Privacy policy

Site Check is a free tool run by CherryRank. For the personal data described on this page we decide why and how it is used, which makes us the controller under data protection law (the GDPR).

Questions about privacy go to info@cherryrank.com. You can also reach us through the CherryRank contact page.

Site Check has one job: you type a website address, we scan it, and you get a plain-language report and a PDF. There is no account, no email address and no payment. When you start a scan we store:

• The address you typed, so we know which site to scan and which report belongs to it.
• A scrambled version of your IP address. It is a keyed hash made with a secret key (HMAC). We never store the IP address itself, and the stored value cannot be turned back into it.
• The findings of the scan, which is what you see on the results page.
• The PDF report made from those findings.
• Timestamps and the outcome: when the scan started and finished, and whether it worked.

If you never run a scan, we store nothing about you.

Our legal basis is legitimate interests (Article 6(1)(f) of the GDPR). In plain words: we have good reasons to use this data, and we have kept it small enough that it should not cut across your interests. The reasons are:

• Giving you the scan you asked for. We need the address to run it and the findings to show you the result.
• Keeping the tool fair and safe. The scrambled IP address lets us limit how many scans one visitor can start and stop abuse, so a free tool stays free for everyone.
• Scanning publicly available pages. The pages we read are ones the site owner chose to publish for anyone to visit.

We do not use any of this for marketing, advertising or building profiles of visitors. Because we rely on legitimate interests, you have the right to object. See your rights.

We use your IP address for one thing: counting how many scans each visitor starts, and keeping the tool safe from abuse. These limits apply:

• Each visitor can start 3 fresh scans per hour and 10 per day.
• There is also a global daily cap on fresh scans across all visitors.
• Each website is scanned at most once per day. Anyone else who asks for it that day is shown the stored result.

The scrambled value is stable, so two scans from the same connection look the same to us. That is what a limit needs, and we do not use it for anything else.

The scanner reads a small, bounded number of public pages of the website you name. It identifies itself honestly to the servers it visits, and it respects an opt-out block list that also covers a blocked site’s subdomains.

Public pages can contain personal data that the site owner published, for example a name on a contact page. The scan is about how a site looks to search engines and AI assistants, not about the people mentioned on it. Findings may quote small parts of public pages. Those quotes are kept for the same 30 days as everything else, and no longer.

If you own a website and do not want it scanned, write to info@cherryrank.com from an address on the site’s domain and we add the site to our block list. If you are named on a site that was scanned and want something removed, write to info@cherryrank.com.

Every scan gets its own result link. The link is unguessable and search engines are asked not to index it, but anyone who has the link can view the report until it is deleted. Share it only with people you want to see it.

Scans, findings, PDFs and the scrambled IP values are deleted automatically 30 days after the scan finishes, by a job that runs daily. Once a scan is deleted, its link no longer shows a report.

We keep nightly backups of the database for 14 days so we can recover from failures. A deleted scan can therefore stay in a backup for up to 14 more days before the backup itself is removed.

These providers process data for us, only to run Site Check:

• Hetzner Online rents us the server in the European Union that hosts this website, runs the scan and renders the PDF. Like any host, it receives your IP address when your browser asks for a page. CherryRank operates the software on it.
• Cloudflare provides the Turnstile human check when you submit an address. Per its Turnstile Privacy Addendum, the check looks at signals such as your IP address, TLS fingerprint and browser user agent. Cloudflare acts for us in providing the check, and as its own controller for improving its bot detection.
• A self-hosted database on a server rented from OVHcloud and operated by CherryRank holds the scan records described above.

Cloudflare is a US company, so the human check can involve processing outside the European Economic Area. Cloudflare relies on recognised safeguards for that, such as the EU-US Data Privacy Framework and standard contractual clauses.

We do not sell your data, share it with advertisers or data brokers, or run analytics or advertising trackers.

We set no cookies of our own. The site keeps two small notes in your browser so it works, and Cloudflare’s human check runs there too. Because nothing optional is stored, we do not ask for consent. The details, and how to clear them, are in the cookie policy.

Under the GDPR you can ask us to:

• Give you access to the personal data we hold about you.
• Correct data that is wrong.
• Erase data, which also ends the report link.
• Restrict how we use data while a question is being settled.
• Stop using data that we hold because of our legitimate interests (the right to object).
• Hand over data you gave us in a portable format, where that applies.

To use any of these, write to info@cherryrank.com. We answer within one month. Because we store your IP address only in scrambled form, we may be unable to tell which scans are yours. Please send the result link of the scan you mean, and we will find it from that.

If you are unhappy with how we handle your data, you can complain to the State Data Protection Inspectorate (VDAI), or to the data protection authority where you live.

Site Check is meant for business owners and is not directed at children under 16. We do not knowingly collect personal data from them.

When this policy changes, we update the date at the top of the page. If a change is significant, for example a new provider or a new use of data, we also say so on this page.