Privacy Policy

Site Passport is operated by Agentic Tech LLC (Atlanta, GA, US). This page explains what we collect when you use the free scan or submit a site to the directory, and what we deliberately don't collect.

The free scan

When you paste a URL and click Scan, we fetch that site live (llms.txt, robots.txt, and homepage schema.org markup) and return the result to you, in your browser, immediately. We do not store the URL you scanned or the result. The only thing retained is a short-lived, per-IP rate-limit counter (see below) — there is no scan history, no account, and nothing tying a scan to you personally.

Submitting a site to the directory

"Submit to Directory" is a separate, deliberate action from the free scan. If you use it, we store the site URL and the optional category you provide, along with the score, grade, platform tag (whether the origin looks like WordPress from the outside), and category results pulled directly from that site's own public files. If the site is verified, this information is displayed publicly on the directory page and on that listing's embeddable badge. We re-fetch on a schedule to keep the listing current, and automatically delist a site after repeated failed re-checks — see the methodology page for exactly how that works. We do not require a login, password, or contact email to submit a listing.

If you submitted a site and want it removed, email [email protected] and we'll take it down. Operators who have claimed a listing can also hide it themselves from that listing's page.

Claiming a listing

Claiming is optional. If you choose to claim a listing, we send a one-time code to the email address you provide, which must be at the listing's own domain. We store that email against the listing so we can recognize you as the operator (session cookie, listing administration, and operational mail such as a later "your grade changed" notice). We do not use it for marketing, and we do not show the full address on the public listing — only that the listing is claimed.

Bot protection

Scan, submit, and claim are protected by Cloudflare Turnstile, a browser check that distinguishes people from bots. Cloudflare receives the check token and your IP address to verify it; see Cloudflare's Privacy Policy. We do not use Turnstile on the MCP endpoint that agents call.

Video embed

The homepage explainer video is not loaded until you click play — until then, only a static thumbnail image from YouTube's image CDN (i.ytimg.com) loads, with no cookies or tracking script. Clicking play loads the video from youtube-nocookie.com, YouTube's privacy-enhanced embed mode; see Google's Privacy Policy.

Suggesting a tool for the Solutions page

The form on the Solutions page is protected by Turnstile, same as scan/submit/claim. We store what you enter (tool name, URL, category, description, and your email if you give one) purely to review the submission — nothing is published automatically. Every entry is added to the page by hand, or not at all.

Rate limiting

To keep the scan and submission endpoints usable for everyone, we keep a short-lived counter tied to your IP address (via a one-way hash, not the raw address) purely to enforce a per-hour request limit. This counter is not linked to any scan result, directory listing, or any other data, and entries fall out of the window automatically — there is no long-term IP log.

Analytics

This site uses Google Analytics (GA4) to understand aggregate traffic — pages visited, referral source, rough location and device type. Google Analytics sets its own cookies in your browser; see Google's Privacy Policy for how Google handles that data. We don't combine analytics data with directory or scan data.

Infrastructure

The site is served through Cloudflare (CDN and bot/abuse protection) and hosted on a server we control directly. Standard web server access logs (IP address, requested URL, user agent) are kept briefly for security and debugging purposes, consistent with normal web hosting practice, and are not used for tracking or shared with third parties beyond what's needed to operate the service.

What we don't collect

• No passwords — claiming uses a one-time email code, not an account signup
• No payment information — the service is free
• No contact details required to scan a site or submit a listing (only if you claim)
• No persistent record of what any individual visitor has scanned

Your rights

If you're in the EU/UK or anywhere else with data-access rights, you can ask us what data we hold about a directory listing you submitted or claimed, correct it, or have it deleted, at any time — email [email protected]. For unclaimed listings, most requests will simply be "remove this listing," which we'll act on directly.

Changes to this policy

If this policy changes in a way that affects what we collect or how, we'll update the date at the top of this page.

Contact

Questions about this policy: [email protected].