What we collect, where it goes, and how long it stays.
This page is written from the tables the service writes to. Where it says something is not collected, that is a statement about the code.
Two analytics tags
Since 17 September 2026 every page loads Cloudflare Web Analytics without asking: a script from static.cloudflareinsights.com that reports a page view to cloudflareinsights.com. It writes nothing to your device and does not try to recognise you elsewhere, so there is no cookie to consent to. Cloudflare already serves every page here, so the request tells it nothing new about you.
Since 14 September 2026 the site can also load Google Analytics 4, but only after you press Allow analytics on the banner. Until then, and permanently if you decline, nothing is fetched from Google and no cookie is set. Declining is stored so you are not asked again, and dismissing the question counts as declining. The cookies page names the two cookies, what they hold and how long they last.
There is no tag manager, advertising or remarketing tag, A/B testing tool, session recorder or heat map, with consent or without. Google signals is switched off, so nothing feeds cross-device or advertising audiences.
The Content Security Policy allows googletagmanager.com and static.cloudflareinsights.com in script-src, because a browser decides what it may fetch before anyone is asked for consent. Our own script decides whether to ask about the first; the second is always in the page. No other vendor can load code here.
To check, open your browser's network panel on a fresh visit. Nothing is requested from Google until you answer, and the Cloudflare beacon goes out immediately.
If you run a free scan
The only required input is the web address to scan. We store the address, the host, the scan result, and the rendered sheet so the link to your result keeps working.
A scan is kept for seven days and then deleted, not archived or anonymised, and the link stops working. The delete runs whenever a later scan runs, not on a separate schedule. To keep a sheet, save the page. The seven days are stated on screen during the scan and in the email if you asked for one.
The scan box has an optional email field. Unless you tick the box beside it, the address is held in memory only long enough to send you the link and is not stored anywhere. If you tick it, we keep three things: the address, when you consented, and a random unsubscribe token that is not derived from the address. Every message has a one-click unsubscribe link; unsubscribing marks the row unsubscribed rather than deleting it, so an old export cannot restore it. Either way we record a rate-limit label: the first sixteen hexadecimal characters of a SHA-256 of the address keyed with a secret (a plain hash of an email address can be reversed by guessing), so one address cannot be sent unlimited sheets. Like every rate-limit row, it is deleted after two days, longer than the longest window it counts.
We do not store your IP address. For rate limiting, the service keeps the first twelve hexadecimal characters of a SHA-256 hash of the connecting IP, stored like ip:3f9a1c7e04bb. That is enough to count requests from one source and not enough to recover the address or identify you. It is deleted after two days.
A scan reads only what any visitor to the scanned site could read. It submits no form, signs in to nothing, and makes no request that changes anything.
If you ask for an audit
The form asks for your name, email address, the site to audit, the tier, and any notes. The message is emailed to the operator and stored with the same hashed request token described above and whether the email was delivered.
The contact form works the same way: your name, email address and message are emailed to the operator, stored on the same terms, and deleted on the same schedule.
Your email address is used to answer you and to send the report you paid for. It is not added to a mailing list, sold, rented, or shared outside the processors named below.
If you pay
Stripe handles payment on its own pages. We never see, receive, or store a card number, expiry, or security code.
For a purchase we store the Stripe session identifier, the tier, the site to be audited, your email address, the Stripe customer and subscription identifiers, who attested they were entitled to have the site audited and when, whether the audit has been fulfilled, and the token for your report link.
Who else touches it
Four services, each for one job:
- Cloudflare hosts the site, serves every page, and holds the database. All stored data described here lives in Cloudflare D1. Cloudflare also receives the page-view beacon on every visit, whatever you answer to the analytics question.
- Stripe takes payment and holds the card details under its own privacy policy.
- Resend delivers the email carrying your request to the operator and your report to you.
- Clerk signs you in, if you use the account area to find a report you bought.
Google is a fifth only if you allow analytics. A request to Google carries your IP address, as any request does, and Google's terms govern what it does with it. We do not control that, which is why we ask before the tag loads.
There are no others. Your browser does not contact a font host: typefaces are served from this origin, and the Content Security Policy's font-src and style-src directives are 'self', so fonts and stylesheets from anywhere else are refused.
If we audit your site
An audit reads public pages. It does not sign in, submit forms, or collect personal data from your site beyond what any visitor sees. The crawler identifies itself in its user-agent string on every request, respects robots directives, and works within published limits on pages, depth, size, redirects and time.
The captured responses are the evidence for the findings and are kept with the audit. Raw captures are not published unless you are the site owner and asked us to publish the audit. Every report carries a retention date, and the report link expires ninety days after delivery.
Getting it deleted
Email privacy@citeunseen.io and say what you want removed. A scan result, an audit request, or a completed audit and its evidence can all be deleted on request, and we will confirm when it is done.
Only two things survive a deletion request: records Stripe must keep for tax and financial reporting, held by Stripe, and the fact that a payment occurred where accounting law requires it.
Changes to this page
The date at the top is when this version took effect. A change to what the service collects should update this page in the same change. If this page and the service disagree, that is a defect; please tell us.