Privacy

What Walkaround keeps when it checks an app, where it is, who else touches it, and how to have it deleted. This is a scanner that stores what it found, so the honest answer is longer than "nothing" - but it is short. Last changed 21 October 2026.

What we keep when you scan

One row per scan, and this is the whole of it:

• The address you asked us to check, and the host it resolved to.
• The twelve results: for each line, whether it came back open, closed, or not checked, one sentence saying what that means, and where a line is open or closed the evidence - the exact request the scanner made and the response text it got back, kept so the receipt can print it unsealed. That response text can contain whatever your app returned to a stranger, which is the point of a receipt and is the one thing worth thinking about before you scan something you would not want read.
• What could not be checked, and why: addresses that did not answer, checks that were skipped, the test login that was refused if it was.
• The date and time of the scan and how long it took.

Nothing else. There is no image of your pages: the only screenshots this product has are of its own four demo apps, captured by our own scripts and published in the gallery on the front page. We do not photograph a customer's app.

If you pay, one more row is kept for the order: the plan, the amount, the Stripe identifiers for the payment and - for a subscription - the customer and subscription they belong to. Card details are never in it and never reach us: Stripe holds those.

What we keep about a visit

Pages are counted with Cloudflare Web Analytics: a cookieless pageview beacon. It reports the address of the page, where the visitor came to us from, and the page's own loading timings, to Cloudflare. It sets no cookie, writes nothing into the browser, builds no profile, does not record a session or the screen, and does not follow anyone to another site. There is no advertising pixel, no social tracker and no third-party analytics on any page - and it is off entirely unless this deployment has been given a site token.

On our own side we also count steps through the funnel - a page was viewed, a scan was submitted, a paywall was seen, a fix was copied - in our own database, so we can tell whether the product works. Those rows hold the step, the time, the receipt it belongs to, the host that was scanned, the referring host, the campaign in the link if there was one, and whether the caller looked like a program rather than a person. They hold no cookie, no fingerprint, no IP address, no user agent, and nothing that identifies anyone.

The only cookie this site sets is the one that lets the person who runs it stay signed in as the owner. A visitor to the public pages gets no cookie at all.

The test login, which is the sensitive part

If you tick the box and hand us a test account, that address and password are sent to your own app's login form, over the network, once - and they live in the memory of that one scan. They are not written to our database, not written to our logs, and not printed on the receipt. Nothing about that session is kept for the next scan: a rescan asks for the login again, which is why it does.

Who else touches it

• Stripe - card payments and the billing portal. Stripe is the processor for anything to do with a card: you give your details to Stripe, not to us.
• Cloudflare - hosting. The site runs as a Cloudflare Worker and the database is a Cloudflare D1 database, so a scan's row is stored on Cloudflare's infrastructure, and the cookieless page counter described above is Cloudflare's.

That is the whole list. We do not sell data, we do not share a receipt with anyone, and we do not use anything you scan to train anything.

Receipt references are the access control

A receipt is readable by anyone who has its reference. That is deliberate - it is what lets you send one to a colleague or paste it into a ticket - and it means a receipt should be treated like a document, because the evidence on an unsealed one is a working example of what was found. The four receipts in the front-page gallery are scans of our own demo apps, published on purpose.

How to have it deleted

Email hello@walkaround.dev with the receipt reference (it is printed at the bottom of the roll, and in the page address). We delete the scan's row - address, results, evidence and notes - and if you ask, the payment record we are required to keep for accounting is separated from it. We will confirm by email, and we do it within seven days. Nothing you scan is held for a fixed term: a receipt stays until it is deleted or until the service shuts down, so if you want it gone, ask.

Under UK data protection law you can also ask for a copy of what we hold about you, ask for it to be corrected, or object to it being held; the same address does all three. If you are not satisfied with our answer you can complain to the Information Commissioner's Office.

Prices, for the record

£39 for one report, £19 a month for unlimited rescans. The full terms are in the terms of use, and refunds are set out in refunds and cancellation.