What we keep, and for how long.
Short version: running an audit needs no account and no email address, the report is deleted after 90 days, and you will never hear from us unless you fill in the contact form yourself.
When you run an audit
We store the URL you entered and the report we produced, which does not record who asked for it. Your IP address is used only to enforce the rate limit that keeps the free tool from being abused, in a request counter that deletes itself within two days. The report is deleted automatically 90 days after the audit runs, enforced by an expiry on the record itself rather than by someone remembering to run a cleanup.
Report links are unlisted, not secret
A report lives at a URL containing a random identifier. It is excluded from search engines and from AI crawlers, and there is no public index of audits. But anyone you send the link to can open it without signing in. Treat it like an unlisted document.
When you use the contact form
Your name, email address, company and message reach us along with a link to the audit they came from and the IP address the request came from, which helps us block spam. We use them to reply to you about that request, and we keep them until you ask us to delete it. We do not sell them or add you to a mailing list. Outside Red Cloud, only the providers below handle them, on our behalf.
Who else sees this
DigitalOcean hosts the server that runs the site, in Toronto, Canada, and processes the requests that reach it. Supabase stores the reports and contact requests, in a database only our server can reach. Resend delivers the email that tells us about a contact request, with your details in it. Sentry receives a report when our server hits an error, which can include server log lines with an IP address but never what you typed into the contact form. Cloudflare Turnstile, when it is switched on, checks that the audit and contact forms are used by a person and not a bot: your browser loads the check from Cloudflare, which sees your IP address and browser details, and our server sends Cloudflare the check's result and your IP address to confirm it. Google (Gemini) receives the scores and finding titles of an audit to write its summary, and never your contact details.
What we do not do
No advertising trackers, no third-party analytics, no cookies for profiling, and no cross-site identifiers. The typefaces are served from this domain rather than a font CDN, so rendering this page involves no third party at all. There is no cookie banner because there is nothing to consent to.