Privacy

Baudot Systems Ltd, Plot 26, Ndawula Road, Village 19, Ntinda, Nakawa Division, 216257 Kampala GPO, Uganda is the data controller for everything described below. Reach us at hello@citeable.tools.

You do not create an account and we do not ask for your name. We store the URL you scanned and its result for six hours, so that a shared report link loads without hitting your server again. We add the result to an anonymous aggregate: counts of how many scanned pages block AI crawlers, how many require JavaScript, and a score histogram, published at /index. Alongside the counts we keep one marker per hostname, so that scanning the same site twice does not count it as two. When a page returns nothing at all we keep one marker of that refused address for six hours, for the same reason: a refusal is never cached, so without the marker reloading a broken report would count it again every time. The aggregate holds no page addresses and nothing about the person who ran the scan.

For rate limiting we hold a counter keyed to your IP address for up to two hours. We do not use analytics scripts, advertising trackers, or cookies. The site sets no cookies at all.

We store your email address, the URL you asked us to watch, the date you asked, and a history of that page's score, at most 26 dated entries of the form {date, score, band}. We do not store copies of your pages.

Your address is not stored at all until you click the confirmation link we email you. If you never confirm, the pending record expires after 48 hours and nothing remains.

Dodo Payments processes the payment and is the merchant of record. We never see or store your card details. From Dodo Payments we receive your email address and which plan you are on, and we store only that.

Three processors, and no one else: Cloudflare hosts the service and stores the data above; Resend delivers our emails and therefore handles your address; Dodo Payments processes payments. We do not sell data, share it with advertisers, or use it to train anything.

The form on the agency page stores the band you pick (how many sites you look after), the date, and your email address only if you chose to give one. The address is optional and most submissions carry none. We send nothing when you submit. If that plan is ever built we will email the addresses once to say so, and that is the only message this list will ever produce.

Every address that confirms a site gets one unguessable link that shows all of its sites in one place. Against that link we store your address, so the link keeps working, and one setting: whether you have asked for the monthly summary. Nothing else. It is deleted when you stop watching your last site, at the same moment as everything else we hold about you.

We also keep a single marker per account to record that we have emailed you your account link once, so you do not receive the same welcome message every time you confirm a new page. The marker holds nothing but the fact that it was sent, and it is deleted with everything else when you stop watching your last site.

Off unless you switch it on from your own list page. When it is on we send one email on the first of each month showing where your sites stand, and we record no more than the fact that you asked for it. Switching it off is one click on the same page, and it stops immediately.

Each run writes a record of which watched URLs were checked and what happened, kept for 90 days so we can tell whether a missed alert was our fault. It contains watched URLs, never email addresses. Alongside it we keep a marker of where the last run stopped, so the next one resumes rather than starting over. That marker is a bookmark in our own list of watched pages and describes nobody.

When a check cannot finish — pages that do not answer us — we keep a count of how many runs in a row that has happened for a watched URL, so we can tell you rather than leaving you in silence. It holds the URL, the count and how many pages answered last time. It is deleted the moment a check completes.

We also keep a one-hour marker when we have warned ourselves about a billing fault, so the same fault does not send us forty identical messages. It holds a price identifier of our own and nothing about any person.

And when you ask for your account link on the recover-your-link form, we keep a one-hour marker so the same address cannot be mail-bombed by an attacker asking for it repeatedly. The marker holds your address and expires after an hour; without it, somebody knowing your address could ask a botnet to flood your inbox.

Every account gets a referral code, which is generated independently of your account link — the code is meant to be shared and the link is a password, so neither is derived from the other. We keep the code, and the address it belongs to, so a reward reaches the right person.

Clicking a referral link records nothing whatsoever: no cookie, no marker, no visit. A record is created only if somebody actually subscribes, and then it holds the code used, the date, and whether the reward has matured — nothing about who they are beyond the address the subscription itself already gave us. We never tell a referrer who used their code, because that is somebody else's information.

Every alert email contains a one-click unsubscribe link. Using it deletes that watch, its score history and its last snapshot immediately. When it was your last site, your account link and your summary setting go with it. If you have a paid plan, the record of which plan you are on stays until the subscription itself is cancelled, because that record is the subscription as far as this service is concerned. Cancel it and that goes too. We do not keep a suppressed copy. You can also email hello@citeable.tools and ask us to delete everything associated with your address, and we will do it and confirm.

If you are in the UK, EU or another region with data protection rights, you can ask for a copy of what we hold, ask us to correct or delete it, or object to processing. Email hello@citeable.tools. We do not require an account to honour any of that.

This is a tool for people who operate websites. It is not directed at children and we do not knowingly collect their data.