Back to home

Privacy Policy

What SiteXray collects when you run a scan or contact us, and how long we keep it.

Last updated: 2026-10-22

Summary

SiteXray is a passive website vulnerability scanner. You can use it without an account. We collect as little as we can and do not sell personal data.

When you run a scan

  • What we receive: the domain or URL you enter, your IP address and browser user agent (as any web server does), and your confirmation that you are allowed to test the site.
  • What we fetch: public pages and files of the site you entered, as described on the homepage. We do not log in, submit forms or collect personal data from the scanned site.
  • What we keep: the report is held in server memory for about five minutes so repeated scans do not hit the target again, then discarded. Detected secrets are masked before the report leaves the server. We do not store scan reports in a database.
  • Abuse prevention: we apply rate limits and may keep short-lived server logs (IP address, time, target domain) to stop the scanner being used against sites without permission.

When you contact us

If you send the contact form, we store your name, email address, website and message so we can reply and, if you hire us, deliver the service. We keep these records for up to 24 months after our last contact, or longer if required for accounting.

Accounts and payments

If you create an account, we store your name, email and login method. Payments are processed by our payment provider; we never see or store full card numbers.

Cookies and analytics

We use cookies that are needed for sign-in, language and theme preferences. Analytics or advertising cookies are only loaded after you allow them in the privacy choices panel, and you can change that choice at any time from the footer.

Service providers

We use hosting (Vercel), a database provider, an email provider and, if you pay, a payment processor. They process data only to run the service.

Your rights

You can ask us to access, correct or delete the personal data we hold about you by writing through the contact form. We will reply within 30 days.

Changes

We will update this page when our practices change and show the date at the top.