Privacy Policy - Crocky Audit

Version 2.4, in force from 15 October 2026

This policy explains what personal data Crocky Audit handles, why, on what legal basis, for how long, who receives it, and what you can do about it. It covers the website https://audit.crocky.host, the report links it creates, and the account, API and MCP services.

Our hosting business and client area at https://crocky.host have their own policy (https://crocky.host/legal/privacy-policy). This policy covers Crocky Audit only.

The Romanian version of this policy prevails. This English text is provided for information.

1. Who is responsible

CROCKY S.R.L. (trade names "CrockyHost" and "Crocky"; "we", "us") is the controller of your personal data.

We acknowledge every message within 2 business days and answer within 30 days. Removal requests for audited websites are answered within 7 days (section 6).

2. In short

• You can run an audit without an account. We keep the URL you submit, the results, and technical data about the request (IP address, browser string, time). The IP address and browser string are cleared after 30 days. The report stays, so that we can improve our checks: its PDF and screenshots are deleted after 30 days, and the personal data found on the audited site after 12 months.
• If you leave your email address on the audit form, we send the report link to it and, now and then, news about Crocky Audit, unless you tick "No news, just the report". We send CrockyHost hosting offers only if you tick that box. Every message has an unsubscribe link (section 3.7).
• Whoever holds a report link can open the report. We never publish links, we ask search engines not to index them, and we do not give a link to anyone but the person who asked for the audit. But a link is a secret you hand on when you share it.
• Reports contain what the audited website publishes, including contact details found on its pages. If your website was audited by someone else, read section 6. You can have the reports about your site deleted, and you can stop future audits with a short entry in robots.txt.
• Nothing is loaded from other companies. Fonts, icons and scripts come from our own server. No advertising, no analytics, no tracking cookies. One login cookie after you sign in, the language and theme shared with crocky.host and crocky.ro, and a few choices stored on your own device (section 9).
• You can delete your account at any time. You can ask us to delete your data (section 12).

3. What we process, why, on what legal basis, and for how long

"Legal basis" means a ground in Article 6 of the GDPR (Regulation (EU) 2016/679): (b) to provide a service you asked for, (c) a legal obligation, (f) our legitimate interests. Deletion described below is done automatically by a clean-up job that runs every day.

3.1 When you open our pages

We do not use Google Analytics or any other analytics service. When you open one of our pages or a report, your browser requests files only from audit.crocky.host.

3.2 When you run an audit

Passwords for protected sites. We keep them encrypted in a database table only until our scanner picks the job up, and no longer than that audit. They are deleted when the audit starts, finishes, fails or is cancelled, including when you cancel before it starts. Anything left over is removed by the next daily clean-up. They are not written to logs. Be aware that screenshots and findings from behind the login become part of the report, and anyone with the report link can see them.

The same URL twice. If you (the same account, or, if you use the form without an account, the same IP address) asked for the same URL in the last 10 minutes, we show you your existing report instead of running a new audit. For anyone else, the same request starts a new audit with a new link.

3.3 The report

A report is created for each audit. It holds:

• scores, findings and recommendations, with the evidence for each (for example the response headers that were found);
• technical facts about the audited site (hosting, DNS, certificate, technology, accessibility, performance, carbon estimate);
• what the audited website itself publishes: page titles and descriptions, contact email addresses, phone numbers, social media handles, postal address and map coordinates, the names or user names of WordPress authors where the site exposes them, the cookies its server sets on a first visit, short quotes (about 100 characters each) from the page as evidence for the AI check, and screenshots of the page at four widths;
• unless you unticked the AI check: the verdict, its evidence, and a score for the design;
• the list of addresses on the audited site that our scanner requested or that the page loaded (for example /robots.txt, /sitemap.xml, the page's scripts and styles), with the status code, type and size of each answer;
• a PDF, a downloadable HTML copy, a share image, and copies of the site's icon and share picture, which our scanning server fetches during the audit (for an older report, after it is first opened) so that your browser does not have to contact the site or anyone else.

We show the contact details and other personal data found on the audited site in that report only. We use them for nothing else, we do not use them for outreach, and we do not copy them to any other system.

WordPress user names, the values of the cookies the site sets and, when the site has a public phpinfo() page, the server's IP address, machine name and paths on disk are shown in full only to the account that ran the audit, while it is signed in or through its API key. Everyone else who opens the report, and every PDF and HTML copy, sees them masked (for example "d*", "141.95..", "/home/*"; for a cookie, its name and attributes without the value). The finding itself, that the page is public and what kinds of information it gives away, stays visible, because that is the thing to fix.

Legal basis: Art. 6(1)(b) for the person who asked for the report; Art. 6(1)(f) for the third-party data inside it (section 6) and for keeping reports to improve our checks. Retention:

• the PDF, the share image and the HTML copy: 30 days from when they were made. If someone opens the PDF link later, our scanning server prints it again from the report, and the new copy is kept for another 30 days;
• the screenshots: 30 days after the audit;
• the copies of the site's icon and share picture: 30 days after they were fetched (our scanning server fetches them again if the report is opened later);
• the personal data found on the audited site (contact email addresses, phone numbers and social media handles; the street, postal code and map coordinates; WordPress user names; cookie values): 12 months after the audit. After that the report keeps only how many there were, and WordPress user names and cookie values stay masked for everyone;
• the rest of the report (the URL, scores, findings and their evidence, technical facts, the list of addresses, the short quotes behind the AI check): as long as we run Crocky Audit, so that we can measure and improve our checks. We do not publish reports and do not use them for anything else. For reports made before 13 October 2026, keeping them past 12 months applies from 13 November 2026.

We delete a report earlier when the owner of the audited site asks (section 6), and you can ask us to delete a report you asked for (section 12). The sample report on our home page is kept whole.

3.4 When you create an account

You create an account by entering your email address and opening the sign-in link we send. There is no password. You can also sign in with your CrockyHost account (crocky.host, also ours, CROCKY S.R.L.'s); a paid plan can only be bought that way, because the billing details are kept there.

When you delete your account (page "Account", button "Delete my account"), we delete the account, its keys, monitors and monthly counts, and the sign-in link records for your email address. On the audits you ran, we clear the IP address, the browser string and the webhook URL. The reports stay at their links (section 3.3), no longer tied to you.

3.5 When you use the API or the MCP server

We process your API key (hash), the IP address of the caller, the URLs you submit, the results, your monthly counts, and the webhook URL if you give one. We use them to run your requests, apply the limits of your plan (60 requests per minute per key and a monthly quota) and prevent abuse. Legal basis: Art. 6(1)(b), and (f) for abuse prevention. The IP address is cleared after 30 days like any other audit record.

The MCP server lets an AI assistant you configured ask us to check a URL. We receive the URL and return the result. What your AI provider does with the answer is outside this policy.

If you ask for the verdict on a public site that someone else checked recently, we may answer with that recent verdict instead of starting a new scan. Through the MCP tool you also receive its evidence and scores. You never receive that other person's report link or scan number. Your own scans always return your own links.

3.6 "Was this right?" on the AI verdict

If you press "Looks right" or "Wrong" under an AI verdict, we store the report it belongs to, the verdict band, your yes/no answer, any comment you send with it, and a 32-character code that we compute from your IP address and the date with a secret key. We do not store your IP address for this. The code lets us count one answer per report per person per day. We use the answers only for our own evaluation of the AI check, to improve its accuracy. We do not publish results about individual sites. Legal basis: Art. 6(1)(f). Retention: 24 months.

3.7 Emails, news and offers

We send these messages from our own mail server:

• your sign-in link, monitor alerts, and the "your audit is ready" message if you gave an address on the audit form;
• the confirmation of an order and the messages about the order (payment received, plan started, cancellation, withdrawal, the confirmation of a withdrawal declaration); the paid invoice is sent by the billing system at crocky.host;
• news about Crocky Audit, now and then, to the address you left on the audit form, unless you ticked "No news, just the report": new checks, changes to the service, our plans and offers for it. Legal basis: Law 506/2004, art. 12(2), which lets a provider write to an address it obtained while providing a service about its own similar services, provided the person can refuse when the address is collected and in every message; and Art. 6(1)(f) GDPR;
• CrockyHost hosting offers, only if you ticked "Also send me CrockyHost hosting offers". Legal basis: your consent (Art. 6(1)(a) GDPR; Law 506/2004, art. 12(1)). We keep the time you gave it and the wording of the box.

Every news message, and the "your audit is ready" message, has an unsubscribe link. Unsubscribing takes one click, costs nothing and does not touch your reports.

What we keep for news: the address, the language, which lists you are on, the dates, the consent record for hosting offers, and a code for the unsubscribe link. How long: until you unsubscribe, or three years after the last audit for which you left the address. When you unsubscribe from everything, we delete the address and keep only a code computed from it (SHA-256), so that a later audit does not sign you up again. We do not sell or lend the addresses and we give them to no one. The content of the messages is handled by your email provider.

3.8 When you write to us

We keep your message and your address to answer you, and to prove what was agreed. Legal basis: Art. 6(1)(b) or (f). Retention: 3 years from the end of the conversation, the same period as on crocky.host.

3.9 Orders, paid plans and invoices

Plans are ordered from your account, starting at https://audit.crocky.host/pricing, and paid by card on the NETOPIA Payments page; CROCKY S.R.L. issues the invoice through its billing system at crocky.host. The details on the invoice (the name, the tax ID, the address, city, country and currency) are read from your CrockyHost account when you order. From an order we keep: its number, the plan, the period, the price, the VAT and the total, the currency, whether a company or a person is buying, the name, the tax ID, the address, city and country, your account's email address, the page language, your choice about when the plan starts, the version of the terms you accepted and when, the invoice number, and then the payment date, the way the payment came, the plan's period, any cancellation or withdrawal, and our notes. For each payment attempt we keep NETOPIA's identifier, the amount, the currency, the payment status and NETOPIA's answers about it. Card details never reach us: you type them on NETOPIA's page.

If you withdraw on https://audit.crocky.host/withdraw without signing in, we keep the declaration: the name, the order number, the email address, the language, when it was sent, and a code computed from your IP address (for the limit of five declarations an hour).

• Why: to make and perform the contract: the order confirmation, the invoice, the payment, starting the plan, a withdrawal and its refund (Art. 6(1)(b)); to meet our tax and accounting duties: the invoice, the VAT and e-Factura (Art. 6(1)(c)); to prove a withdrawal and our answer (Art. 6(1)(c) and (f)).
• Who sees it: we do; NETOPIA, for the payment (section 7); and, for what is on the invoice, our accountant and the tax authority. Confirmations go out by email (section 3.7).
• How long: an unpaid order (cancelled by you or by us, cancelled by itself after 48 hours, or withdrawn from before payment) is deleted 12 months after it closed, with its payment attempts. A paid order and its payment attempts are kept as long as the invoice they back: 5 years, counted from 1 July of the year after the financial year in which the invoice was issued (Law 82/1991, art. 25). A withdrawal declaration sent without an account is kept for 5 years. If you delete your account, unpaid orders go with it, and paid ones stay until that date, no longer tied to the account.

3.10 Backups

Backups of the server are kept for at most 30 days. Data that we delete from the live system disappears from the backups when they expire.

4. Who can see a report

• Whoever holds the link. The link has 32 random characters. No login is needed. The PDF, the HTML copy, the share image and the report data follow the same rule. Whoever you send the link to can open it and pass it on.
• We do not publish links. robots.txt tells search engines to stay away from /report/, and every report page says "noindex". Our home page shows one sample report: the audit of our own website.
• Link previews. The preview bots of a few services (X/Twitter, Facebook, LinkedIn, Slack) may read a report page when you paste its link, to build a preview card. The card shows the website name and the scores. It never shows the AI verdict.
• Not given to other requesters. A repeat request returns an existing report only to the same account, or, without an account, to the same IP address, within 10 minutes. API and MCP answers that reuse someone else's recent verdict carry no link to that report.
• Our staff. Our administrators can see job records, including the IP address (for 30 days), browser string and email address (for the short time they exist), and the list of addresses kept for news (section 3.7). Access to the administration panel is limited to CROCKY S.R.L. staff and needs a password.
• Web-server logs record requests, including a request for a report link (section 3.1). Our application does not keep a list of who opened a report.

We do not sell reports or personal data, and we do not share them with advertisers.

5. What the AI check says about people

The AI check gives an automated estimate about how a website looks, from public signals. It is not a statement of fact about a site or its authors, it is not a judgement of any person, and we take no decision about any person from it. Section 13 says more.

6. If your website was audited by someone else (information under Article 14 GDPR)

Who decides. The person who typed your URL decides to audit your site. We run the audit and keep the report, so we are the controller of the report.

Where the data comes from. From your public website (pages, response headers, public files, sitemaps), from public DNS, certificate and domain-registry (RDAP/WHOIS) data, from the public lookups listed in section 7 and, when your site leads to its own public code repository on GitHub, from that repository: its latest commit messages and a few files at its root. We keep the repository's name, which includes the GitHub account name, because it says which tool the site was built with. We do not log in to your site unless the person who asked for the audit gave us a password.

What we keep about you or your business. Technical information about the site, and, where your site itself publishes them: email addresses, phone numbers, social media handles, postal address and coordinates, names or user names of authors (including WordPress author names the site exposes), the cookies your server sets on a first visit, short quotes from your pages, screenshots, copies of your site's icon and share picture, and the addresses on your site that our scanner requested or that your page loaded. When your site has a public phpinfo() page, we also keep what it publishes: the PHP version, the operating system, the server's name and IP address, paths on disk and the names of environment variables. We never keep the values of those variables, even though the page shows them, so that a credential published there does not end up in our database as well. Otherwise we do not keep your passwords or the contents of files that our probes find.

Why and on what basis. To produce the audit that someone requested and to show the evidence behind each finding; and to measure and improve the AI check. Basis: Art. 6(1)(f), the legitimate interest of the person who requested the audit and of ours in a website audit based on public information. We weighed this against your interests: the data is public, the checks are of the kind a visitor or a page-speed test makes (the Terms list the few exceptions), we stop when you ask us to, and after 12 months the personal data found on your site leaves the report.

Who sees it. Whoever holds the report link (section 4), and our staff. WordPress user names, cookie values and the server internals read from a public phpinfo() page are masked for everyone except the account that ran the audit (section 3.3).

How long. The personal data found on your site: 12 months from the audit; after that the report keeps only how many there were, and WordPress user names and cookie values stay masked. Screenshots and the copies of your site's icon and share picture: 30 days. The technical results: as long as we run Crocky Audit, to improve our checks. Sooner if you ask (below).

Why we did not write to you. Writing to every audited website owner would take disproportionate effort, so Article 14(5)(b) GDPR lets us make this information public instead.

Stop audits of your site yourself. Add this to your robots.txt:

User-agent: CrockyAudit
Disallow: /

Our scanner first requests the page and your robots.txt. If it finds this group, it stops there: it runs none of its probes, browser tests or mail checks, and it does not retry. A general User-agent: * rule does not stop it, because an audit is one visit that a person asked for, not crawling. The scanner identifies itself as CrockyAudit/<version> (+https://audit.crocky.host/bot).

Have reports deleted, and future audits refused.

1. Write to audit@crocky.host. Give the domain, or the report link.
2. Prove you control the site: write from an email address at that domain, or add a DNS TXT record that we tell you.
3. Within 7 days we delete every report of your domain: the database records, the PDF, the share image and the cached images. We confirm when done.
4. If you ask, we also add your domain to a list of sites that we refuse to audit.

What we keep about a removal. Your request stays with our correspondence (section 3.8). If you asked us to refuse future audits, the block list keeps the domain, the date and a short reason for as long as the block lasts; ask us and we lift it. Legal basis: Art. 6(1)(c) and (f), to honour your request and to be able to show that we did.

Your rights. You may ask for access, correction, erasure or restriction, and you may object (Articles 15 to 18 and 21). For a website you own or run, we will delete the reports if you ask. If you think something in a report is wrong, or you disagree with an AI verdict, write to the same address and a person will review it within 7 days.

7. Who receives personal data

We use no CDN in front of audit.crocky.host, no analytics service, no CAPTCHA service and no email-sending service for Crocky Audit. Links inside reports (for example to documentation, or to a map on OpenStreetMap) lead to other websites. Nothing is sent to them unless you click, and then their own policies apply. The "talk to us" links lead to our own site crocky.host and pass the address of the audited site in the link, so that we know which site you mean.

8. Transfers outside the European Economic Area

• We store all data on our own server in Germany. Audits run on a second server of ours in France (Scaleway, near Paris). It receives each job as it was submitted, without your email address (that stays on the server in Germany, which sends the ready email) but with any webhook address or password for a protected site, fetches the site, sends the results back to the server in Germany and keeps only a technical log of its jobs (section 10). Any further scanning servers will also be in the EU and under our control.
• The public lookups in section 7 can reach services outside the EEA. They carry domain names and server IP addresses, never data about the people who use Crocky Audit. A domain name can still identify a person, for example when a site carries its owner's name. Cloudflare, which is in the United States, takes part in the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023 (Article 45 GDPR).
• When you open our pages or a report, your browser makes no request to any other company.

You can ask for information about the safeguards at audit@crocky.host.

9. Cookies and similar technologies

We use no advertising, analytics or tracking cookies. We use three cookies: the login cookie and two that remember the language and the theme. A few choices are stored in your browser.

The language and the theme are shared with crocky.host and crocky.ro, the other websites of CROCKY S.R.L. They are kept in the crocky_pref cookie, shared by crocky.host and its subdomains, this site included. A language or theme chosen on crocky.host applies here too, without a click, and one chosen here applies there. When you choose the language or the theme on this site, your browser also sends the new value, in the background, to crocky.host and crocky.ro. The request carries only that value; as with any request, your IP address and the cookies your browser already holds for that site travel with it. On crocky.ro the value is kept only by browsers that keep cookies coming from other sites (Chrome, Edge, Android); in the others it reaches crocky.ro with the first link between the sites.

The cookies (ca_session, ca_crocky, crocky_pref, ch-lang) reach our servers with every request; the rest stay in your browser. Clear them in your browser's site-data settings; crocky_pref is listed there under crocky.host.

Why there is no cookie banner. Under Law 506/2004, art. 4(5) and (6)(b) (which implement Article 5(3) of Directive 2002/58/EC), storing information on your device needs your consent unless it is strictly necessary for a service you asked for. The login cookie is that. The language, theme, layout and notes are interface choices you make, and the Article 29 Working Party found that cookies remembering such a choice need no consent (Opinion 04/2012). An inferred language is the one your browser asks every site for anyway, and if you have chosen nothing, crocky_pref keeps it only until you close the browser. The technical markers hold nothing about you. The score history, which is not strictly necessary, stays off until you tick its box, so that tick is your consent. Because we place nothing else, there is nothing to ask you about on arrival.

10. How long we keep data: summary

11. How we protect data

In plain words, and only what we do:

• Pages and API are served over HTTPS.
• API keys and sign-in tokens are stored as hashes, so they cannot be read back. The session cookie is signed, HttpOnly, Secure and SameSite=Lax.
• Passwords for protected sites are encrypted in the database and deleted as soon as they have been used.
• Sign-in links work once and expire after 20 minutes. Requests are rate-limited.
• Visit counters keep a shortened IP address; the "Was this right?" answers keep a keyed code instead of the IP address.
• The database is stored outside the web root. Report files cannot be listed, and web rules refuse to serve log files and database files.
• Our scanner, and our server when it fetches a report's icon or picture, refuse to connect to private or internal addresses.
• The administration panel needs a password, throttles failed attempts and uses short sessions with CSRF protection.
• Card payments happen on the NETOPIA Payments page: card details never pass through our servers. Payment notifications are checked cryptographically (NETOPIA's signature), and the access keys to NETOPIA and to the billing system are kept outside the web root, readable only by the application.

No measure is perfect. If a breach puts your rights at risk we will tell you, and we will notify the ANSPDCP within 72 hours, as the law requires (Articles 33 and 34 GDPR).

12. Your rights and how to use them

You have the right to:

• access your data and get a copy (Art. 15);
• have wrong data corrected (Art. 16);
• have data erased (Art. 17), within the limits of our legal duties;
• restrict processing (Art. 18);
• take the data you gave us in a usable format (Art. 20);
• object to processing based on our legitimate interest (Art. 21). We stop unless we show compelling grounds;
• object to news and offers by email at any time, free of charge, with the link in every message (Art. 21(2) and (3)). We then stop, with no further question;
• withdraw consent at any time, where we rely on it (for example CrockyHost offers: the unsubscribe link; the score-history box: untick it);
• not be subject to a decision based only on automated processing that has legal or similarly significant effects (Art. 22). We make no such decision (section 13).

How: write to audit@crocky.host or gdpr@crocky.host. If you ask about an account, write from the account's email address. We may ask you to prove who you are. We acknowledge within 2 business days and answer within 30 days; for complex requests the law allows a longer period and we will tell you why. It is free unless a request is clearly unfounded or excessive.

Complaint: you may complain to the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), Bd. General Gheorghe Magheru nr. 28-30, sector 1, București 010336; tel. +40 318 059 211; anspdcp@dataprotection.ro; https://www.dataprotection.ro (online complaint form), or to the authority of your own EU country. You may also go to court.

13. Automated decisions and the AI estimate

The AI check is an automated estimate about a website's code and design. Its bands are Confirmed, Likely, Possibly, No evidence found and Not measured. Every report ends with the line "Scores and verdicts are automated estimates from public signals, not statements of fact about a site or its authors." We do not use the estimate to decide anything about a person. It can be wrong, and we publish its measured error rates on https://audit.crocky.host/ai. If a verdict about your website is wrong, tell us (section 6) and a person will review it.

14. Children

The free audit asks nobody's age and needs no personal data (the email is optional). An account requires you to be at least 16: below that age, Art. 8 GDPR requires a parent's consent for services based on consent, and we do not check ages. If you learn that a child under 16 has an account, write to gdpr@crocky.host and we will delete it.

15. Changes

We will change this policy when our processing, providers or the law change. The current version is at https://audit.crocky.host/privacy. The version in force shows the date it applies from. Earlier versions are available on request.

Version 2.4, 15 October 2026

Questions about this document: audit@crocky.host