere they appear. To run them, content from the pages you ask us to scan is sent to a large-language-model provider.
Three other features send content to the same providers, and the sub-processor table above was the only place that was written down. Article drafting sends the pages we drafted from. Competitor analysis sends the competitor pages you named. And if you use Reddit Radar, the text of public Reddit posts and comments matching your keywords is sent so it can be classified, and for Hunt, scored and drafted against. The Reddit author's username is not sent to any model provider.
This is a real disclosure and worth stating plainly rather than burying in a sub-processor table, if you scan a page, the text of that page leaves our infrastructure. "We do not train models on your content" means we do not use it to train models and we contract for the same; it does not mean the content never goes anywhere.
Scanning a site you do not control, which the free scorecard permits, sends that site's public HTML the same way.
Sub-processors
| Processor | Purpose | What it sees |
|---|---|---|
| Amazon Web Services | Object storage and hosting | Files you upload and generated artifacts |
| Polar | Payments and subscriptions | Billing identity and transaction records |
| Resend | Transactional email | Your address, and the contents of mail we send you |
| Cloudflare | CAPTCHA (Turnstile) and edge delivery | Request metadata for abuse prevention |
| OpenRouter, Anthropic, OpenAI, Groq and DeepSeek | Model-judged checks, article drafting, Reddit mention classification | Page content from sites you scan, competitor pages, and the text of public Reddit posts matching your keywords |
| redditapis.com | Reddit keyword search for Reddit Radar | The keywords you ask us to watch |
Fonts on this site are self-hosted, so loading a page here does not send your address to a font CDN. Brand icons are inlined at build time for the same reason. There is no analytics script on this site today.
Retention
| Data | Kept | Why |
|---|---|---|
| Free scan results | 30 days | A shared scorecard is a snapshot, not a permanent product. |
| Requester IP for a free scan | Stored only as a truncated HMAC | Enough to block a repeat abuser, not a log of who visited. |
| Email verification tokens | Stored hashed, valid 24 hours | The column is reachable from an unauthenticated surface; a raw token there would be the link itself. |
| Account crawl data and findings | While the account is open | Deleted with the account. |
| Reddit mentions and threads we surface | Kept while you are watching the keyword that found them | Ask us and we will remove a specific mention or thread. See below if one of them is yours. |
| Repository and CMS access | Only the scopes you grant | Revoking access takes the associated data with it. |
Your rights
You can export your data, and you can delete your account, which deletes the crawl data and findings associated with it. If you are in a jurisdiction with statutory rights of access, correction, portability or erasure, those apply and the mechanisms above are how they are exercised.
Being crawled by us
If you are here because CrawldBot appeared in your logs rather than because you are a customer, the crawler page explains exactly what it fetches, the limits it works within, and how to block it. Blocking works and takes effect on the next scheduled run.
If we hold a snippet of your Reddit post
Reddit Radar searches public Reddit for the keywords a customer asks us to watch, and stores what it finds: the subreddit, the post or comment text that matched, a link back to the original, and the author's username. We show it to that one customer so they can decide whether to reply. It is never published, never shown to other customers, and the username is never sent to a model provider.
If one of those is yours and you would rather we did not hold it, tell us through the contact page with a link to the post and we will delete it. You do not need an account with us to ask, and we will not ask you to make one.