Privacy policy

Short version: we do not ask who you are, we do not sell anything to anyone, and scan data is deleted automatically within minutes.

What we collect when you run a scan

• The URL you submit. Used to perform the scan and cached with its result for 15 minutes so repeat scans are instant. Then deleted.
• Your IP address. Held only in memory and in a short-lived rate-limit counter, so that no single visitor can overwhelm the service. Not written to any permanent log.
• Screenshots. Stored for 60 minutes, then deleted.

We do not require an account, and we do not ask for your name or email address to use any of the three tools.

Uptime monitors

If you register a URL for continuous monitoring we store the URL, the check results (status code and response time) and a one-way cryptographic hash of your IP address. The hash lets us show you your own monitors without ever storing your actual IP. It cannot be reversed back into an address.

Check history is kept for 30 days and then deleted automatically. You can remove a monitor at any time from the uptime page, which stops all future checks.

The contact form

If you contact us we keep your name, email address and message for as long as it takes to answer you and to keep a record of the issue. We use it only to reply. It is never added to a marketing list.

Cookies and analytics

This site sets no cookies and runs no third-party analytics, advertising or tracking scripts. There is nothing to consent to, which is why you are not being shown a cookie banner.

Third parties we pass data to

When you run a scan, the URL you submitted is shared with:

• Google PageSpeed Insights — to obtain the Core Web Vitals for the performance tool. Google receives the URL being tested and is subject to its own privacy policy.
• Our screenshot provider — to render the page image on the uptime tool. It receives the URL being captured.

Neither receives your IP address or any information about you — only the public URL being tested. We share nothing with anyone else.

Fonts and stylesheets

The site loads its font and CSS framework from public CDNs (Google Fonts and jsDelivr). Your browser therefore connects to those services when you load a page, and they can see your IP address as a consequence of serving the file.

Your rights

Because we hold almost nothing that identifies you, there is usually nothing to request. Where we do hold data — a monitor you registered, or a message you sent — you may ask us to delete it by emailing hello@websitestate.com. If you are in the EEA or UK you also have the rights of access, rectification, erasure and objection under the GDPR.

Security

Scans are performed only against publicly reachable addresses. We refuse to connect to loopback, private or reserved IP ranges, which protects both our infrastructure and yours.

Changes

If this policy changes we will update the date at the top of this page. Material changes will be announced on the homepage.