Privacy

Updated 2026-10-23

Can Bots See Me is a free site audit run by Yuriy Stasyuk. This page covers the website at canbotsseeme.yuriystasyuk.com and its API.

Scans

When you scan a URL, we fetch that public page and store the report for 30 days so its link works. Reports contain only what the page publicly serves.
Your IP address is used in memory to apply rate limits. It is not saved with reports.
With each report we keep the raw response we received (status, headers and the page's HTML, plus robots.txt and llms.txt) for the same 30 days, so any finding can be checked again. Cookies the site sets are not kept.
The site uses Google Analytics to count visits.

We count five things per day to see whether the tool helps: scans, Search Console connections, fix-prompt copies, rescans and fixes detected by a rescan.
Each is a number per day and nothing else: no IP address, account, URL, cookie or device ID, and no session recording. Counts are kept for 400 days.

When you are signed in, we keep which checks passed or failed on the pages you scan (not their content), your last 10 scans per page, so a rescan can show what you fixed and when.
To measure a fix, we read clicks and impressions for the fixed pages and for similar pages on the same property, from your own Search Console. You see only properties your Google account has verified.
Deleting your account deletes this history.

Connecting Search Console is optional; scans work without it. If you connect, we ask Google for three permissions and nothing else:

openid and email: your Google account ID and email address, to know who is signed in.
Search Console, read-only (webmasters.readonly): the list of your verified properties, search performance (clicks, impressions, click-through rate, position) and URL Inspection index status for the pages you scan or put in an experiment.

Read-only means we cannot change anything in your Search Console account, submit sitemaps, or add or remove users.

Your Google refresh and access tokens are encrypted with AES-256-GCM before they are saved, in Cloudflare storage. The key is held separately as a server secret.
To keep within Google's limits, we cache your property list for up to 10 minutes, page performance for up to 6 hours and URL Inspection results for up to 24 hours.
Raw export streams your rows from Google straight to your browser. We don't store them.
Experiments you pre-register are kept so the result can be checked later: the property, the page lists, the dates and the power analysis (summary numbers, not your rows). Disconnect or delete your account to remove them.
Your browser keeps one signed, HttpOnly session cookie. It holds your Google account ID and email, not your tokens, and expires after 30 days.

Only to show you your own Search Console data inside this tool.
We do not sell or share it, use it for advertising, or use it to train AI models.
Can Bots See Me's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Cloudflare hosts the service and stores the data. No other company receives it.

Disconnect revokes our access at Google and deletes your tokens, cached Search Console data and experiments immediately.
Delete account does the same and also removes your email, account ID and fix history.
You can also remove access at myaccount.google.com/permissions, or email us to have everything deleted.