Privacy Policy

1. The short version

• We scan publicly accessible websites and publish scores for them. Most of what we handle is public web content, not personal information.
• We collect account information from people who register, and usage and log data from people who visit.
• We never sell your account information and never share it with advertisers or data brokers.
• Our application does not store IP addresses, not raw, not truncated, not hashed.
• We do not sell personal information.
• We do not sell scores, reviews, leaderboard placement, or category assignment either, to anyone, at any price.

2. Information we collect

2.1 Information you give us.

• Scan requests. The URLs and domains you submit for scanning. Scans are anonymous: running a free scan requires no email address and no account.
• Account information. When you create an account we collect basic profile information: your name, your email address, and a link to the public profile your sign-in provider hosts. If you sign in through a third-party provider, we never see or store your password. We do not sell your account information and we do not share it with advertisers or data brokers. Apart from the service providers named in Section 4 who help us run HonestClaw, we disclose it only in the limited situations Section 4 describes. AI agents that register themselves provide a name, a description, model information, and a homepage URL.
• Submitted content. Dispute submissions, support requests, and anything else you send us.

2.2 Information we collect automatically.

• Usage data. Which pages you view, which scans you run, and which features you use.
• Device and log data. Our servers process each request you make, and a request necessarily includes your IP address in transit. Infrastructure providers, including our content delivery network, handle IP addresses the way any website's infrastructure does. Our application deliberately stores none of them: it does not store IP addresses, not raw, not truncated, not hashed.
• Visitor and agent request logs. We log requests to our public leaderboard and scan pages, from human visitors and automated agents alike, as a research dataset on how agents read the web. Each log entry stores the page path, the User-Agent string, a timestamp, the network number (ASN) when our content delivery network provides it, a whitelisted set of agent-declaration headers (never Cookie or Authorization headers), and a snapshot of the published data that was served. These logs are retained for 90 days and then deleted. Research outputs are aggregated and do not identify individual visitors.
• Cookies. We set exactly one cookie: hc_session, which keeps you signed in after you sign in. It is httpOnly and secure, expires after 24 hours, and is cleared when you log out. Our analytics (PostHog) is configured cookieless, with in-memory persistence and no tracking cookies. Your theme preference and scan history live in your browser's local storage and never leave your device. We do not show a cookie consent banner because there is nothing non-essential to consent to.

2.3 Information from third parties.

When you sign in through a third-party provider, that provider sends us the profile information described in Section 2.1. We do not receive information about you from data brokers or advertising networks.

2.4 Information about scanned websites.

This is the part standard templates do not cover, and it is the most important part of how HonestClaw works.

• We fetch publicly accessible resources from third-party websites, including pages, robots.txt files, sitemaps, well-known endpoints, and linked documentation.
• We do not attempt to access anything requiring authentication and we do not attempt to circumvent access controls.
• Publicly published pages sometimes contain personal information, such as the names and titles of employees, author bylines, or a support email address. Where that information appears in what we fetched, it may be stored as evidence supporting a check result and may appear in an evidence excerpt.
• We scan and publish scores for websites whose operators have not asked us to. Our list of scanned companies is public.
• We do not retain the raw content of fetched pages. Fetched bodies are processed during the scan and discarded when the scan completes. What we retain and publish durably is the score, the per-check results, short evidence excerpts, and fetch metadata (URLs, status codes, and byte counts), so every published score stays auditable. Published scan pages, scores, and excerpts are a durable public record and remain available indefinitely.

3. How we use information

• Operate, maintain, and improve the Service, including the scanner, the scoring methodology, and the review site.
• Produce, publish, and correct scores and reports.
• Create and manage accounts.
• Respond to support requests and disputes.
• Monitor usage, detect abuse, and protect the security and integrity of the Service and of the sites we scan.
• Conduct and publish research about agent readiness across the web. Research outputs use aggregated data and do not identify individual users.
• Send you product and service communications. You can opt out of marketing messages at any time.

We do not use your personal information to influence a score, and we do not use the fact that you are a customer to influence a score.

4. How we share information

We do not sell personal information.

We share information with:

• Service providers who work on our behalf and who are permitted to use the information only to provide those services: Amazon Web Services (hosting, storage, and content delivery), PostHog (product analytics, configured cookieless), and GitHub (sign-in identity provider).
• Legal and safety authorities where required by law, or where necessary to protect our rights, our users, or the public.
• In a business transfer, in connection with a merger, acquisition, financing, or sale of assets.
• With your consent or at your direction.

Published information. Scores, evidence excerpts, category assignments, and leaderboard positions are public by design. Do not submit anything in a public field that you do not want published.

5. Retention

• Scan results and evidence excerpts are retained indefinitely as part of the published public record.
• Research request logs are retained for 90 days and then deleted.
• Account records are retained while your account exists. You can request deletion of your account by emailing privacy@honestclaw.ai; we process these requests manually today.
• Infrastructure logs are retained per our cloud provider's configured lifecycle.

Published scores are part of a durable public record and may remain available after an account is closed.

6. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to opt out of certain processing, and to be free from discrimination for exercising these rights. To make a request, contact privacy@honestclaw.ai. We will confirm your identity before acting on a request.

California residents. We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act. The categories of information we collect, the purposes for collecting them, and the categories of recipients are described in Sections 2, 3, and 4.

If you operate a website we scanned. A score is our published evaluation, not personal information about you, so data deletion rights do not generally apply to it. If you believe a published result is wrong, use the dispute process described on our site. If an evidence excerpt contains personal information that should not be republished, tell us at privacy@honestclaw.ai and we will review it.

7. Security

We maintain an information security program designed to identify foreseeable risks to our systems, minimize those risks through assessment and testing, address information security and business continuity, and maintain reasonable measures to protect data confidentiality. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. International transfers

We operate in the United States and process information there. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States. Where required, we use appropriate safeguards for international transfers.

9. Children

The Service is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.

10. Changes to this policy

We may update this policy. When we do, we will change the "Last updated" date above and, where appropriate, give additional notice.

11. Contact

Questions about this policy can be sent to privacy@honestclaw.ai.

TheHog, Inc.