The address you submit, and what we fetched from it. When you run a check we
request the page the way a crawler does and keep the result, so the report link keeps working
afterwards and so the fix pack can be regenerated. That includes the HTML we received and the
evidence attached to each finding.
Your email address, if you leave one. It is optional. It is used to send you
the report and to notify you when a re-check finds something changed. Every notification has a
one-click unsubscribe link.
Your account, if you create one. An email address and a password. The password
is stored as a PBKDF2-SHA256 hash — 100,000 iterations, two rounds, a random salt per user —
never as the password itself. Sign-in sessions, email-verification links and password-reset
links are stored only as hashes too, and changing your password invalidates every existing
session. The checks, reports and monitoring you keep belong to that account, nothing else.
A truncated hash of your IP address. Used for one thing only: counting how
many anonymous checks come from the same place each day, so the free limit cannot be
trivially bypassed — and, in the same form, to notice abuse of the service. It is a SHA-256
hash cut to eight bytes — pseudonymous, not
anonymous, and we would rather say that plainly than imply otherwise.
What we do not do
No analytics scripts, no advertising, no tracking cookies, no cross-site identifiers, and no
selling or sharing of your data for marketing. An account collects an email address and a
password hash — no name, no address, no phone number, and no payment details, because nothing on
this site takes payment.
One exception worth naming: the human check on the check page is Cloudflare Turnstile, and it
may set a cookie as part of that challenge. It is there to stop the free check from becoming an
open proxy for anyone who wants to crawl the web at our expense.
Who else touches it
Two processors, both acting on our instructions: Cloudflare hosts the site,
stores the reports and provides the bot check; Resend delivers the emails. The
scans themselves contact the site you asked us to check — obviously — but we do not send your
email or your identity along with that request.
How long we keep it
Reports are kept so that the link you were given keeps working; there is no automatic expiry
today. Daily counters roll over within a day. An account lives until you ask us to remove it:
there is no self-serve delete button yet, so it is an email, and it takes the account, its
reports and its monitoring with it. You do not need to give a reason.
Your choices
Never leave an email: the check works without one.
Unsubscribe from re-check notifications with the link in any of those emails.
Ask us to delete your account, your email address or a report by writing to
reports@geoaiseo.com.
Changes
If this policy changes in a way that matters, the date at the top changes with it. Questions
about any of the above go to reports@geoaiseo.com.