Privacy

The short version

The scoring engine runs on your machine. A scan reads the page you are on, fetches that same site’s robots.txt, llms.txt and raw HTML, and computes a score locally. No page content, URL or score is sent to a CrawlRadar server as part of scanning — not on the free plan, not on Pro.

We do not sell data, share it with advertisers, or build profiles. There is no advertising network, no fingerprinting and no cross-site tracking anywhere in the extension or the site.

The extension

Permissions requested at install

• activeTab — access to the one tab you are on, granted by Chrome when you click the icon and expiring when you leave. There are no host permissions at install, which is why Chrome shows no “read your data on all websites” warning.
• scripting — to inject the analysis script into that tab when you press Scan. Nothing runs on any page until you do.
• storage — to keep your settings on this machine. See below for exactly what is in there.

What is stored, and where

Everything is in chrome.storage.local, which stays on this computer. Deliberately not storage.sync: sync replicates through Google’s servers, and this object can hold an API key.

• The list of sites where you enabled in-editor scoring.
• Your AI provider API key, if you saved one, along with the provider and model you chose.
• Whether you collapsed the in-editor panel.
• If you connected an account: whether it is on Pro, the account email, and when that was last checked.

Scan results are not stored. They exist while the popup is open and are discarded when you close it. Uninstalling the extension removes all of the above.

The three things that can leave your device

Each requests its own Chrome host permission at the moment you turn it on, and handing that permission back disables it.

1. In-editor scoring on your own site

Enabling this for a domain grants access to that one origin so the panel can score drafts as you write. The scoring still happens locally; the permission is what lets the panel run on your CMS at all. Nothing is transmitted.

2. Connecting a CrawlRadar account

If you connect an account, the extension asks crawlradar.xyz one question — whether that account is on Pro — using the session cookie you already have from signing in on the website. It sends no scanned URL, no page text and no score. The answer, and your account email, are cached locally and re-checked at most every six hours.

3. AI checks with your own API key

This is the one feature that sends page content anywhere. If you save a key for Anthropic, OpenAI or Perplexity, the extension sends the text of the page you are scanning directly to that provider from your browser, and the answer comes straight back. It does not pass through CrawlRadar infrastructure, and your key is never sent to a CrawlRadar endpoint.

That content is then handled under your chosen provider’s privacy policy and the terms of your own account with them, not under this one. The feature is off until you add a key, and removing the key ends it.

The website

crawlradar.xyz is a normal web application and does more than the extension does.

• Scans you run here are performed by our server, which fetches the URL you submit once, anonymously. A one-off scan is not stored. The URL and score are kept only when you create a share link, or when you are signed in and the scan is part of your own history or a site you asked us to monitor.
• Accounts store your email address and plan. Authentication and the database are run on Supabase.
• Payments go through LemonSqueezy, which acts as merchant of record. We never see or store your card details.
• Monitoring alerts, if you enable them, are emailed via Resend.
• Rate limiting on the endpoints that fetch on your behalf uses your IP address, held briefly in Upstash, to stop the service being used as an open proxy.
• Analytics: when configured, this site loads Google Analytics 4 with IP anonymisation enabled. It is not present in the extension.

What the extension does not do

• No analytics, telemetry, crash reporting or usage statistics.
• No browsing history collection. It sees only the tab you scan, when you scan it.
• No remote code. Everything runs from the package the Chrome Web Store reviewed; nothing is downloaded or evaluated at runtime.
• No cookies, advertising identifiers or fingerprinting.

Things you export yourself

The score card image and the fix prompt are produced in your browser and saved or copied by you. Neither is uploaded. If you paste a fix prompt into a coding assistant, that content becomes subject to that tool’s policy — which is your call to make, and the reason the prompt is handed to you rather than sent for you.

Children

CrawlRadar is a tool for people who publish web pages and is not directed at children under 13.

Changes

If a future version changes what is collected, this page is updated before that version ships and the date at the top moves. Any new collection would be opt-in, on the same terms as the three features above.

Checking this yourself

You should not have to take our word for it. Open DevTools → Network, run a scan, and watch where the requests go: the site you are on, and nowhere else unless you turned on one of the three features named above. The install card lists the permissions. The scoring engine and the extension are the same code described here.

Contact

Questions about this policy, or a request to delete an account and its data: privacy@crawlradar.xyz.