privacy
Privacy
This describes what the system actually does. Where it says something is not kept, that is a property of the code and not a policy someone can quietly relax.
Effective 17 August 2026 · AIFindUs · Ottawa, Ontario, Canada
What is collected when you run an audit
An audit needs one thing: the URL you paste. You do not need an account and you do not need an API key.
If you are not signed in, your IP address is recorded so that anonymous audits can be counted — ten per address per hour. It is used for that and nothing else, it is returned by no endpoint, and it is deleted on the next request that arrives more than two hours later. If you are signed in, no address is recorded, because your account is already the thing being counted against.
The audit result itself is stored against your account if you were signed in, and against nobody if you were not. An anonymous result is readable only by whoever holds its id, and appears in no listing.
What is collected when you sign in
Your email address, so a six-digit code can be sent to it. The code expires in ten minutes and survives five wrong attempts. The IP the request came from is kept alongside it to rate-limit sign-ins, and is deleted when the code is pruned.
A successful sign-in creates a session that lasts 45 days. It is an opaque token, it is stored as a row rather than as a signed claim, and “sign out everywhere” deletes every one of them in a single statement.
What is deliberately not kept
Server access logs you upload are never stored. They are parsed in memory to answer one question — did a named crawler actually fetch your pages — and nothing from them is written to disk. Your visitors’ IP addresses are counted and are never returned by any endpoint. This is asserted by the test suite, not only by this paragraph.
The text of your pages is not retained after an audit. A stored snapshot is under a kilobyte and deliberately excludes the crawled content, which is why an old audit cannot be re-rendered as a PDF. That limit is the cost of not keeping your site’s text, and it was chosen knowingly.
API keys are never returned. Any key you configure is reported only as present or absent.
Card details never reach this server. Payment happens on Stripe’s own page. What comes back is a confirmation that a payment succeeded, and how many credits it was for.
Sites we fetch
When you audit a site, this system fetches it. It identifies itself truthfully as AIFindBot with a contact URL, honours that site’s robots.txt for its own requests, waits at least 750ms between requests to the same host, and stops at 40 URLs and 8 MB.
It sends a real AI crawler’s user-agent in one place only: the access probe, where sending that user-agent is the measurement — the entire point being to observe what your server returns to it. It does not do so anywhere else.
A site’s logo is captured once during the crawl so a report can carry it. The renderer has no network access at all.
If you own a site and would rather it were not fetched, disallow AIFindBot in your robots.txt and it will stop, or write to roydell2b@gmail.com.
Others who process this data
- Stripe — payments. They receive what a payment requires; we receive a confirmation.
- An email provider — delivers sign-in codes. Login is email-only, so if that provider is down, sign-in is down.
- Answer-engine APIs — only when you run a paid measurement, and only the questions in the prompt set you approved before it ran.
Your data
Write to roydell2b@gmail.com to ask what is held about you, to correct it, or to have it deleted. Most of the answer is already above: for an anonymous audit the answer is an IP address for under two hours, and for an account it is an email, a session and a ledger of what was bought.
Changes
The date at the top is when this last described the system accurately. It is bumped when behaviour changes, not when wording does — a version that moves for a rewritten sentence tells a returning reader nothing.