Privacy policy

01Who is responsible#

Data controller: Root92 sh.p.k., NIPT (Albanian tax ID) M52111038D, Don Bosko, Njesia Administrative Nr.11, Zyre F-101, shkalla F.kati , ambienti 1, Tirane, Albania.

For any request about your data, write to: info@root92.it.

02What we collect, exactly#

When you ask for the surface check — the form with your app’s address — we store one row with these fields and nothing else:

• url — the address of the app you asked us to check.
• email — the address we reply to. We need it to answer you, so the form is not sent without it.
• problem — which of five fixed codes you picked (slow, security, cost_lockin, ownership, other). We store the code, not the translated label.
• lang — the language the page was in, so we answer you in it.
• consent, plus the timestamp of the row and the version of the consent text you read (currently en-2026-10). This is the proof that you authorised the scan.
• detections — the technical result of the check: which technologies were detected, which security headers were present, sizes and timings. A short technical summary only. Never page content, never any data from your database.
• score and the status of the scan.

When you send the form, the same details (the email address you entered, the app URL, the problem code and the scan outcome) are also emailed to us so we can answer you. That email goes through our email delivery provider and is set up so that a reply goes straight to your address.

If you use the “Write to us” form instead, we store what you typed there and nothing else: your first name and last name, your phone number (only if you give one), which service you are asking about, your message, your email address and the language of the page. This site keeps it as a contact request so we can answer you, for as long as described under “How long we keep it”. At the same moment your message is emailed to our team through our email delivery provider, set up so that a reply goes straight to your address, and you receive a short confirmation at the address you gave.

That is the whole list, for both forms. There is no field for anything else, so there is nothing else to collect by accident.

We have put in place appropriate technical and organisational measures to keep your data secure.

03Your IP address#

Your IP address is used for two things, and they are separate.

• Rate limiting, so the tool cannot be used to overload someone else’s site. The limits are 20 checks per hour per IP address and 3 per hour against the same target host.
• A record of checks: every check leaves one row saying which domain was checked, when, from which IP and browser, and its outcome. This is how we tell misuse from ordinary use before we decide to block anyone, instead of blocking real customers on assumptions.

We keep that record for 12 months — see “How long we keep it”.

Like any web server, ours also writes technical logs of each request, and they include your IP address. Those are kept for a much shorter time — see “How long we keep it”.

04Cookies and similar technologies#

This site uses one statistics tool and nothing else: no advertising pixels, no social-media widgets, no other tracking scripts. It runs only if you accept it in the cookie banner. The fonts are served from our own servers, so no third party learns that you visited.

When you only visit the pages or run the surface check and don’t answer the banner, this site stores nothing in your browser: no cookies, no local storage, no session storage. Everything it can store is in this list, with when it appears, what it is for and how long it stays:

These items are set by this site only. They track nothing and are never shared with anyone. The cookies in the list cannot be read by scripts on the page (HttpOnly), travel only over an encrypted connection (Secure) and are not sent along when another site loads something from this one (SameSite=Lax). If local storage is blocked in your browser, your answer to the banner is kept in a cookie instead, with the same name and the same content: your choice and its date, nothing else.

Each of them is needed for something you asked for — remembering your answer to the banner, or a verification you started — so they need no consent (Article 5(3) of the ePrivacy Directive, Article 122 of the Italian Privacy Code).

There is a cookie banner, and it asks about one thing only: visit statistics. Everything in the list above works whatever you answer. You can change your choice at any time from “Cookie settings” in the footer, as easily as you gave it.

Emails we send you are plain text. They contain no tracking pixels and no tracked links.

If we ever add another cookie, or a tool that stores something in your browser or tracks visits, we will update this page first and, where the law requires it, ask for your consent before it runs.

Visitor statistics

We count visits with a statistics service that we run ourselves on a server in the European Union. It sets no cookies. It runs only after you accept it in the cookie banner: before your choice, and if you refuse, it is not even loaded.

When it runs, it reads, for each page you view:

• the address of the page, without anything after “?” or “#”, and the page title;
• the site you came from, also without anything after “?” or “#”;
• your browser, operating system and type of device, your screen size and your language;
• the country, region and city, estimated from your IP address.

It turns your IP address and browser into a code that changes every day, so that a visit is counted once without knowing who you are. The service does not store your IP address. It never counts the owner area or the verification page, nor which site you checked. If your browser sends “Do Not Track”, nothing is sent at all.

We only look at totals. The data is kept for 12 months and then deleted. Nothing is shared with other companies.

The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time from “Cookie settings” in the footer, as easily as you gave it (Article 7(3) GDPR): from that moment nothing more is sent, on the page you are on too, without reloading it.

05Ownership verification#

If you verify that a site is yours before a deeper check, a few more things are involved. None of them happens unless you start a verification.

• A session cookie, HttpOnly, valid for 24 hours, or 24 hours from the moment you prove ownership if that comes later. It exists only so you can close the page and come back; when it ends, a proved ownership is not lost, and in the owner area you confirm your email again to pick it up; it is strictly necessary for the service you asked for, and it is not used for tracking.
• The hostname you verify, the method you chose, and the outcome of each check (for example “found” or “not found yet”). We never store the token, the codes we send, or the links in our emails.
• Before the proof, the email address you enter to receive a 6-digit code. The code is valid for 10 minutes and one use. To deliver it, the address and the code pass through our email delivery provider, which keeps a copy of the message as part of its delivery logs.
• If you prove ownership, the email address you then give us, so we can send you a one-time code and know whom to answer.
• Your IP address, for the same two reasons described above: rate limits and the record of checks.
• If you tick the source-map box of the deeper check: for each exposed key we find, its type, the file path, the line number and a shortened fragment. They become part of the report summary. Never your code and never the whole key.
• If you tick the code-composition box of the deeper check: the paths of the files that look unused or are included more than once (with user names removed from them), the names and versions of those libraries, and their sizes in bytes. They become part of the report summary. Never your code.
• If you tick the box for accessibility on rendered pages: the paths of the pages we opened (never their query string) and, for each, only measurements — check results, counts, and how many requests to other services the isolated browser could not make. They become part of the report summary. Never the content of your pages. The browser starts with no cookies and no stored data, and is destroyed with everything it loaded when the check ends.
• If you tick the network box of the deeper check: for the requests your home page made while it ran in the isolated browser, the method, the address without its values (an identifier in the path is replaced by its kind, for example “number” or “email”), the names of parameters and headers, the third-party hosts, how many times each request repeated, and the kind of personal data a value looked like (for example “email”). The values themselves are read only inside the isolated browser, to recognise that kind, and are never kept. To judge the page’s performance, the browser also measures how many bytes each response transferred, its file type, the protocol it came over and whether it was compressed, when the first content and the largest element appeared and how much the layout moved, and counts in the loaded page the images set to load late, the stylesheets that hold back the first paint and the @import and font rules: only the yes/no results of fifteen checks are kept, never the numbers. They become part of the report summary. For now those fifteen checks are switched off, and until they are switched on none of their results is kept. Never the content of your pages. The browser starts with no cookies and no stored data, and is destroyed with everything it loaded when the check ends.
• If you tick the breach box of the deeper check: how many accounts on your domain appear in known breaches, and in how many breaches. Never the addresses and never the names of the breaches. If the breach database first asks for proof that the domain is yours, we keep the DNS record value it gives us, so that you can publish it.
• If you tick the public-code box of the deeper check: for each public file that names your domain next to a key, the repository, the path, the link and the type of key. Never the code and never the key.
• With the report summary we store the version of the consent text you accepted and which boxes you ticked, so that each report shows by itself what you authorised.

The verification details — the proof of authorisation (hostname, method, times, the email address, the consent text versions), the report summary and the record of checks — are kept as described in “How long we keep it”. If you verified from the owner area, ownership stays valid for 90 days from the first successful proof, even if you close the page or the browser; if you verified from the verification page alone, there is no way back to it once its session ends, so it lasts 24 hours from the proof. After that, the verification stops authorising anything and is erased automatically, with its proof, report summary and record of checks. Our internal dashboard reads it from here and keeps no copy: for a report email it only notes whether it went out, without your address or the report.

06Report by email#

Once the deeper check has run, you can ask us to email you that report. Nothing is sent unless you press the button.

• It goes only to an address that has been confirmed: the address of the account you signed in with, if you verified by signing in with your search-engine account and that provider marks it as verified; or, if you verified with DNS, a file or a meta tag from the owner area, the address you confirmed there with a 6-digit code — the same address you started the verification with; another address, even if confirmed, is refused. You cannot type an unconfirmed address, and we do not send it anywhere else. If you verified from the verification page without the owner area, there is no confirmed address, so this option is not offered.
• With DNS, a file or a meta tag, the address is kept only if you ask for the report: it is added to the verification at that moment, and kept with the proof of authorisation as described in “How long we keep it”, so that the report goes only to the address you confirmed.
• Just before sending, we check your proof of ownership again. If it is gone, nothing is sent. You can request the report up to 3 times an hour. If our email provider refuses it, nothing has been sent and you can try again.
• The email is a copy of the audit report you see on the page: the same sections, findings and details of the deeper checks you agreed to, plus the scores and the steps to fix each finding. Findings the page shows only as a number appear only as a number in the email too, and any secret stays redacted. It is sent from our own mailbox (see “Who else sees it”).

We record that you asked, when, and the outcome of the delivery, together with the rest of the verification, as described in “How long we keep it”.

07Repeating checks#

After the deeper check you can ask us to repeat it on the same site at regular intervals and to write to you only if the result changes. Nothing repeats unless you press the button, and one schedule covers one site.

• It needs the email address you confirmed with the 6-digit code in the owner area, for that site. We use it only to tell you that the result changed; the message contains no findings, only the site name, a link to the owner area and a link to stop the alerts.
• Each repeated check is the same deeper check, with the same limits per site, and only while your proof of ownership is still valid. If the proof is gone, the schedule stops.
• You can stop it at any time with one button in the owner area, or from the link in each alert, on any device. Stopping deletes the address. In any case the schedule stops when the verification expires, 90 days after the first proof, and the address is removed from it then.
• The alert is delivered by our email delivery provider, which keeps a copy of the message as part of its delivery logs.

08Why we are allowed to do this#

There are separate operations here, each with its own legal basis. They are deliberately not merged into one sentence.

• Running the scan on the app: your consent as its owner, or as someone authorised to have it analysed. That is the checkbox, and it is why we record which version of its text you read.
• Each part of the deeper check that has its own box (rebuilding source maps, analysing the code’s composition, searching known breaches, searching public code, reading real speed, reading the domain registration, searching known vulnerabilities, analysing the secure connection): your consent, given with that box. Without it, that part does not run and nothing is sent to the service it uses.
• Contacting you afterwards about the full audit: legitimate interest in business-to-business communication, with your own request for the report as the context.
• Keeping the record of checks described above: legitimate interest in the security of the service. A tool that reaches other people’s sites has to be able to show who asked it to, and to notice when it is being misused.
• Counting visits with the statistics tool: your consent, given in the cookie banner (Article 6(1)(a) GDPR), which you can withdraw at any time from “Cookie settings”, as easily as you gave it (Article 7(3) GDPR).

09How long we keep it#

For the surface check and the “Write to us” form — the contact details we reply to, your message and the result of the check: 24 months from when you sent them. Then our hourly job erases them automatically.

For the record of checks, with your IP address and browser: 12 months from the check. Then our hourly job erases it automatically.

For the server’s technical logs — your IP address, the time, the page requested and your browser: up to 14 days, then they are deleted automatically. We use them only to keep the service running and secure, never to build a profile of you.

We keep no backup copies of the database. When we delete your data, no older copy of it remains with us; the last traces in the technical logs disappear within 14 days.

You can ask us to delete any of this sooner (see “Deletion and opting out”).

For the ownership verification — the proof of authorisation, the email address linked to it, the report summary and the record of checks: 90 days from the first successful proof. Then the verification expires and our hourly job erases it automatically. A verification made from the verification page alone, without the owner area, lasts 24 hours from the proof, because nobody can come back to it after that. A verification that was never proved is erased when its 24-hour session ends.

Our internal dashboard keeps no copy of these details: it reads them from here while they exist. The only things it writes are our own working notes about your request — its status, a name we type, whether you asked not to be contacted, whether an email to you went out, never your address.

We have put in place appropriate technical and organisational measures to keep your data secure for as long as we hold it.

10Who else sees it#

We don’t sell your information to anybody. The only other parties that handle it are the services below, each named with what we use it for, and only to run the service for us. Before we add a service, or use one for a new purpose, we name it here first.

Our hosting provider, which runs the server and the database of this site, in Germany, inside the European Union. The server’s technical logs stay in the same place. It also hosts our visitor statistics tool, on a server in the European Union.

An email delivery provider, which delivers the messages this site sends (the form notification to us, the verification code, the contact form, the repeating-check alert). It keeps a copy of each message in its delivery logs for 30 days.

Our email provider, which we use to reply to you, and to send you the report when you ask for it.

Only if you prove that a site is yours by signing in with your search-engine account: that search-engine provider, for the sign-in and for its tool for site owners. It tells us the email address of your account and, read-only, the list of sites you manage in that tool, so that we can check that the site is one of them. If it is not, or your access to it is not that of an owner, we keep that address and what we found for 60 minutes, only to show you the result, and remove them within the following hour. You can withdraw that access at any time with the disconnect button, or from your account with that provider.

Only if you tick the breach box of the deeper check: a public database of known data breaches, to find out whether email accounts on your domain appear in them. We send it your domain name and nothing else. It answers with the affected addresses: we count them and keep only two numbers, never the addresses and never the names of the breaches.

Only if you tick the public-code box of the deeper check: a public code-hosting platform, to find out whether your domain appears next to secret keys in public code. We send it your domain name as a search term (on a builder subdomain, the full address of your site) and nothing else. Of each matching file we keep the repository, the file path, the link and the type of key, never the code and never the key.

Only if you tick the real-speed box of the deeper check: a public dataset of speed measurements from real visitors, published by a browser maker, to find out how fast your site is for real users. We send it the address of your site and nothing else. It answers with aggregated, anonymous figures for the last 28 days: we keep five speed measurements and their rating, never data about any single visitor.

Only if you tick the domain-registration box of the deeper check: the public directory of domain registrations, to read when your domain expires and how it is protected. First we download the public list of which registry runs each domain extension, and that request says nothing about you; then we ask the registry of your domain’s extension. We send it your domain name and nothing else, and never for a site on a builder’s subdomain. Of the answer we keep the registrar’s name, the creation and expiry dates, the domain status and whether DNSSEC is on, never the details of the domain holder.

Only if you tick the known-vulnerabilities box of the deeper check: an open database of security advisories for software libraries. For each library we recognise on your site we send its name and exact version and nothing else: not the address of your site, not your domain. Of each advisory we keep its identifier, its severity, its short title and the versions that fix it.

Only if you tick the secure-connection box of the deeper check, and only if the server is yours and not a shared platform: the public list of sites that browsers open only over HTTPS, to find out whether your site is on it. We send it your site’s hostname and nothing else. We keep only the answer (on the list, pending, or not) and, if it is on the list, which entry covers it.

The breach database, the code-hosting platform, the real-speed dataset, the security-advisory database and the HTTPS list are based outside the European Union, and the registry of your domain’s extension may be too. Each receives only what its entry above says, and only for a deeper check where you ticked its box.

11Your rights#

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. You can also object to the commercial follow-up.

You can also ask us to limit what we do with your data while a request is being checked, and to receive the data you gave us in a common machine-readable format. Where we rely on your consent, you can withdraw it at any time; this does not affect what we did before you withdrew it.

If you think we handle your data unlawfully, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, where you work, or where the infringement took place.

Send all of these requests to one address: info@root92.it. We answer within one month, as the GDPR requires.

12Deletion and opting out#

To have your data deleted, write to info@root92.it and we will delete what we hold about you. To stop us contacting you, write to the same address. We handle these requests by hand: a self-service button would be more convenient, and until we offer one, email is the way to do it.