This policy covers Bot Appétit at botappetit.ai, a free tool operated by Milk Moon Studio (Pty) Ltd (“we”, “us”). It explains what we collect when you use the tool and what we do with it. For the rules of using the tool, see our Terms of Use.

You do not need an account to run a single-page scan, and we do not ask for your name or email to run one. A multi-page site scan needs an account, because it takes several minutes and we need somewhere to send the result.

Accounts

If you create an account we store your email address, the identifier from whichever service you signed in with (or a secure form of your password), the sites you have added as projects, and any domains you have verified as yours. We use these to sign you in, to show you your own scan history, and to tell you when a scan you asked for is ready. When you sign in we also store, with your account, the visitor IDs from your browser’s analytics cookies (named under “Usage analytics (PostHog)” below), so that our analytics tools can be matched to the same person.

You can sign up with GitHub, Google, or an email address and a password, and we check a new email address by sending it a code. Sign-ups from disposable email domains are blocked. Our sign-in provider, Clerk, also offers a passkey and an authenticator app (with backup codes) as extra ways to sign in and to protect your account; both are optional, and you add them yourself under Manage account, then Security. A sign-in lasts at most 30 days, then you sign in again.

We also keep the last day you were signed in, and your re-scan choices: two for your account and one for each site. Thirty days after the last finished scan of each site in your account we scan it again, once however many accounts track that site, and unless you have switched that off we email you the result. Your result holds only the pages you pinned yourself. If you have not signed in for about three months we email you once to say the re-scans will pause, and email you again when they do. Apart from the sign-in links and codes you ask for, which our sign-in provider sends for us, those are the only emails we send you: the result of a scan you asked for, the result of a monthly re-scan, and these two notices about pausing them. You can switch the re-scans and the result emails off on Your sites.

We do not sell any of this. You can delete your account at any time — under Manage account, then Security, in your account menu, or by emailing hello@botappetit.ai — and your email address, sign-in details, projects and site scans go with it, along with any share links you made.

Scan results are not deleted with your account, because they were never stored against you in the first place. Scan results are never linked to who ran them: the history of an address shows what was found and when, not who asked. Two people scanning the same page moments apart produce two entries that look identical, because the result is a fact about that page — not about either of them.

What we send to Google when you scan

When you run a scan you give us a web address. To produce your results we fetch that page the way a search engine would, and we send that web address to Google, which provides two parts of the report:

Google PageSpeed Insights — measures how fast the page loads.
Google Safe Browsing — checks whether the page is flagged as unsafe.

Please do not submit a web address that is itself confidential — for example a password-reset link, an unlisted preview, or an address with a token or an email address in it — because the address is shared with Google as described above. Scan the public address of a page rather than a private link to it.

What we keep, and why

To understand how the tool is used, to improve our checks, and to see how sites change over time, we keep a record of each scan. That record includes:

the web address you scanned, and the address it resolved to after any redirects;
the results we produced — the overall score and the outcome of each individual check;
general technical information about the request: approximate location (country and city), network provider, browser type (User-Agent) and language;
which platform the scanned site appears to be built on (for example Webflow or WordPress);
the date and time of the scan, and how long it took.

In our scan records we do not store your IP address, with or without an account. Where we need to recognise repeat use or detect abuse, we convert your IP address into a one-way, irreversible code (a salted hash) that cannot be turned back into your address. We keep that code, not the address. (PostHog, which counts visits, does keep IP addresses — see “Usage analytics (PostHog)” below.)

If your browser already carries our analytics cookies (Google Analytics or HubSpot — see “Cookies and analytics” below), we also record the identifier from those cookies with your scan, so we can tell how many separate people use the tool and recognise a returning visitor. This identifier comes from cookies that are already set; it does not name you, and we do not combine it with any contact details.

We also note where you came from when you first arrive on our site in a browser tab: the page that linked to us (the website only, not the page) and any campaign tags in the link, such as the utm_ parts or, for an advert, a Google Ads click identifier. Your browser keeps them for that tab only, and we record them with the scans you run in it and with a call you book through the scanner, so we can see which channels bring people to the tool. They do not name you.

We rely on our legitimate interest in running, understanding and improving a free service as the lawful basis for keeping this information (section 11(1)(f) of POPIA; Article 6(1)(f) of the UK/EU GDPR). The records are not used to identify you as an individual, and we keep them for as long as the tool operates so we can measure change over time.

Scan links and page history

Every scan gets its own web address — a permalink — shown on the results page so you can save it or send it to a developer. Opening it shows that scan exactly as it was, without re-running it. These links do not expire, and anyone who has one can view that scan.

Results pages also show a history of the exact page scanned: earlier scans of that same address, with their dates and scores. This history is visible to anyone who scans, or holds a link to, that exact address — including scans run by other people. It covers only the one address, not the rest of the site.

Where we can tell from our analytics cookies that a scan was run in your browser, we may also show you other pages on the same site that you scanned. That list is shown only to you; other visitors never see which pages you scanned.

We only ever scan pages that are already publicly reachable, and we ask search engines and AI crawlers not to index scan links. If you would like a particular scan removed, email hello@botappetit.ai with the link and we will delete it.

A multi-page site scan is a collection of page scans, and the collection is private to the account that ran it. Nobody else can list the pages in it, and it is not linked to from anywhere on this site. This matters because you can paste addresses we could not have found on our own — an unlisted page, a staging address — and being scanned must not make them discoverable.

The owner of a scan can create a share link for it. The link carries a random, unguessable token, and anyone who has it can read that whole report without an account — which is the point: the person who has to fix the findings is often not the person who ran the scan. We ask search engines and AI crawlers not to index these pages, and we do not publish them anywhere.

Only the owner can create or remove a share link. Removing it takes effect immediately — the old link stops working for everyone the moment you stop sharing, and it cannot be turned back on: creating a new one issues a new token. We never show a share token to anyone opening the report, only to its owner.

Individual page results still behave as described above: they belong to the address, not to you, and anyone who scans the same address sees the same history. What a share link changes is access to the collection — which pages were scanned together, and the site-wide score over them.

Our Chrome extension

Besides the website, Bot Appétit has a Chrome extension. It needs a Bot Appétit account, and everything above applies to it too. This section covers what is different. The extension talks to botappetit.ai and to nothing else: it has no analytics of its own and no ads. Installing it is covered in How do I install the Chrome extension?

Signing in. You sign in on botappetit.ai, and the extension picks that sign-in up. To do that it reads the sign-in cookie that our sign-in provider, Clerk, sets for botappetit.ai’s sign-in service, which is why it asks Chrome for the cookies permission for that one address. It does not read cookies from any other site.

Scores on pages. “Show scores on pages” is on once you are signed in, and you can turn it off in the extension’s window. While it is on, each time you open or switch to a page, the extension checks whether we already hold a scan of that page and shows its score on the toolbar icon. To do that it makes a one-way code (a hash) from the page’s address, in your browser, and sends us that code with your sign-in token. It does not send the address itself. Addresses that are not ordinary public web pages, such as your own computer or private network, are not looked up. We do not keep the code: it travels in the body of the request, not in the request address, and we do not write it to our scan records or our logs. Cloudflare, which runs the site, keeps technical request logs for about a week, and those record the request address, which does not contain the code. Turn the setting off and no look-ups are made at all.

Scanning from the extension. The extension never scans anything on its own. Pressing Scan this page sends us that page’s address, and the result is stored and public like any other scan result, in the same history as on the website. Pressing Scan site sends only the site’s address (the scheme and host, not the page you are on) and starts the same site scan as the website, which is private to your account unless you share it.

On this page now. When you open the extension’s window, it reads the page in your active tab: heading counts, structured data types, language and a few meta tags. This is shown to you in the window and is never sent to us. Chrome only lets it read the tab you opened it on.

What stays in your browser. The extension stores two things in Chrome’s extension storage, on your device only: whether “Show scores on pages” is on, and the last ten scans you ran from the extension (the page’s address without any query, its score and a link to its result), shown as “Your recent scans”. You can clear that list from the extension’s window, and it is never sent to us. We do not change your pages, do not read your browsing history, and do not send us pages you did not scan.

Copies of scanned pages

To test that our checks keep working correctly, we sometimes keep a copy of a page we scanned — the HTML and the small files a search engine would read, such as robots.txt. We keep these only where a page is different enough from ones we already hold to be useful as a test case, so most scans are never copied.

These copies are used solely to re-run our own checks against a page we have already seen, so we can tell the difference between our scanner changing and a website changing. They are never published, shared, or made searchable, and we do not use them to train anything. We only ever copy pages that are already publicly accessible.

If you would like a copy of your page removed, email hello@botappetit.ai and we will delete every copy we hold for your site.

Anti-abuse checks (Cloudflare Turnstile)

Before each scan we run an invisible check that confirms you are a real person using a real browser rather than an automated script. You will not see a puzzle or a checkbox. To do this, Cloudflare Turnstile processes your IP address, information about your browser’s secure connection, your browser type, and our public site key. Cloudflare states that it cannot identify you personally from this. We have not enabled Turnstile’s “pre-clearance” feature, so it does not place a clearance cookie on your device. Cloudflare describes this service in its Turnstile Privacy Addendum.

Rate limiting

To keep the tool available, we count requests from your IP address over a rolling one-minute window and refuse requests above a set number. These counters are short-lived and are not used to identify you. The same counting applies to AI tools and programs that use our MCP server or API.

AI tools and the API

Bot Appétit has an MCP server and a public API, so an AI tool or a program can scan a page for you. No account is needed for that. What reaches us is the request the tool sends: which of our tools it called and the address to scan. We do not receive the rest of your conversation with the AI tool.

If you want a tool to use your own account (whole-site scans, your sites and their settings), you approve it once in your browser, on a page run by our sign-in provider, Clerk, which names the tool asking and what it may see: your basic profile and email address. The tool then holds an access token for your account. We check the token on each request, and it is valid for our server only. Our server logs record which tool was called, whether it worked, and which AI tool holds the token; they do not record your conversation, and they are deleted after 7 days. The tool can only reach what your account can reach, and a site scan stays private to your account unless you share it. An AI tool cannot create an account for you. You can remove the connection in your tool at any time; if you want it ended on our side as well, email hello@botappetit.ai.

We count how the MCP server and the API are used, in PostHog and Google Analytics, the same way we count visits to the website. For each call we record which tool was called, whether it worked, how long it took, whether it hit a rate limit, the website address (host only) it was about, and the name and version your AI tool reports about itself. We do not record your conversation, the rest of the address you asked about, or the page contents. When you have connected your account, these counts are tied to your account in PostHog, like your visits to the website; otherwise they are anonymous. Calls we make ourselves are left out.

A scan made this way is stored exactly like a scan made on the website: the address, what we found and when, marked as having come through the MCP server or the API. Like every page scan, it belongs to the page and is public to anyone who scans or looks up that address. A site scan started through your account is different: it is private to your account, like one started on the website.

Cookies and analytics

We use Google Analytics, loaded through Google Tag Manager, to understand in aggregate how the tool is used. This sets cookies in your browser. We do not use these cookies to identify you personally, and we do not sell your data.

The pages of this site also load the following, which set their own cookies or identifiers in your browser. We read this list off what a page actually loads:

Google Tag Manager, Google Analytics and Google Ads. Counting visits, and measuring and remarketing our adverts. Google Tag Manager is also how Microsoft Clarity is loaded.
Microsoft Clarity. Shows us how people use our pages, through heatmaps and recordings of a visit. It sets cookies of its own, and Microsoft Advertising’s identifier can come with it.
HubSpot. Tracks visits and links them to a contact if you book a call, and picks up what you type into a HubSpot form on the page. HubSpot’s advert pixels also load the Meta (Facebook) pixel and the LinkedIn Insight tag, so Meta and LinkedIn can see that your browser visited a page here.
PostHog, described in the next section.
Cloudflare Turnstile and Clerk, which run the anti-abuse check and sign-in.

Each is a separate company that handles the data under its own privacy policy.

Usage analytics (PostHog)

We also use PostHog, on its European cloud, to see how the tool is used. In your browser it records the pages you open, what you click and tap (the button or link, never what you type), how far down a page you scroll, how quickly a page loads, and any error our own page code hits. It also records the actions that matter to the tool: starting a scan, seeing a result, opening a check, copying a link, opening the history or a comparison, ticking a checklist item, pinning a site, and clicking sign in, create account or “Book a call”. When something happens on our servers it also records that it happened: a page scan (the site’s hostname, the scores and verdict, whether it was blocked, whether the page had been scanned before, and how long it took), a site scan starting and finishing, a performance check, a site scan being shared, and an account being created or signed in to. It does not record the contents of a scan, the address you typed in full, or anything you type into a box. For people who sign in, and for anyone who books a call through the scanner, it does record an email address, as described below.

To tell visits apart, signed-in people are identified by their account’s ID. Everyone else is identified by an anonymous ID. PostHog keeps it in your browser’s local storage and in a cookie on botappetit.ai. Our studio site, www.milkmoonstudio.com, keeps its own, so for now one person can show up as two visitors; where Google Analytics has already given your browser an ID and PostHog has none yet, we reuse that one so a scan and the visit that made it line up. When you sign in, or book a call through the scanner, PostHog also receives your email address, and the Google Analytics and HubSpot visitor IDs from your cookies (HubSpot’s only if you have its cookie). None of these go to Google Analytics. For people with an account we also keep a few counts against that ID, such as when it was created and how many sites it has scanned, so we can see how the tool is used. PostHog does not record sessions or screens; Microsoft Clarity, above, does.

PostHog receives and keeps your IP address. Your browser sends it to PostHog through an address on our own domain (z.botappetit.ai) that PostHog runs, and PostHog stores the address those requests come from. We keep it so we can leave our own visits out of the numbers. This is separate from our own scan records described above, where we still do not store your IP address. Scans run by us are not sent to PostHog.

Bug reports and feature requests

When you send a bug report or a feature request from our report pages, what you write is published publicly on GitHub, as an issue in a public repository, where anyone can read it and search engines can index it. We post it for you, so you do not need a GitHub account, and nothing links it to you. Leave out anything private. The same applies if you choose to post on GitHub yourself.

The reply email address is optional. If you give one, we keep it privately, apart from the issue, only so we can write back about that report. It is never put on GitHub, and we delete it when you ask. The issue itself says only that a reporter left an email for a reply. To have a published report removed, email hello@botappetit.ai.

Who else is involved

The tool runs on Cloudflare, which serves the site, provides the anti-abuse check, and hosts the scan records described above. Google provides the performance and safety checks and the analytics. PostHog provides the usage analytics described above. GitHub hosts the public issues that bug reports and feature requests become. Google also runs the Chrome Web Store, where our extension is listed. Each processes data on the terms of its own privacy policy.

Your rights

Under POPIA and the GDPR you have rights over your personal information, including to ask what we hold and to ask us to delete it.

If you have an account, you can ask us what we hold about you and ask us to delete it, and we can act on that directly.

If you scan without an account, the records we keep are not tied to you as a named individual — our scan records hold no name, no email, and no reversible IP address — which can make a specific record impossible for us to single out. PostHog’s visit counts do include IP addresses, as described under “Usage analytics (PostHog)”. If you have a concern, contact us and we will help as far as we reasonably can.

Changes

We may update this policy. The date at the top changes when we do. Because the policy lives with the tool itself, it is kept current with what the tool actually does.

Contact

Milk Moon Studio (Pty) Ltd — hello@botappetit.ai

Privacy policy