What we store, and what we do not

If you have an account, that is an email address and the categories of check you said you cared about. Nothing else.

There is no password field anywhere in this product, so there is no password of yours to store, leak or reset. We do not ask for your name, your company, your phone number, or your address, and we do not collect them from anywhere else.

The URL, the host, the scores, and each finding — its title, the evidence observed, the remediation and the suggested fix prompt. Also when the scan ran, how long it took, and which version of the engine produced it, so an old report stays reproducible.

The evidence is what a browser could already see: response headers, HTML, and what a page renders. ScanlyFix never signs in, never submits a form, and never attempts anything a site owner has not already made public.

You can scan without signing in. Those scans are stored too, and to make rate limiting possible we keep a salted SHA-256 hash of the visitor’s IP address — not the address itself.

The salt is what makes that meaningful. There are only about four billion IPv4 addresses, so an unsalted hash of one is reversed by brute force in minutes; with a secret salt it is not. We cannot recover an address from what we store, which also means we cannot connect an anonymous scan back to you on request.

We never see your card. Razorpay collects and holds payment details; what reaches us is the state of your subscription — its plan, its status, and when the current period ends.

An API key is shown once, at creation, and is never stored. What we keep is a SHA-256 hash of it plus its first few characters, so you can tell your keys apart in a list. A copy of our database does not contain a usable key.

These are the only companies involved, and each receives only what its job needs.

We do not sell anything to anyone, and there is no advertising network, analytics script or third-party tracker on this site. The typeface is served from our own domain rather than Google’s, because a page that phones a third party before you consent is something this product’s own compliance checks would flag.

Account data lasts as long as the account. Scans and their findings are kept so your history stays comparable over time — that comparison is most of what a paid plan is for. Deleting a project deletes its scans, findings, monitors and alerts with it.

Email scanlyfix@gmail.com from the address on the account and we will delete it, and everything attached to it, within 30 days. You can also ask for a copy of what we hold.

Anonymous scans are the one exception, for the reason given in section 3: there is nothing in them that identifies you, and no way for us to find them on your behalf.

One, and only when you sign in: the session cookie that keeps you signed in. There is no cookie banner because there is nothing to consent to — no advertising, analytics or tracking cookie is set at any point.

If this policy changes in a way that affects what we collect or who receives it, the date at the top changes and account holders are told by email before it takes effect.

ScanlyFix is operated by the individual operating ScanlyFix. Write to scanlyfix@gmail.com with any question about this page.