Privacy Policy

Short version: no accounts and no marketing email. We use analytics and advertising cookies, but only after you accept them in the banner. Decline and we keep only what is strictly necessary to run and protect the scanner.

Last updated: 19 May 2026

Who we are

XEOscan is a free tool operated by Constantin Ungureanu. You can reach us through our contact page.

What we collect

• The URL you submit and the pages we fetch from it to produce a report.
• Scan results, stored so a share link works. These auto-expire after 7 days.
• Scan log: the scanned URL and a timestamp, for abuse prevention and aggregate usage statistics.
• Limited request metadata (such as IP address) used transiently by our host for rate limiting and bot protection.
• Contact form data you choose to send us: your name, email and message, used only to reply to you.
• Analytics and advertising data, only if you accept cookies: usage and device data collected through Google Tag Manager, Google Analytics, Google Ads and the Meta (Facebook) Pixel, used to measure traffic and run advertising. If you decline, these do not load.

We do not require an account, we do not ask for payment, and we do not send marketing email.

Cookies and consent

We use one strictly-necessary cookie set by Cloudflare Turnstile to tell humans from automated abuse. This is always on because the site cannot function safely without it.

We also use analytics and advertising cookies through Google Tag Manager (which can load Google Analytics, Google Ads and the Meta / Facebook Pixel). These load only after you choose "Accept all" in the cookie banner shown on your first visit. We use Google Consent Mode, so until you accept, these tags are held in a denied state and set no advertising or analytics cookies. Choosing "Reject non-essential" keeps them off. You can change your choice at any time using the "Cookie settings" link in the footer.

Third parties

• Cloudflare: hosting, storage (Workers KV) and Turnstile bot protection.
• Google PageSpeed Insights: we send the scanned URL to Google to fetch Core Web Vitals. This is subject to Google's privacy policy.
• Google Tag Manager: loads our analytics and advertising tags, only after you consent.
• Google Analytics and Google Ads: traffic measurement and advertising. Subject to Google's privacy policy.
• Meta (Facebook) Pixel: advertising measurement. Subject to Meta's data policy.

We do not sell your data. Data is shared with the analytics and advertising providers above only when you have accepted those cookies.

Retention

Share reports and their data are deleted automatically 7 days after a scan. Scan-log entries are kept for a limited period for abuse prevention and statistics, then expire. Contact messages are kept only as long as needed to handle your enquiry.

Your choices

You can change or withdraw your cookie consent at any time using the "Cookie settings" link in the footer; declining stops analytics and advertising cookies from loading on your next page view. You can also ask us to delete a stored report or a contact message at any time via the contact page. Because reports expire on their own within 7 days, most data clears without any action.

Changes

If this policy changes we will update the date above. Continued use after a change means you accept the updated policy.