// Privacy

Privacy

Last updated 2026-07-22

MachineRead's free audit is anonymous. There is no account, no API key, and no email required to run a scan. This is a deliberate design choice due to the cost ceiling the project operates under (under $20 per month in compute), which makes account infrastructure and persistent storage impractical for the free tier. As a result, the audit collects the minimum data needed to function, and that data is transient.

What the audit collects

The URL you submit is the only user input. It is fetched server-side, scored against 13 check groups and 56 checked points, and the result is returned to your browser. The URL string itself is not stored in a database. It is used in memory for the duration of the request, then discarded. Meaning the audit does not build a profile of sites you have scanned, does not retain a history of your audits, and does not link your activity across sessions.

It is through this server-side fetch that the audit score is computed. The backend validates the URL, blocks private IP ranges to prevent SSRF abuse, fetches the homepage, robots.txt, and sitemap, runs the checks, and returns the JSON response. In other words, the URL goes in, the score comes out, and nothing persists in between.

Log retention

The audit server keeps request logs for 24 hours. These logs contain the submitted URL string, a timestamp, and the response status. The 24-hour window exists for two reasons: rate limiting (the audit endpoint is throttled to 3 requests per minute per IP) and abuse detection (if someone is scanning hundreds of sites in a burst, the logs are how that pattern surfaces). After 24 hours, the URL string is dropped from the logs. The logs are not permanently archived and are not shared with third parties.

Agent surfaces

The 4 agent-readable surfaces (llms.txt, ai-catalog.json, api-catalog.json, and openapi.json) are static files served from the static export. They do not execute code, do not collect data, and do not track who reads them. They are public reference documents for AI agents and crawlers to discover what MachineRead does and how to call the audit API.

Contact form

The contact page uses a mailto link to [email protected]. The email is delivered through Migadu Micro to a personal Gmail inbox. It is not stored on any MachineRead server. However, once the email leaves the mailto link, it is subject to the email provider's own infrastructure, which is outside MachineRead's control. If you prefer not to use email, there is no alternative contact channel at this time.

Ko-fi and third-party services

The support link on the site points to Ko-fi, which is a third-party service. Ko-fi's own privacy policy applies to any interaction on their platform. MachineRead does not process payments, does not store payment information, and does not receive transaction data from Ko-fi beyond a notification that a contribution was made.

Tracking and analytics

There are no tracking cookies, no analytics scripts, and no fingerprinting. The static export is served as plain HTML, CSS, and JavaScript. There is no client-side telemetry. The only server-side data is the 24-hour request log described above.

My recommendation is straightforward: if you want to audit a site without leaving a trace, the free Essentials audit is designed for exactly that. The URL goes in, the score comes out, and after 24 hours even the log entry is gone.

Questions about this policy: [email protected]