Privacy Policy

Short version: no accounts and no marketing email. We use analytics and advertising cookies, but only after you accept them in the banner. Decline and we keep only what is strictly necessary to run and protect the scanner.

Last updated: 12 June 2026

Who we are

XEOscan is a free tool operated by Constantin Ungureanu. You can reach us through our contact page.

What we collect

• The URL you submit and the pages we fetch from it to produce a report.
• Scan results, stored so a share link works. These auto-expire after 7 days.
• Scan log: the scanned URL and a timestamp, for abuse prevention and aggregate usage statistics.
• Limited request metadata (such as IP address) used transiently by our host for rate limiting and bot protection.
• Contact form data you choose to send us: your name, email and message, used only to reply to you.
• Unlock email address, only if you choose to unlock the free Content scan: we store your email, the site you scanned and the time of the request, and we keep a small record that links your email to your unlock so it keeps working on future scans. Used to send you the unlock link and, if you reply, to talk to you. Never sold, never added to a marketing list.
• Analytics and advertising data, only if you accept cookies: usage and device data collected through Google Tag Manager, Google Analytics, Google Ads and the Meta (Facebook) Pixel, used to measure traffic and run advertising. If you decline, these do not load.

We do not require an account, we do not ask for payment, and we do not send marketing email.

Cookies and consent

We use one strictly-necessary cookie set by Cloudflare Turnstile to tell humans from automated abuse. This is always on because the site cannot function safely without it.

We also use analytics and advertising cookies through Google Tag Manager (which can load Google Analytics, Google Ads and the Meta / Facebook Pixel). These load only after you choose "Accept all" in the cookie banner shown on your first visit. We use Google Consent Mode, so until you accept, these tags are held in a denied state and set no advertising or analytics cookies. Choosing "Reject non-essential" keeps them off. You can change your choice at any time using the "Cookie settings" link in the footer.

Third parties

• Cloudflare: hosting, storage (Workers KV) and Turnstile bot protection.
• Google PageSpeed Insights: we send the scanned URL to Google to fetch Core Web Vitals. This is subject to Google's privacy policy.
• Google Tag Manager: loads our analytics and advertising tags, only after you consent.
• Google Analytics and Google Ads: traffic measurement and advertising. Subject to Google's privacy policy.
• Meta (Facebook) Pixel: advertising measurement. Subject to Meta's data policy.
• Resend: delivers our transactional email (the Content scan unlock link and contact-form notifications). Resend processes the recipient address and keeps its own delivery logs, subject to Resend's privacy policy.

We do not sell your data. Data is shared with the analytics and advertising providers above only when you have accepted those cookies.

Retention

Share reports and their data are deleted automatically 7 days after a scan. Scan-log entries are kept for a limited period for abuse prevention and statistics, then expire. Contact messages are kept only as long as needed to handle your enquiry. Unlock requests are kept for up to 180 days; the record that keeps your Content scan unlocked is kept until you ask us to remove it, because deleting it is what switches the unlock off.

Your choices

You can change or withdraw your cookie consent at any time using the "Cookie settings" link in the footer; declining stops analytics and advertising cookies from loading on your next page view. You can also ask us to delete a stored report, a contact message or your unlock email at any time: reply to any email we have sent you, or use the contact page. Deletion of your unlock email also removes your Content scan unlock. Because reports expire on their own within 7 days, most data clears without any action.

Changes

If this policy changes we will update the date above. Continued use after a change means you accept the updated policy.