What Scan.now knows about you
Short, because there is not much to say: Scan.now is designed to learn as little about you as it can while still working. Last updated 9 October 2026.
Who we are
Scan.now is operated by Targa Limited. Contact details are on the contact page, or you can email [email protected].
What we collect, by tool
| Tool | Stored | For how long | Not stored |
|---|---|---|---|
| Website, SSL, headers, email, JavaScript scanners | The target address, the results, your IP address and the country it comes from, kept with the report for abuse handling, and a daily-rotating hash of the address used for rate limiting | 30 days, then deleted with the report | Anything else about you or your browser |
| Public site relationship inventory | The registrable domain, scan dates and exact public analytics, advertising and tag identifiers exposed in page markup, such as Google Analytics, Google Ads or Meta Pixel IDs. This inventory is not tied to the visitor who requested the scan | Retained to recognise the same public identifier on later scans; removed on a verified site-owner request | Visitor IP addresses, cookies, generic page numbers, private credentials, API secrets, or a claim that matching domains have the same owner |
| LLM API key scanner | The target address, redacted findings, your IP address and country, and the account that ran a paid private-page, deep or bulk scan. Free and non-owner report views receive only the YES or NO projection, without provider or location | 30 days, then deleted with the report | Raw API keys found in responses; Authorization and Cookie values supplied for a private-page scan; files and results examined by the Premium local-folder scanner. Local-folder files remain in the visitor's browser and are not uploaded |
| Website-owner outreach audit | The submitted business email and site address, website-security findings, redacted LLM findings from the public page and linked client assets, SEO/content findings, delivery status, and report-link opens | The report for 30 days; contact and suppression records while needed to operate the outreach and honour opt-outs | Raw LLM API keys; unlinked LLM-secret paths are not probed by this workflow |
| File scanner and extension analyzer | The file's SHA-256 hash, size, filename and verdict; the report, with your IP address and the country it comes from, kept with the report for abuse handling | Hash indefinitely; report 30 days | The file. It is analysed in memory and discarded when the response is sent. |
| Browser check and WebRTC test | SHA-256 hashes of each fingerprint signal and of their combination, with counts | Indefinitely, as aggregate counts | The signal values, your IP address, your User-Agent |
| Phishing URL checker | The URL, the results, and your IP address and the country it comes from, kept with the report for abuse handling | 30 days | Anything from your browser: The link is fetched from our server |
| Email header analyzer | The derived verdict, sender domains, routing hosts and IP addresses, plus your IP address and country for abuse handling | 30 days, then deleted with the report | The raw pasted header, authentication signatures and message body. If a full original message is pasted, its body is removed before analysis and is not stored |
| Password checker | Nothing. Strength is computed in your browser; the breach check sends the first five characters of a SHA-1 hash, which we forward to Have I Been Pwned and cache | Prefix responses cached one hour | Your password, its hash, or the prefix tied to you |
| Signing in with Google | Your email address, the Google subject id for that address, whether Google reports it as verified, and the first and last sign-in times. Optional: Nothing on this site requires an account | Until you ask us to delete it | Your name, profile picture, contacts, or any Google data beyond the address. OAuth tokens are used once during sign-in and discarded, never stored |
| Certificate expiry reminder | Your email address, the hostname you asked about, and the certificate's expiry date. Only when you ask for it while signed in — we write only to addresses that signed in with Google | Until you unsubscribe; unconfirmed requests are deleted after 48 hours, and every watch after 400 days | Anything else. The address is never used for anything but this reminder, is never shared, and is deleted rather than flagged when you unsubscribe |
| Home-page activity feed | The scan type and the first octet of the source IP address. Until Scan.now reaches 2,000 unique visitors in one day, every target has about four fifths of its characters replaced by dots. After that permanent milestone, new website rows store and show the uncensored website origin; filenames and other non-web targets stay censored | 7 days | Your full IP address. URL credentials, paths, query strings and fragments are never stored in the activity feed |
| Daily visitor milestone | A SHA-256 hash of your IP address and the UTC date, used only to count distinct visitors toward the 2,000-in-one-day activity-feed milestone | 2 days | Your IP address in this counter; the hash changes at midnight and is not tied to activity-feed rows |
| Contact form | Name, email, topic, message and a hash of your IP address | Until resolved, at most two years | None |
Who can see it
The people who run Scan.now can see what the table above says is stored: scan targets and their results, the IP address and country each scan came from, public site identifiers, account addresses and plans, and contact messages, through an internal admin view. We use it to run the service: to spot and stop abuse, identify exact public signals reused across websites, answer support and removal requests, and see which tools people use. Nobody else has access, and IP addresses are deleted along with their report after 30 days. The country comes from our network provider, Cloudflare, not from anything on your device.
If you sign in
Signing in is optional for public single-site scans. Paid bulk scanning and owner-supplied authentication for a private page require a signed-in paid account.
What we store when you do
- Your email address and the opaque account identifier Google gives us, so the same account is recognised next time.
- Whether the account has a paid plan, and when it last signed in.
- The scans you run while signed in, linked to the account so your dashboard can list them for the 30 days reports are kept.
What we never receive
Your Google password, your contacts, your files, or anything else in your Google account. Sign-in is delegated entirely to Google; we ask only for your email address and see nothing else.
Deleting it
Ask through the contact form and the account row is deleted, along with any certificate-expiry reminders and monitored sites attached to it. Scans you ran while signed in are unlinked from it rather than deleted, so any report link you already hold keeps working until it expires on its own, 30 days after the scan.
The browser extension
The extension has no accounts, analytics or crash reporting. It handles cookies, page content, browsing hostnames and information about installed extensions locally for the features described below. None of that local data is transmitted automatically.
What stays on your device
- Your settings — keep-list, auto-delete delay, blocker state — in local extension storage, never transmitted.
- The cookies it reads, shown to you in the popup and not logged anywhere.
- The list of your other extensions, read the moment you open the audit tab and never sent.
Tracker blocking is declarative, so the extension is not in the request path and cannot see the requests it blocks even if it wanted to.
The actions that open Scan.now
Scan this site and Crawl the whole site open a Scan.now tab and send the hostname of the site you are on so the requested scan can run. Scan reports are stored for 30 days under the rules described above. Local LLM key audit opens the Premium folder scanner without passing a hostname, filename or file; folder selection happens later on Scan.now and remains inside that browser tab. The manual update check requests the public version file without credentials or a referrer. Nothing happens unless you press one of these controls. Source, checksums and the permission-by-permission reasoning are on the extension page.
The use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. It is used only to provide the extension's disclosed, user-facing features; it is not sold, used for advertising or credit decisions, or made available for humans to read except when required for security or law.
Cookies and tracking
Scan.now sets one session cookie, used to protect forms against cross-site request forgery. It contains no identifier that persists between visits. There is no advertising, and no third-party font or image on any page. Page views are counted by Matomo, which we host ourselves: the data goes to a server we run, is never sold or shared, and the tracker is started with cookies disabled, so it sets none and cannot follow you between visits. It is the only script on the site loaded from another origin. Server logs record request paths and status codes with IP addresses truncated after 24 hours.
Sharing
We do not sell or share personal data. The password checker forwards hash prefixes to Have I Been Pwned; the browser check uses a public STUN server (operated by Google) to discover WebRTC candidates, which is standard for any WebRTC test; the phishing checker may query Google Safe Browsing and public RDAP servers about the URL you submit, never about you. Candidate LLM API keys are not sent to their providers or any validation service.
Your rights
Under the GDPR, UK GDPR, CCPA/CPRA and similar laws you may ask what we hold about you, ask for it to be deleted, or object to processing. Because most data is hashed or aggregate we may be unable to link it to you, in which case we will say so. Contact us through the contact form. We honour Global Privacy Control signals, though there is nothing on this site that they would need to switch off.
Reports about third-party sites
Reports are stored at unguessable links, excluded from search engines and deleted after 30 days. A small domain inventory and supported public tracking identifiers are retained separately so an exact identifier reused on another scanned domain can be recognised. A shared identifier is presented only as a possible relationship, never proof of ownership. If you own a site and want its reports or inventory removed, use the contact form with the domain or report link.
Changes
Material changes will be dated at the top of this page.
