Awfully Helpful LLCWebsite Check

Privacy Policy

Effective date: November 4, 2026

This Privacy Policy explains what the Website Check by Awfully Helpful LLC (https://scan.awfullyhelpful.com) collects, why, who helps us process it, and how long we keep it. The Website Check is run by Awfully Helpful LLC, Minnesota, USA ("we", "us").

1. Who we are

2. What this covers

The Website Check site, its scans, sign-in, payments, the support inbox, and the emails it sends.

3. What we collect

When you ask for a scan

  • The web address you type. We keep it with the result.
  • A one-way, salted hash of your IP address, used only to count your scans against the daily limit. We do not store the IP address itself in our database.
  • The site's name, used to count scans of that site against its daily limit.

What a scan reads. A scan reads only what any visitor's browser can see on that page (section 1 of the Terms). We keep the counts by type for everyone, and the detailed findings for the site's owner. If a scan finds a secret key, we never store the key: we keep its first 7 characters, its length, and a short fingerprint.

When you sign in

  • Your email address (it is your account).
  • A sign-in link token and a session cookie. We store only one-way hashes of them, not the tokens.
  • A salted hash of your email address and of your IP address, used only to count sign-in emails against limits.

When you prove you control a site or a database (detailed reports)

  • The site name, your account, the proof method (DNS record or file), and the time.
  • For a database check: the database project you named and the tables you said are public on purpose. We use the public database key the page publishes and ask only for row counts. The database check does not read or keep rows. (While a page loads, its own scripts may fetch data; the scanner reads those answers only during the scan, to look for problems, and does not keep them.)

Payments. Stripe collects your card details. We receive only what Stripe sends us about the payment (for example amount, date, status, and your email), not your full card number.

Support email. Your message and email address. An AI system helps draft our replies (see section 7).

Logs. Our hosting providers keep technical request logs, which can include IP addresses, for a short time (We turned off Cloudflare's log of each request to our app. Our app's own log lines hold no IP address and are kept up to 3 days.) The scan server's own log records each scanned address; it keeps about 31 days.

We do not use advertising, analytics, or tracking cookies. We do not sell personal data.

4. Why we use it

Purpose Data Basis (where a law asks for one)
Run scans and show results the address you typed, scan results to provide the service you asked for
Stop abuse and keep limits salted hashes of IP and email, site name our legitimate interest in a fair, safe service
Sign you in and keep you signed in email, hashed tokens, session cookie to provide the service
Detailed reports and database checks proof of control, named database to provide the service, with your permission
Payments and receipts Stripe payment details to provide the service; tax and record laws
Answer support your message to provide the service

5. Cookies

We set one cookie, __Host-awfullyhelpful, only after you sign in. It keeps you signed in. It is needed for the service, so we do not ask for consent for it. It lasts up to 30 days, or until you sign out. No other cookies, and no local storage, are used.

6. Who processes data for us

7. AI

An AI assistant reads the email that comes to our mailbox, including support email. It sums up new messages for us and helps draft replies. It runs on Claude, by Anthropic. If Anthropic's system does not answer, it uses a backup AI system from OpenAI or one reached through OpenRouter. The assistant reads the whole message as you sent it: nothing is removed first. So do not send passwords, keys or card numbers by email. The assistant can not send email. A person reads every reply and sends it. The assistant can also read our daily review list (site names, order and payment references, and payment amounts). Scans do not use AI.

8. Where data is processed

Mostly in the United States. Some service providers (Telegram, and the backup AI systems in section 7) may process data in other countries. If you are outside the US, your data is sent to and processed in the US and possibly there. The Service is offered to people in the United States. We do not aim it at the EU or the UK.

9. How long we keep it

Data Kept for
Scan requests and results (in our database) deleted at the first daily clean-up after 30 days (so up to 31 days), except relevant report evidence under a purchase-review or other necessary hold
Rate-limit counters (salted hashes) about 2 days
Sign-in link records deleted at the first daily clean-up after 1 day (so up to 2 days)
Sessions work until sign-out or 30 days; the record is deleted at the next daily clean-up
Support email (in our mailbox and in our assistant's copy) deleted after 90 days, unless a purchase review or other necessary hold needs it
Your account (email) until you ask us to delete it, by email to support@awfullyhelpful.com
Proof of control and database permissions until you withdraw them, by email to support@awfullyhelpful.com
Copies on the scan server (job records, reports, raw scan output) deleted at the first daily clean-up after 30 days (so up to 31 days). A short record that links each job to our app's job number is deleted after 35 days (so up to 36 days). A job that is still waiting or running is kept until it ends
The scan server's log about 31 days (one log file a day; files older than 30 days are deleted)
Unused proof codes on the scan server deleted 4 days after they are made (they stop working after 72 hours)
Minimum paid-transaction, refund and accounting records seven years after the later due date or filing date of the relevant tax return; longer for an unresolved audit, dispute, legal hold or longer applicable requirement
Purchase-review request text and relevant database report evidence while the review is open, then until the first daily clean-up after another 30 days; longer only under a necessary hold. Normal customer report access still ends after 30 days. A minimal outcome stays with the accounting record.
Our app's log lines (no IP address) Cloudflare Workers logs: up to 3 days. Cloudflare's per-request log is off

We separate minimal accounting records from expiring operational orders and checkout links. Accounting deletion waits until the relevant tax-return dates are recorded; related sale and refund records stay together until all applicable periods end. Sandbox transactions are marked separately and normally kept for 31 days, subject to an active review or hold. Private working copies and correspondence follow the same review and retention rules.

10. Your choices and rights

You may ask us to show, correct, or delete your personal data, or to stop a database permission, by writing to support@awfullyhelpful.com or to the postal address in section 1. Depending on where you live, you may have more rights under your state's or country's law. We will not treat you differently for using these rights.

11. Security

We use reasonable steps to protect data: only hashes of sign-in tokens, sessions and IP addresses are stored; the scan server is walled off from the rest of our systems; access to our systems is limited. No system is perfectly secure, and we do not promise it is.

12. Children

The Service is not for children. We do not knowingly collect data from anyone under 18.

13. Changes

We may update this policy. We will post the new version here with a new effective date, and email signed-in users about important changes.

14. Contact

Email: support@awfullyhelpful.com. Post: P.O. Box 5, Eagle Lake, MN 56024, USA.