Privacy
Short version: we store the sites you scan and, if you make an account, your email address. We do not sell anything to anybody, we do not run advertising trackers, and nothing you scan leaves our own servers.
If you scan without an account
We store the address you entered, everything the scan measured, and your IP address. The IP is used for rate limiting — it is what stops one person running thousands of scans — and is not used to profile you.
We also set one cookie holding a random identifier. Its only job is to let you claim a scan you started before signing up. It is not shared with anyone and it does not follow you to other sites.
If you make an account
We store your email address, your name if you gave one, and your password as a bcrypt hash — we cannot read your password and neither can anyone who steals the database. Sessions are stored as hashes of a random token in a cookie that is HTTP-only and same-site.
Your email is used for account matters only: confirming the address, resetting the password, and telling you if someone tries to register with it. There is no newsletter and no marketing email.
What we store about the sites you scan
Page titles, meta descriptions, headings, word counts, structured-data types, HTTP status codes, response headers relevant to crawling, and a text excerpt from each page we read. The excerpt is what lets us generate your llms.txt and run the answerability test.
We do not keep complete copies of pages, and we do not republish or resell anything we read. If you scan a site you do not own, be aware you are asking us to fetch its public pages on your behalf.
Language models
The models that write your report run on our own hardware. Your scan data is not sent to OpenAI, Anthropic, Google or any other model provider, and nothing you scan is used to train anything.
How long we keep it
Scans not attached to an account are deleted after 90 days. Scans in an account stay until you delete them or close the account. Rate-limit counters are transient. Ask us to delete your account and everything in it goes with it.
Who we share it with
Nobody, other than the service that delivers our email (Resend), which necessarily sees the address a message is sent to. There are no analytics scripts, no advertising pixels and no third-party embeds on this site.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to hello@citefiles.com and we will act within 30 days. Security reports go to abuse@citefiles.com.