Data handling
What happens to your domain and data.
You're handing over a domain, and sometimes an email or account — here's the honest read of what that does. No legalese wall, and nothing here that isn't true of the actual code that runs the scan and the dashboard.
The free scan
Before you have an account
- What does the free scan actually read?
- A single server-side HTTP fetch of the public homepage you gave us — the same page anyone's browser can load. It reads the public HTML, JSON-LD/schema, and head tags. It never logs in, never touches an admin panel, and never fetches a private or internal address.
- Is this a browser or a bypass tool?
- No. The scan is a plain HTTP GET with a normal timeout and a byte cap, identifying itself honestly (PromptGoblinScanBot). It is not a headless browser, and it does not attempt to get around a firewall, paywall, or bot-block — a blocked or unreadable page is flagged as unreadable, never scored as a failure.
- What do you do with the domain I type in?
- It's used to run the scan and, if you ask for the results by email, to send you that one report. We don't sell it or hand it to a third party for marketing.
Paid tiers
Your account and the work we ship
- How is my account data stored?
- Paid-tier accounts run on Supabase with row-level security (RLS) policies scoping every query to your own account — one client's dashboard can't read another's rows.
- Who sees the fixes and content before they ship?
- A human operator reviews generated fixes and content before anything goes out. Nothing from the pipeline auto-deploys or auto-publishes on your site or socials without that review.
- Do you see my card details?
- No. Checkout runs through Stripe's hosted payment page — we never see or store card numbers.
What we won't claim
The honest gaps in this page
- We don't publish a retention-period table or a deletion SLA here — if you need one for a vendor-review process, email us and we'll answer for your case directly instead of guessing in a boilerplate page.
- We don't hold a SOC 2, ISO 27001, or similar third-party certification. If that's a requirement for you, tell us before you buy.
- We don't claim 'we never store X' unless it's true of the actual code path — this page only states what we could verify.
Need a real answer for a vendor-security review? [email protected] — a human answers, not a template.
Go deeper