Trust and data handling
Privacy
You can run the basic OpenForBots public website audit without an account or email address. Signing in is optional and is used only when you choose to save audit history and use account controls.
Last updated: .
Audit requests
When you run an audit, OpenForBots sends bounded requests to the public hostname and standard public resources you submit. Optional delivery diagnostics can also request the same-site public paths you explicitly provide. A focused tool may request a specific public same-site page when that page is the evidence target—for example, the Recipe structured-data checker can inspect the recipe page URL you enter.
Audit report storage
Completed homepage/site audits are stored as versioned report snapshots. The stored record includes the hostname you submitted, the site's final public URL after any redirects it issued, the check timestamp, report status metadata, and the generated report. The index is kept in a Cloudflare D1 database and the report snapshot is kept in a Cloudflare R2 bucket. Raw fetched page HTML is not intentionally stored as a separate long-term page archive.
Page-targeted focused diagnostics, such as a Recipe check against a specific public recipe path, are not added to the normal saved-site audit-history store in the current release. This keeps page-level diagnostics from being compared with homepage audits as though they were the same evidence target.
An audit that remains anonymous and unclaimed is automatically and permanently deleted, including its index row and report snapshot, no later than 30 days after the check completes. Deletion is enforced by a scheduled retention process.
If you sign in and explicitly save an audit to your personal history, that saved audit is associated with your account and is no longer subject to the anonymous 30-day cleanup. Saved audit history remains available until you delete the individual audit, delete the saved site and its audits, or delete your account.
Optional accounts and sign-in
OpenForBots currently supports optional third-party sign-in for saved audit history. GitHub and Google are the enabled sign-in providers. The basic public audit does not require sign-in.
When you sign in, OpenForBots processes the identity and session information needed to authenticate you and associate saved sites and audit history with your personal workspace. OpenForBots does not offer a separate password-based account flow in the current release.
From the account area, you can export your account data, delete an individual saved audit, delete a saved site and its audit history, or permanently delete the whole account. Account deletion removes the personal workspace and saved audit data and removes the OpenForBots identity and session records used for that account.
Information processed
The service processes the hostname or public page URL you submit, public response metadata, bounded public response content needed for the requested check, the generated findings, and routine technical metadata needed to deliver and secure the request. If you choose to sign in, it also processes the account and session information needed for the optional saved-history features described above.
Contact, feedback, partnership, and remediation messages
Contact, feedback, and partnership messages continue to use the same protected message path. If you choose to use any message form, including an audit remediation request, OpenForBots processes the fields you submit so the message can be reviewed, the product can be improved, and a reply can be sent where appropriate. Depending on the form, this may include your name, reply email, organization, role, organization website, selected topic, optional experience rating, message text, and for a remediation request bounded technical context such as remediation family, capability ID, and finding rule ID. The pre-filled remediation request link and message form do not intentionally place the audited hostname, evidence text, credentials, or fetched content into the message.
Public forms use Cloudflare Turnstile and Cloudflare-hosted request handling to reduce automated abuse. Turnstile and related infrastructure may process IP addresses, device or browser signals, timestamps, and security metadata needed to evaluate the request. Form notifications are delivered to a controlled OpenForBots inbox through Cloudflare email infrastructure. OpenForBots does not use submitted message content to build advertising profiles.
Do not submit credentials, private URLs, access tokens, customer data, confidential reports, unpublished vulnerability details, or other sensitive information through ordinary contact forms. Remediation access, backups, authorization, and rollback are agreed separately after a request is qualified. Security reports should follow the security-reporting guidance.
Messages and related email records may be retained for as long as reasonably needed to answer the enquiry, maintain a correction or support record, prevent abuse, or meet operational and legal obligations. OpenForBots does not currently promise a fixed deletion interval for ordinary correspondence.
Operational logs and infrastructure
OpenForBots is delivered through Cloudflare infrastructure. Cloudflare and related hosting systems may process IP addresses, timestamps, request paths, user agents, network diagnostics, security events, and error logs according to the service configuration and Cloudflare's applicable terms. OpenForBots does not currently promise a specific infrastructure-log deletion interval.
Cookies and analytics
OpenForBots does not currently use advertising cookies or build cross-site marketing profiles. Essential authentication, security, or delivery features may use cookies or equivalent browser storage when technically required.
OpenForBots counts selected product usage in aggregate: for example, how often a tool or audit is started versus completed. Each analytics event is limited to a fixed, pre-approved set of coarse labels, such as the tool, audit focus, success or failure, a general error category, and the day it happened. Those counters do not include the audited hostname or URL, fetched page content, robots.txt content, generated remediation, IP address, user agent, referrer, cookies, or account or visitor identifiers. The analytics counters are separate from the audit snapshots, account data, and routine infrastructure/security processing described elsewhere on this page.
Public results
Audit output reflects public evidence available at the time of the check. Results are displayed in your browser and may also be retained as described above. They are not a guarantee of indexing, citation, ranking, recommendation, traffic, or model use.
International processing
Cloudflare and the enabled sign-in providers operate services across multiple regions, so routine request, security, authentication, and account data may be processed in countries other than the one from which you use the service, subject to the applicable provider safeguards and terms.
Your choices
Do not submit private hosts, credentials, URLs containing secrets, personal data that is not already intentionally public, or content you are not authorised to assess. You can use the basic public audit without signing in. If you choose to save history, the account area provides export and deletion controls for saved audits, saved sites, and the whole account.
You do not need to use a web form to contact OpenForBots. Published support, feedback, partnership, and remediation email routes are available on the relevant pages.
Changes and questions
Material changes to this notice will update the date above. Use the published contact routes for privacy questions or corrections. Do not place sensitive security information in a public issue; use the private security-reporting route.