Updated 18 October 2026
Privacy policy
Super Simple Site Security Check operates from British Columbia, Canada. This policy explains how information is handled when you use the tool.
What the tool processes
When you submit a scan, the tool processes the website address, scan status, timestamps and the public evidence collected for your report. Public evidence can include page addresses, response settings, software clues and relevant excerpts. Do not submit addresses containing passwords, access tokens or private information.
Why it is used
This information is used to run the scan, display results, provide downloads and associate your report with your browser session. The scanner also uses session, target-host and network-address information for scan limits and abuse prevention. Cloudflare processes the connecting network address. The gateway derives a keyed identifier from that address for abuse prevention and sends an authenticated visitor identifier to the backend; raw visitor addresses are not included in its transient request queue. People using the same network may share a scan limit. Requests to the website being checked may be visible in that website’s logs.
Cookies and browser storage
An essential session cookie, set to expire after seven days, keeps your reports associated with your browser. The server stores a hashed session token and session identifiers to control access. Opening the scanner can establish this session before you submit a scan. Browser session storage remembers the active scan and sharing controls. Clearing this storage or losing the session may remove your access to a report. The current interface does not include advertising or analytics tracking scripts.
Storage and retention
The scanner sets a seven-day retention period for scan jobs and reports. Shared summaries expire with the underlying scan. This describes report availability; it is not a promise that every log, backup or expired summary file is immediately erased. Primary scanning and report storage are on a VPS in Helsinki, Finland. ChatGPT Sites and Cloudflare provide private access and transient request routing; processing and storage can occur outside Canada, and Canadian data residency is not guaranteed. Transient routing records are normally removed after delivery or timeout; scheduled cleanup runs every five minutes and outages may delay removal. Expired summary files are removed on access or by scheduled cleanup. Encrypted off-server backups retain seven daily, four weekly and six monthly recovery points, so expired information may remain in a backup until rotation. A restored copy is checked for expiry before service resumes.
Sharing is your choice
Reports are not published automatically. If you choose to publish a summary, anyone with its link can view the website, assessment date, score and limitations. The public summary does not include the full technical evidence. While the summary is unexpired and you retain the originating browser session, you can unpublish it. Copies or downloads made by others cannot be recalled. Email sharing opens a draft in your email application; you decide whether to send it.
External services
The scanner requests public resources from the target website. Its integrations can download public threat feeds from GitHub and Hugging Face and query software-advisory services such as NVD and WPVulnerability. Software lookups can disclose detected component names or versions. If Google Web Risk is configured, selected site and redirect URLs are sent to Google for threat checks. Not every integration runs for every scan; availability is recorded in the report. The private deployment uses NVD, WPVulnerability and public threat/signature feeds as recorded in each report; Google Web Risk is not enabled. Advisory requests disclose detected product names or versions, not your private report. Hosting uses Hetzner, ChatGPT Sites and Cloudflare R2. Operational logs contain service status and safe error codes; they are not intended to store submitted URLs, report bodies or session cookies. Scanner service logs are limited to seven days and a 100 MB namespace budget; backup copies follow the recovery-point policy above. Links to other websites and your email application are subject to their own privacy practices.
Questions and requests
Privacy Officer · British Columbia, Canada. Contact email: hello@supersimplesecuritycheck.com. Operator: Super Simple Site Security Check. You may contact the Privacy Officer to ask about your information, request access or correction, ask about deletion, or raise a privacy concern. We may need to verify your identity before responding. Requests are subject to applicable law and any information we must retain. You may also withdraw consent where applicable; this may prevent further service use and does not override lawful retention requirements. If a privacy concern remains unresolved, you can contact the Office of the Information and Privacy Commissioner for British Columbia at info@oipc.bc.ca or www.oipc.bc.ca. Messages to this address are forwarded through Cloudflare Email Routing to the operator’s monitored inbox.