Privacy

Who to contact

AEO Test operates this service. For questions about your data or requests to access, correct, or delete information, email contact@aeotest.ai. Include the relevant report link when you have one, but do not send passwords or access tokens. We may need information to locate the record and verify that the request relates to you.

Scans and shared reports

We fetch the URL you submit and supporting files from the target website. Reports store the submitted and final URLs, page title, findings, scores, performance measurements, and evidence excerpts. New reports also save a readable plain-text preview of up to 6,000 characters and 60 text blocks, plus up to 300 characters each for the detected title, description, author and organization declarations. The full fetched HTML is not saved in the report database. URLs and excerpts can contain personal information if it appears on the scanned page. Do not submit passwords, access tokens, private documents, or signed links.

Anyone with a report link can view it. Reports are not account-private and the app does not require authentication to open them. Report pages are marked noindex and omitted from the sitemap, but this is not an access restriction. Take care when sharing links or downloaded reports.

Reports expire after 30 days. We also keep scan attempt records for 30 days to investigate failures and improve checks: the target origin and path, timing, response statuses, errors, and a summary of results. Query strings and fragments are removed from the diagnostic URL fields; the report itself can still contain them. Expired database records are removed in scheduled batches, so physical deletion may follow expiry.

Browser history and scan limits

Your browser keeps up to 20 recent report summaries in local storage, including their links, website URLs, titles, dates, and scores. This list stays in that browser until you clear it or the browser removes site data. Use “Clear local history” on Recent reports to remove it. Clearing local history does not delete shared reports from the server.

To enforce the scan limit, the server hashes your IP address into a network identifier. It keeps that identifier and a scan count for a two-hour quota window; expired quota records are removed in scheduled batches. People on the same network may share this limit. The hash is not sent to our analytics service.

Services involved in a scan

Cloudflare hosts the app and stores reports and diagnostics in D1. It processes network requests, including IP addresses and browser headers, to deliver and protect the service. See Cloudflare’s privacy policy.

We send the final scanned URL to Google PageSpeed Insights for mobile performance measurements. Google fetches that page to run its test. The scanned website also receives our requests for its public page and supporting files. See Google’s privacy policy.

Cookieless analytics

We use Umami Cloud to count page visits, scan starts, results, cancellations, and report downloads. Our integration sends fixed app page names, the referring site’s origin, and event names. It does not send submitted website URLs, report IDs, report contents, scores, query strings, or error messages. It does not use analytics cookies, session replay, or account identification.

Umami receives the IP address and browser headers associated with analytics requests and processes visitor, session, device, and approximate location statistics. Its storage is separate from our 30-day report database. See Umami’s privacy policy.

The tracker does not load when your browser signals Do Not Track or Global Privacy Control. Blocking the analytics script also leaves scanning available. We do not use this integration for advertising profiles or cross-site tracking.

Your choices

Use public URLs without sensitive information, share reports only with people you intend to, and clear local history on shared devices. You can download your report before it expires. The app currently has no account or self-service server deletion control.

This notice describes the current service. When data handling changes, we will update this page. See the terms of use for the conditions of running scans.