Privacy

What a scan stores

• the scan record: scanned URLs, host, score, check results, request user agent and timestamps, kept for up to 12 months for operations and abuse review;
• the private report link, accessible for 30 days from the scan;
• evidence artifacts such as screenshots, HTML, axe results and extracted text, kept for 7 days in private object storage;
• a one-way HMAC hash of the requesting IP for rate limiting and abuse review, cleared after 30 days. The application database does not store the raw IP. Infrastructure request logs may contain IP addresses for a short period set by the host's log rotation.

Reports are private links, excluded from search results, and artifact access uses short-lived signed URLs. On request we remove the report and its artifacts.

What we do not collect

CrawlWise does not create accounts and does not ask for an email address to run a scan. It does not use analytics, advertising trackers, third-party scripts or cross-site tracking pixels.

If you email the safety contact, we receive the address and whatever you include in the message. We use it only to handle that request.

Error reports

When the application or the scanner hits an unexpected error, the server sends an error report to Sentry (Functional Software, Inc.), stored in Sentry's EU region. A report contains the error, the code location, the request path and, for scan errors, the scanned URL. It does not contain IP addresses, cookies or request bodies, and private report links are removed before it is sent. Nothing runs in your browser.

Cookies and local storage

The application sets a first-party session cookie (_web_session) so forms can show validation errors and to protect submissions against cross-site request forgery. It is encrypted, Secure, HttpOnly and SameSite=Lax, is not used to identify or track visitors across sites, and expires when the browser session ends.

Reports, screenshots and measurements are generated on the server; the page does not run analytics code in your browser.

Private reports and removal

A report is reachable only through its long private link. If the link is lost, it cannot be recovered; run a new scan instead. To remove a report before it expires, use the report abuse page and include the report link and target page. We aim to respond within 48 hours.

Contact

CrawlWise is operated by ImagineIT. Questions about this page, removal requests and security reports: contact@crawlwise.dev.

For how CrawlWise behaves when scanning a site, see report abuse.