privacy

Privacy.

Last updated October 11, 2026

stole.si has no accounts, no sign-up, no cookies and no ad trackers. This page lists everything it keeps, why it keeps it, and for how long.

What is stored

What	Why	How long
Scan results	What a scanned page shows any visitor: style values, detected technologies, response headers, timings, the domains it loads from, and the names and settings of its cookies (never their values). Stored under the page’s address, including its query string and any `#/` app route, so the report link works for everyone.	30 days
Scan log	The address, time, outcome and duration of each scan, to run the status page and fix failures. It doesn’t record who asked for the scan.	30 days
Rate limits	A one-way hash of your IP address, used to count scans per hour and stop abuse. Held in memory only.	1 hour
Contact messages	What you send through the contact form, your email address so you can get a reply, and a one-way hash of your IP address to stop spam.	Up to 12 months
Emails	Mail you send to an @stole.si address, kept in an ordinary mailbox at Fastmail so it can be answered.	Until you ask for it to be deleted
Server logs	Standard web server logs: IP address, time, page and browser, for security and troubleshooting.	Up to 180 days
Visits	A small script records page views without cookies: IP address, approximate location, browser, device, the site you came from and the pages you read. It runs through this site’s own address, and the data stays in analytics software on stole.si’s own server.	No fixed limit yet

Screenshots, images, fonts, text or files from the sites stole.si scans.
The values of cookies that scanned sites set.
Addresses that contain a password, token or key. Those are refused before any scan starts. Tracking tags like utm_source are removed from addresses first.

Scan reports are public. Anyone with the link sees the same report, and the four downloads that go with it.
Scanned sites don’t see you. The scan comes from stole.si’s server, with a browser name that says it’s stole.si. Your IP address and browser are never passed on.
Nothing is sold or shared. stole.si loads no outside analytics, ad, font or script services: everything comes from stole.si itself.

Own a site? Remove it and stole.si deletes its stored reports and stops scanning it.
Want a message you sent deleted, or to know what’s stored about you? Ask through the contact form or at hello@stole.si.

stole.si may show ads in the future. This page will say so, and name any ad provider, before that happens.

When this page changes, the date at the top changes too, and the changelog says what changed.