Privacy

Privacy

The checker has to remember a result so the link works, and it has to count requests so one network cannot scan the web through this form. That is the whole purpose of the stored data.

Checker

When you submit a URL, the site stores the URL, a normalized key, the JSON result, the time, and a SHA-256 hash of a fixed prefix plus the IP address. The hash is truncated. The raw IP is not written to the database. The hash is used for the limit of five checks per hour. A repeat of the same URL within 24 hours returns the stored result and does not count against that limit.

The fetch itself contacts the site you named, plus its robots.txt, sitemap, and llms.txt, and it may contact Google PageSpeed Insights if an API key is configured. Those requests leave this server. Do not submit a URL you are not allowed to request.

Newsletter

An email address is stored only if you submit the form. Optional fields are the page you came from, a URL to recheck, and whether that URL may be included in a future public sample. There is no Kit, Mailchimp, or other vendor. A hidden company field is ignored when it is filled, which is how the form drops automated signups.

Google Analytics and consent

The site loads Google Analytics 4, measurement ID G-YT97L9LT83. Before that script runs, Google Consent Mode v2 sets four defaults to denied: ad_storage, analytics_storage, ad_user_data, and ad_personalization, with wait_for_update of 500 milliseconds. Nothing is granted until you choose.

A banner at the bottom of the page offers Accept all, Reject all, and Customize. Reject all is the same kind of button as Accept all, and it takes the same one click. Customize has two switches: analytics, and ads storage. The choice is saved in localStorage under the key readabot-consent-v1. It is not itself a cookie. Saving calls gtag('consent', 'update', ...) with granted or denied for those four signals. Ads storage covers ad_storage, ad_user_data, and ad_personalization together.

If you allow analytics, Google may set a _ga cookie and a _ga_YT97L9LT83 cookie, each for up to two years, to tell visits apart. If you refuse analytics, those cookies are not set, and a refusal deletes any _ga cookies already stored for this host. Google can still receive a cookieless ping while analytics_storage stays denied. That ping is how Consent Mode reports that the visit was not measured with a cookie.

No Google AdSense script is loaded. The publisher id ca-pub-8847517813457940 is only a comment in the page source. Allowing ads storage does not place an ad cookie until an ads script is added. There is no advertising cookie today.

Withdraw consent at any time with Cookie settings in the footer. Reject all sets the four signals back to denied and clears the Analytics cookies. Customize can turn analytics or ads storage off on their own and then Save choices. The theme switch is a separate localStorage value and is not an analytics cookie. If a Turnstile site key is configured, Cloudflare may process that challenge under its own terms. The key ships empty, so the widget is off until it is set.

Results and addresses stay until the publisher deletes them or a retention rule is written. That rule is also a TODO, and it will be added here rather than implied.