Privacy notice

What is stored when you run an audit

Running an audit creates one record on this server. It holds:

• The address you submitted, with the host, path and scheme parsed from it.
• The measurements: HTTP status, response time, page size, and the value behind every check that ran.
• A hash of the requesting IP address, used only to apply rate limits. The address itself is not stored.
• The user agent your browser sent, and the language the audit was started in.
• Optionally, the HTML that was served, kept for a limited number of days so findings can be re-read, then deleted.

If you contact the studio

A contact or request form stores only what you type: usually a name, an e-mail address, a company and a message, plus the report you were reading. The consent box is never pre-selected, and nothing is sent until you tick it.

Those details are used to answer you and to keep a record of the conversation in the studio inbox. They are not sold, not added to a purchased list, and not shared outside the studio except where a law requires it.

Cookies and browser storage

This platform uses the minimum:

• One session cookie, so the server can recognise a returning request, apply rate limits and keep an administrator signed in.
• One browser-storage entry for your theme and language choice, so the site does not ask again.
• No advertising cookies, no social trackers and no third-party analytics on these pages.

How long things are kept

Audit records, stored page source and log entries have configured lifetimes on this installation; the values in use are shown below. A maintenance task removes anything past its lifetime.

Who else sees the data

The audited server sees one request from this installation, like any other visitor. If e-mail is configured, the mail provider set up by the studio carries the messages you trigger.

Hosting is provided by the hosting account of the studio, which stores the files and the database under its own terms. No other processor is involved by default.

Your rights

You can ask what is stored about you, ask for a correction, or ask for deletion. Write to the contact address on this page and a person handles the request.

If a report about your site was published by someone else and you want it removed, say so: an administrator can take a report down without touching the rest of the data.

How the platform protects data

Database access uses prepared statements, forms are protected against cross-site request forgery, output is escaped, passwords are hashed, sessions expire, and requests to internal addresses are refused. None of that makes the platform invisible to a determined attacker; it means the ordinary mistakes are not present.