Privacy

Last updated 21 October 2026. Publisher: Corsen AI (corsen.ai). The scanner is free and has no accounts.

What a scan stores, and for how long

• The address you scan, reduced to its origin and path — query strings and fragments are removed before anything is fetched or stored.
• The report built from the public page: headers, discovery files, tools the page registered, scores and recommendations.
• Retention: one hour. A report is deleted one hour after the scan at the latest, and as soon as the person who ran the scan closes it (the page holds a deletion key that only that browser has). A report is visible only to people who have its link; it is never listed, never in the sitemap and marked noindex.
• Daily counters of scans and renderings, without any visitor information, to protect shared capacity.

What we do not store

No account, no cookie, no analytics tag, no IP address with the reports. To limit abuse, the scanner counts requests per network address in memory only, for one minute, never on disk. The web server keeps no access log for this site; its error log, shared with the server, can contain an address and is rotated after 14 days.

Cloudflare

The site is delivered through Cloudflare. The scan form uses Cloudflare Turnstile, an invisible check that a person is using it; it runs in your browser under the Turnstile privacy addendum. Cloudflare processes requests under its own privacy policy.

How pages are scanned

The scanner fetches the page, /robots.txt, /llms.txt, /llms-full.txt and /.well-known/webmcp, then renders the page once in a sandboxed headless browser. It never submits forms and never executes WebMCP tools. Requests to private networks are refused. The user agent contains WebMCPScanner.

Removal and blocking

To delete a report before it expires, or to ask that your domain no longer be scanned, contact us from the contact page.