This policy covers Bot Appétit at botappetit.ai, a free tool operated by Milk Moon Studio (Pty) Ltd (“we”, “us”). It explains what we collect when you use the tool and what we do with it. For the rules of using the tool, see our Terms of Use.

You do not need an account to run a single-page scan, and we do not ask for your name or email to run one. A multi-page site scan needs an account, because it takes several minutes and we need somewhere to send the result.

Accounts

If you create an account we store your email address, the identifier from whichever service you signed in with (or a secure form of your password), the sites you have added as projects, and any domains you have verified as yours. We use these to sign you in, to show you your own scan history, and to tell you when a scan you asked for is ready. When you sign in we also store, with your account, the visitor IDs from your browser’s analytics cookies (named under “Usage analytics (PostHog)” below), so that our analytics tools can be matched to the same person.

We also keep the last day you were signed in, and your two re-scan choices. Thirty days after the last finished scan of each site in your account we scan it again, and unless you have switched that off we email you the result. If you have not signed in for about three months we email you once to say the re-scans will pause, and email you again when they do. Apart from the sign-in links and codes you ask for, which our sign-in provider sends for us, those are the only emails we send you: the result of a scan you asked for, the result of a monthly re-scan, and these two notices about pausing them. You can switch the re-scans and the result emails off on Your sites.

We do not sell any of this. You can delete your account at any time — under Manage account, then Security, in your account menu, or by emailing jakes@milkmoonstudio.com — and your email address, sign-in details, projects and site scans go with it, along with any share links you made.

Scan results are not deleted with your account, because they were never stored against you in the first place. Scan results are never linked to who ran them: the history of an address shows what was found and when, not who asked. Two people scanning the same page moments apart produce two entries that look identical, because the result is a fact about that page — not about either of them.

What we send to Google when you scan

When you run a scan you give us a web address. To produce your results we fetch that page the way a search engine would, and we send that web address to Google, which provides two parts of the report:

Google PageSpeed Insights — measures how fast the page loads.
Google Safe Browsing — checks whether the page is flagged as unsafe.

Please do not submit a web address that is itself confidential — for example a password-reset link, an unlisted preview, or an address with a token or an email address in it — because the address is shared with Google as described above. Scan the public address of a page rather than a private link to it.

What we keep, and why

To understand how the tool is used, to improve our checks, and to see how sites change over time, we keep a record of each scan. That record includes:

the web address you scanned, and the address it resolved to after any redirects;
the results we produced — the overall score and the outcome of each individual check;
general technical information about the request: approximate location (country and city), network provider, browser type (User-Agent) and language;
which platform the scanned site appears to be built on (for example Webflow or WordPress);
the date and time of the scan, and how long it took.

In our scan records we do not store your IP address, with or without an account. Where we need to recognise repeat use or detect abuse, we convert your IP address into a one-way, irreversible code (a salted hash) that cannot be turned back into your address. We keep that code, not the address. (PostHog, which counts visits, does keep IP addresses — see “Usage analytics (PostHog)” below.)

If your browser already carries our analytics cookies (Google Analytics or HubSpot — see “Cookies and analytics” below), we also record the identifier from those cookies with your scan, so we can tell how many separate people use the tool and recognise a returning visitor. This identifier comes from cookies that are already set; it does not name you, and we do not combine it with any contact details.

We also note where you came from when you first arrive on our site in a browser tab: the page that linked to us (the website only, not the page) and any campaign tags in the link, such as the utm_ parts or, for an advert, a Google Ads click identifier. Your browser keeps them for that tab only, and we record them with the scans you run in it, so we can see which channels bring people to the tool. They do not name you.

We rely on our legitimate interest in running, understanding and improving a free service as the lawful basis for keeping this information (section 11(1)(f) of POPIA; Article 6(1)(f) of the UK/EU GDPR). The records are not used to identify you as an individual, and we keep them for as long as the tool operates so we can measure change over time.

Scan links and page history

Every scan gets its own web address — a permalink — shown on the results page so you can save it or send it to a developer. Opening it shows that scan exactly as it was, without re-running it. These links do not expire, and anyone who has one can view that scan.

Results pages also show a history of the exact page scanned: earlier scans of that same address, with their dates and scores. This history is visible to anyone who scans, or holds a link to, that exact address — including scans run by other people. It covers only the one address, not the rest of the site.

Where we can tell from our analytics cookies that a scan was run in your browser, we may also show you other pages on the same site that you scanned. That list is shown only to you; other visitors never see which pages you scanned.

We only ever scan pages that are already publicly reachable, and we ask search engines and AI crawlers not to index scan links. If you would like a particular scan removed, email jakes@milkmoonstudio.com with the link and we will delete it.

A multi-page site scan is a collection of page scans, and the collection is private to the account that ran it. Nobody else can list the pages in it, and it is not linked to from anywhere on this site. This matters because you can paste addresses we could not have found on our own — an unlisted page, a staging address — and being scanned must not make them discoverable.

The owner of a scan can create a share link for it. The link carries a random, unguessable token, and anyone who has it can read that whole report without an account — which is the point: the person who has to fix the findings is often not the person who ran the scan. We ask search engines and AI crawlers not to index these pages, and we do not publish them anywhere.

Only the owner can create or remove a share link. Removing it takes effect immediately — the old link stops working for everyone the moment you stop sharing, and it cannot be turned back on: creating a new one issues a new token. We never show a share token to anyone opening the report, only to its owner.

Individual page results still behave as described above: they belong to the address, not to you, and anyone who scans the same address sees the same history. What a share link changes is access to the collection — which pages were scanned together, and the site-wide score over them.

Copies of scanned pages

To test that our checks keep working correctly, we sometimes keep a copy of a page we scanned — the HTML and the small files a search engine would read, such as robots.txt. We keep these only where a page is different enough from ones we already hold to be useful as a test case, so most scans are never copied.

These copies are used solely to re-run our own checks against a page we have already seen, so we can tell the difference between our scanner changing and a website changing. They are never published, shared, or made searchable, and we do not use them to train anything. We only ever copy pages that are already publicly accessible.

If you would like a copy of your page removed, email jakes@milkmoonstudio.com and we will delete every copy we hold for your site.

Anti-abuse checks (Cloudflare Turnstile)

Before each scan we run an invisible check that confirms you are a real person using a real browser rather than an automated script. You will not see a puzzle or a checkbox. To do this, Cloudflare Turnstile processes your IP address, information about your browser’s secure connection, your browser type, and our public site key. Cloudflare states that it cannot identify you personally from this. We have not enabled Turnstile’s “pre-clearance” feature, so it does not place a clearance cookie on your device. Cloudflare describes this service in its Turnstile Privacy Addendum.

Rate limiting

To keep the tool available, we count requests from your IP address over a rolling one-minute window and refuse requests above a set number. These counters are short-lived and are not used to identify you.

Cookies and analytics

We use Google Analytics, loaded through Google Tag Manager, to understand in aggregate how the tool is used. This sets cookies in your browser. We do not use these cookies to identify you personally, and we do not sell your data.

Usage analytics (PostHog)

We also use PostHog, on its European cloud, to see how the tool is used. In your browser it records the pages you open, what you click and tap (the button or link, never what you type), how far down a page you scroll, how quickly a page loads, and any error our own page code hits. It also records the actions that matter to the tool: starting a scan, seeing a result, opening a check, copying a link, opening the history or a comparison, ticking a checklist item, pinning a site, and clicking sign in, create account or “Book a call”. When something happens on our servers it also records that it happened: a page scan (the site’s hostname, the scores and verdict, whether it was blocked, whether the page had been scanned before, and how long it took), a site scan starting and finishing, a performance check, a site scan being shared, and an account being created or signed in to. It does not record the contents of a scan, the address you typed in full, or anything you type into a box. For people who sign in, and for anyone who books a call through the scanner, it does record an email address, as described below.

To tell visits apart, signed-in people are identified by their account’s ID. Everyone else is identified by an anonymous ID. PostHog keeps it in your browser’s local storage and in a cookie on milkmoonstudio.com, so a visit to www.milkmoonstudio.com and a scan here count as one visit; where Google Analytics has already given your browser an ID and PostHog has none yet, we reuse that one so a scan and the visit that made it line up. When you sign in, or book a call through the scanner, PostHog also receives your email address, and the Google Analytics and HubSpot visitor IDs from your cookies (HubSpot’s only if you have its cookie). None of these go to Google Analytics. For people with an account we also keep a few counts against that ID, such as when it was created and how many sites it has scanned, so we can see how the tool is used. We do not record sessions or screens.

PostHog receives and keeps your IP address. Your browser sends it to PostHog through an address on our own domain (z.milkmoonstudio.com) that PostHog runs, and PostHog stores the address those requests come from. We keep it so we can leave our own visits out of the numbers. This is separate from our own scan records described above, where we still do not store your IP address. Scans run by us are not sent to PostHog.

Bug reports and feature requests

When you send a bug report or a feature request from our report pages, what you write is published publicly on GitHub, as an issue in a public repository, where anyone can read it and search engines can index it. We post it for you, so you do not need a GitHub account, and nothing links it to you. Leave out anything private. The same applies if you choose to post on GitHub yourself.

The reply email address is optional. If you give one, we keep it privately, apart from the issue, only so we can write back about that report. It is never put on GitHub, and we delete it when you ask. The issue itself says only that a reporter left an email for a reply. To have a published report removed, email jakes@milkmoonstudio.com.

Who else is involved

The tool runs on Cloudflare, which serves the site, provides the anti-abuse check, and hosts the scan records described above. Google provides the performance and safety checks and the analytics. PostHog provides the usage analytics described above. GitHub hosts the public issues that bug reports and feature requests become. Each processes data on the terms of its own privacy policy.

Your rights

Under POPIA and the GDPR you have rights over your personal information, including to ask what we hold and to ask us to delete it.

If you have an account, you can ask us what we hold about you and ask us to delete it, and we can act on that directly.

If you scan without an account, the records we keep are not tied to you as a named individual — our scan records hold no name, no email, and no reversible IP address — which can make a specific record impossible for us to single out. PostHog’s visit counts do include IP addresses, as described under “Usage analytics (PostHog)”. If you have a concern, contact us and we will help as far as we reasonably can.

Changes

We may update this policy. The date at the top changes when we do. Because the policy lives with the tool itself, it is kept current with what the tool actually does.

Contact

Milk Moon Studio (Pty) Ltd — jakes@milkmoonstudio.com

Privacy policy