Privacy policy
Last updated 12 November 2026.
Who is responsible
Sitewalk is run by Aditya Sharma, India, who decides how your data is used. Contact: contact@
What we collect, and why
- Your email address, if you sign in. To send the sign-in code and link, to send the emails described below and to identify your account. Reason: to provide the service you asked for.
- The addresses you audit and the reports made from them. For each audit we keep the findings and, for each page it read (up to 5,000), the page's address, status, title, description, headings, word count, response time, language, canonical and robots settings, redirects, a content fingerprint used to spot duplicate pages, its list of images and counts of its links. We also keep a sample of up to 300 links to other sites, with their status. We do not keep the page's text or HTML. We use this to run the audit, to show you the report and, if you are signed in, to compare it with your last audit of the same site. A report made without signing in can be opened by anyone who has its link.
- Payment status for Pro. We keep your plan, its status, the paid-through date and your Dodo customer and subscription ids. Dodo Payments holds your payment details; we never see your card. You sign in before you buy Pro, and Pro is added to that account.
- Your IP address. We store it when you request a sign-in email and when you run an anonymous audit, to apply limits and to investigate abuse. Rate-limit counters that include your IP are deleted after 24 hours.
- Verified sites. If you verify a site you own, we store the site name and the verification token.
- Site monitoring. If you set it up, we store the site, how often it is checked, when it was last checked and when it is checked next. Reason: to run what you asked for.
- ChatGPT connection. Sitewalk stores a hashed access token for the connection until you disconnect it or it expires.
Emails
We email you the sign-in code you ask for. After you first sign in with a confirmed email, we send a short series of five getting-started emails over about a week; the first is a welcome. We also email you a notice when Pro is switched on, a notice if a payment fails, a notice when an audit you started from ChatGPT has finished, and one follow-up about 1 hour after your first audit of a site. Some of these emails may mention that a larger plan exists. These emails (not the sign-in code) include a small image that tells our email provider, Zoho ZeptoMail, when the email was opened, so we can count how many people see them and improve them. Turning off image loading in your email app stops it. We send no newsletters and no advertising. Dodo sends the payment receipt. When you start an audit from ChatGPT, we also email you once to say it has started, with the expected time and a link to follow its progress. If you set up site monitoring, we email you after a check only when something changed, such as a different health score, new issues, or the site could not be checked.
Every email except the sign-in code has an unsubscribe link. Use it to stop all of these emails; sign-in codes still arrive when you ask for one.
Cookies
One cookie keeps you signed in. It lasts up to 30 days or until you sign out. We set no other cookie, and our analytics set none either. See the cookie page.
Measuring how Sitewalk is used
We measure how people use Sitewalk so we can see which pages and steps help. We use two tools. Both run on our own systems, not on a third-party analytics service. Our analytics is our own Plausible only. We do not use Google Analytics or any other third-party analytics service. We do not use advertising trackers.
Plausible analytics, run by us. Plausible runs at analytics.adityaarsharma.com. Its script is on our public pages: home, getting started, SitewalkBot, the website crawler page, the Sitewalk for ChatGPT page, the comparison pages, sign-in, privacy, terms, refunds, cookies, no-sell and acceptable use. It is not on the admin pages, your account page, your reports or the ChatGPT plugin page. The script sets no cookies and writes nothing to your browser's storage. For each visit Plausible records the hostname and path of the page, the page you came from, campaign tags (UTM), your browser, operating system and device type, your approximate country, region and city, how far you scroll and how long you stay on a page, clicks on links to other sites, and downloads of files such as our sample report. Plausible's published data policy says it builds a daily identifier from your IP address, your browser's user agent and a secret that changes every 24 hours, and keeps neither the raw IP address nor the user agent, so the identifier cannot follow you from one day to the next.
Events sent from our server. Some actions happen where there is no page to tag, so Sitewalk's server tells Plausible about them: a sign-in code requested or used, an audit started or finished (on the web or in ChatGPT), a report opened, a CSV or PDF report downloaded, a Pro checkout started, and Pro switched on. For the ones that come from your request, the server passes your IP address and, where it has one, your browser's user agent to Plausible, so that Plausible can count unique visitors and hash them as described above. An audit finishing and Pro switching on have no visitor behind them, so they carry a fixed placeholder address instead of yours. Each event carries only the event name and short labels, such as web or ChatGPT, the plan name, or the site a clicked link goes to. It never carries your email address, the address you audited or a report id.
Our relay. Your account page, your reports and the page you land on after checkout carry no Plausible script. When you click a ChatGPT link or a link to another site there, or open the plan panel, your browser sends that event to our own server at /api/track, and our server passes it to Plausible in the same way. The relay accepts only a fixed list of event types, the page, a page label and, for a link to another site, the destination host.
Our own visit counter. We also count page views with a counter built into Sitewalk. It sets no cookies and stores no IP address and no user agent. It gives each visitor an anonymous id that changes every day. We keep the page, the day, whether you reached the pricing section, the host of the site that linked you (never its full address) and any campaign tags. If you sign in, the campaign tags and the referring host from your first visit are saved to your account. Your browser keeps two small notes for this in local storage; see the cookie page.
Do Not Track and Global Privacy Control. If your browser sends either signal, the visit counter and the page script that calls our relay send nothing and store nothing. If the two notes the counter keeps (sw_seen and sw_first) were saved earlier, they are removed the next time you load a page. Plausible's own script does not check either signal. The events our server sends about actions you take, listed above, are not switched off by them.
No selling, no sharing for ads
We do not sell your data, we do not share it for advertising, and we show no ads. Details on the no-sell page.
Who processes it
- Hetzner: hosting.
- Zoho ZeptoMail: sign-in and account email.
- Dodo Payments: Pro payments, tax, receipts and refunds.
- FluentCRM on adityaarsharma.com: the getting-started emails.
- Plausible, run by us at analytics.adityaarsharma.com: page and usage statistics, described above.
- Telegram: a private message to the operator with the email and the site audited, when someone signs up or starts an audit.
OpenAI is not our processor. When you use Sitewalk in ChatGPT, the audit results appear in your conversation, which OpenAI handles under your OpenAI terms. ChatGPT calls Sitewalk to run the audit.
How long we keep it
Reports are deleted 12 months after they finish. IP addresses stored with a sign-in request or an anonymous audit are removed after 30 days. Rate-limit counters are deleted after 24 hours. Accounts are kept until you ask for them to be deleted.
Your rights and deleting your data
You can download any of your reports as CSV or PDF. For anything else, or to delete your data, email contact@
Ask us for a JSON export of everything your account owns, or for deletion of the account and everything keyed to it. We reply within 30 days.
If you are in the European Economic Area or the United Kingdom, you have rights under the GDPR and the UK GDPR: access, correction, deletion, restriction, objection and portability. If you are in California you have the rights to know, delete, correct, and to opt out of sale or sharing; we do not sell or share. If you are in India you have rights under the Digital Personal Data Protection Act 2023: access, correction, deletion and grievance redress. Write to contact@
Lawful basis (GDPR, UK GDPR): contract (to run your account and audits), legitimate interest (limits, abuse prevention, operator alerts) and legal obligation (payment records are kept by Dodo). We have no EU representative.
For a complaint under the Digital Personal Data Protection Act 2023, write to contact@
Where data goes
The server is hosted by Hetzner.
Children
Sitewalk is for people aged 18 and over.
Crawled sites
When someone audits a site, the crawler reads that site's public pages and checks the size of the images on them with a HEAD request, which downloads no image, for images your robots.txt allows. It also sends up to 40 HEAD requests for the stylesheets and scripts those pages use, to the same site only, and up to 9 requests for site-wide files such as robots.txt and the sitemap. It also checks a small sample of the links on those pages that point to other sites, so a site linked from an audited page can receive, per audit, up to 3 link checks plus one read of its robots.txt from SitewalkBot. When the audit ends we ask the crawler to delete its working copy (best effort). Site owners can opt out through robots.txt. See SitewalkBot.
Contact
Sitewalk is run by Aditya Sharma, India. Contact: contact@