Legal
Privacy policy
Effective October 1, 2026. The short version: no accounts, no ads, and one analytics tool you can block.
What data does AIOScan collect?
Only what running the site needs. A scan sends us the URL you entered; we fetch that site, compute the report, and return it to your browser. Reports are cached for 24 hours so share links work, and the address of each scanned site is kept for up to 90 days so score badges can refresh. We count scans by day, grade, and the page the scan started from, and keep a list of the most recently scanned site addresses so we can see how the scanner is used. We also keep anonymous tallies of how many scans pass or fail each check, which feed our published research. None of this is linked to you: no accounts, no names, and no email unless you send one through a request form or sign up for monthly scores. Request forms are stored by Netlify and forwarded to us by email through Resend, and are used only to answer your request.
What happens if I sign up for monthly scores?
We keep your email, the page you asked us to watch, and a record of your consent, and use them to send one email a month plus occasional news and offers from AIOScan and Meison.
Alongside that we store which of the two descriptions you picked (running the business or doing its marketing), and the consent record itself: the exact wording you agreed to, when, and a one-way hash of your IP address. Each month we rescan the page and keep its latest score and failing checks so the next email can say what changed. Records are stored with Netlify and emails are sent through Resend.
Nothing is sent until you click the confirmation link, and sign-ups that are never confirmed are deleted after seven days. Every email has a one-click unsubscribe. When you unsubscribe we delete your scores and keep only your address, the consent record, and the dates, so we can honour the opt-out and show it if asked. To have that deleted too, email theaioscan@gmail.com.
What does the AIOScan app in ChatGPT send us?
Only the website address you ask it to scan. We never receive your ChatGPT conversation, your name, your email, or your OpenAI account.
When ChatGPT uses the app, it sends that address to aioscan.com, which runs the same scanner the site uses and returns the result to ChatGPT. The scan is stored like any other: the report is cached for 24 hours, the site address is kept for up to 90 days for score badges, and the scan is counted as coming from the app. Requests reach us through Netlify, under the same short-lived server logs described below. What happens to your conversation inside ChatGPT is covered by OpenAI's privacy policy.
What about server logs and rate limiting?
Our hosting provider (Netlify) keeps standard, short-lived server logs that include IP addresses, and provides us with aggregate page-view counts computed from those logs. We hold IP addresses for up to an hour to rate-limit the scanner. Neither is used to build profiles, and we don’t sell or share this data with anyone.
Do you use cookies or tracking?
Yes, one tool. We use Microsoft Clarity to see how people use the site, through heatmaps, anonymized session replays, and events such as a completed scan or a copied share link. Clarity sets first-party cookies and Microsoft processes that data under its privacy statement. Clarity also runs inside the embeddable scanner, tagged as the embed together with the address of the site it is embedded on, so we can see how the embed is used. For every embed load and scan we also note that site's address and the time, never an IP address. To keep bots from abusing the free scanner and request forms, we may use Cloudflare Turnstile, which checks that a visitor is a person, usually without asking you to do anything. We also use Simple Analytics for cookie-free page-view counts. There are no advertising scripts. Blocking cookies or using a content blocker stops Clarity without breaking anything on AIOScan.
What happens to the sites I scan?
We fetch the site’s public pages, robots.txt, sitemap, and llms.txt once per scan, identify ourselves with an AIOScanBot user-agent, and keep only the computed report and a short text extract for 24 hours. One extra request per scan identifies as GPTBot, OpenAI’s crawler, to test whether the site’s firewall treats AI crawlers differently. We never disguise the scanner as a browser. We don’t archive scanned pages.
How can you contact us about privacy?
Email theaioscan@gmail.com and we’ll respond promptly. If this policy changes, the effective date above will change with it.