What you type
Every idea typed into the box is stored, along with the time, the page you came from and your browser's user agent. It is stored whether or not it produced a report — including when it was refused as spam or as too short.
This is the most useful data the site collects. It is read to find out what people come here to ask and which questions are answered badly. It is not shared with anyone.
Do not paste anything confidential. Your text becomes a page at its own address. Pages made from visitor text are unlisted — kept out of the site index and the sitemap, and marked so search engines skip them — but anyone holding the link can read them.
Your address
Your IP address is used to enforce the daily limit on checks. It is hashed before it is written down and the raw address is never stored, so the table can be counted but not reversed into a list of visitors.
A cookie, not an account
One cookie is set, sw_sid. It holds a random identifier, lasts a year and cannot be read by JavaScript. It exists so the site can group your visits and show you your own history on the your checks page. It carries no name, no email and nothing that identifies you off this site.
What you do on a page
Which sections of a report you scroll to, how long you stay on them, which source links you click, and whether you rate a page useful. This is recorded because the whole question behind the site is whether people come for the evidence or for the opinion, and that cannot be asked in a survey.
Your email, if you give one
An account exists for one reason: so credits you paid for survive a cleared browser. If you sign in, the address is stored, along with your balance and every credit that has moved in or out of it.
Your password is never stored. What is stored is a scrypt hash of it with a salt unique to your account, which cannot be turned back into the password — not by us, and not by anyone who takes a copy of the database. Use a password you use nowhere else anyway.
Mail goes to that address in three cases and no others: a reset link when you ask for one, a note about a payment you submitted, and a digest for an idea you chose to watch. No newsletter, no product mail. The address is never sold, shared or passed to an advertiser. Ask and the account and its address are deleted; the ledger rows behind a completed payment are kept as an accounting record, with the address removed.
Sign-in attempts are recorded — the time, the address tried, whether it worked and a hashed IP — and kept only to cap how fast a password can be guessed.
Payment screenshots you upload are stored on the server and readable only by an administrator. They are not published, not linked from any public page, and are deleted with the account.
Third parties
Yandex Metrica runs on every page for traffic analytics and sets its own cookies; it records page interactions, including session replay. Google Search Console receives no visitor data — it reports on search results only.
The text of your idea is sent to OpenAI to produce the report, and to the search and data sources named on the how it works page. Nothing else leaves the server.
Removing something
Ask and any page made from your text will be deleted, along with the query that produced it. There is no account to close and no export to request, because nothing is stored that identifies you. Write to smartscan.tools@gmail.com.
Last updated 6 August 2026.