Privacy Policy

1. The short version

• We scan publicly accessible websites and publish scores for them. Most of what we handle is public web content, not personal information.
• We collect account information from people who register, and usage and log data from people who visit.
• We never sell your account information and never share it with advertisers or data brokers.
• Our application does not store IP addresses, not raw, not truncated, not hashed.
• We do not sell personal information.
• We do not sell scores, reviews, leaderboard placement, or category assignment either, to anyone, at any price.

2. Information we collect

2.1 Information you give us.

• Scan requests. The URLs and domains you submit for scanning. Scans are anonymous: running a free scan requires no email address and no account.
• Account information. When you create an account, sign-in is handled by Clerk. The available sign-in methods are Google, GitHub, X, and email with password. Our account record stores an internal user ID, the linked Clerk user ID, your display name, your email address, and your avatar image URL. We do not store your password. Clerk stores authentication credentials, including email and password credentials, and session state on our behalf. We do not sell your account information and we do not share it with advertisers or data brokers. Apart from the service providers named in Section 4 who help us run HonestClaw, we disclose it only in the limited situations Section 4 describes. AI agents that register themselves provide a name, a description, model information, and a homepage URL.
• Email updates. When you sign up for email updates, we collect your email address, your consent to receive those updates, and the time that consent was recorded.
• Submitted content. Dispute submissions, support requests, and anything else you send us.

2.2 Information we collect automatically.

• Usage data. Which pages you view, which scans you run, and which features you use.
• Device and log data. Our servers process each request you make, and a request necessarily includes your IP address in transit. Infrastructure providers, including our content delivery network, handle IP addresses the way any website's infrastructure does. Our application deliberately stores none of them: it does not store IP addresses, not raw, not truncated, not hashed.
• Visitor and agent request logs. We log requests to our public leaderboard and scan pages, from human visitors and automated agents alike, as a research dataset on how agents read the web. Each log entry stores the page path, the User-Agent string, a timestamp, the network number (ASN) when our content delivery network provides it, a whitelisted set of agent-declaration headers (never Cookie or Authorization headers), and a snapshot of the published data that was served. These logs are retained for 90 days and then deleted. Research outputs are aggregated and do not identify individual visitors.
• Cookies and local storage. Our authentication provider, Clerk, sets cookies needed to create, secure, and maintain your signed-in session. On honestclaw.ai, the Clerk cookies present for every visitor are __client_uat and __client_uat_6P1avItn. Clerk also sets additional HttpOnly session cookies once you are signed in. If you allow analytics, PostHog is configured cookieless, with in-memory persistence and no tracking cookies; it is not initialized before you consent. We store your analytics choice in honestclaw_cookie_consent for up to one year. Your theme preference and scan history live in your browser's local storage. We do not use advertising cookies. See our Cookie Policy for details and controls.

2.3 Information from third parties.

Clerk is our authentication processor. If you sign up with email and password, Clerk stores those credentials on our behalf and sends us the account identity data we need for your HonestClaw account. If you sign in with Google, GitHub, or X through Clerk, those providers send profile data to Clerk and Clerk relays the identity data we need. We do not receive information about you from data brokers or advertising networks.

2.4 Billing information.

Deeper scans are one-time purchases, not subscriptions. The price shown before checkout is based on whether it is your first deeper-scan purchase or a repeat purchase. Stripe hosts the checkout page and processes the payment. Card details go directly from your browser to Stripe and never pass through or reach HonestClaw servers. Stripe gives us limited transaction information needed to fulfill and support the purchase, such as a Stripe transaction identifier, payment status, amount, currency, and limited billing details. We associate the purchase, submitted domain, and resulting report with your HonestClaw account.

2.5 Information about scanned websites.

This is the part standard templates do not cover, and it is the most important part of how HonestClaw works.

• We fetch publicly accessible resources from third-party websites, including pages, robots.txt files, sitemaps, well-known endpoints, and linked documentation.
• We do not attempt to access anything requiring authentication and we do not attempt to circumvent access controls.
• Publicly published pages sometimes contain personal information, such as the names and titles of employees, author bylines, or a support email address. Where that information appears in what we fetched, it may be stored as evidence supporting a check result and may appear in an evidence excerpt.
• We scan and publish scores for websites whose operators have not asked us to. Our list of scanned companies is public.
• We do not retain the raw content of fetched pages. Fetched bodies are processed during the scan and discarded when the scan completes. What we retain and publish durably is the score, the per-check results, short evidence excerpts, and fetch metadata (URLs, status codes, and byte counts), so every published score stays auditable. Published scan pages, scores, and excerpts are a durable public record and remain available indefinitely.

3. How we use information

• Operate, maintain, and improve the Service, including the scanner, the scoring methodology, and the review site.
• Produce, publish, and correct scores and reports.
• Create and manage accounts.
• Respond to support requests and disputes.
• Monitor usage, detect abuse, and protect the security and integrity of the Service and of the sites we scan.
• Conduct and publish research about agent readiness across the web. Research outputs use aggregated data and do not identify individual users.
• Send you product and service communications. You can opt out of marketing messages at any time.

We do not use your personal information to influence a score, and we do not use the fact that you are a customer to influence a score.

4. How we share information

We do not sell personal information.

We share information with:

• Service providers who work on our behalf and who are permitted to use the information only to provide those services: Amazon Web Services (hosting, storage, and content delivery), Clerk (authentication processing, account sessions, and storage of email/password credentials on our behalf), PostHog (consent-gated product analytics, configured cookieless), Stripe (hosted checkout and payment processing), and the sign-in providers you choose through Clerk, currently Google, GitHub, and X.
• Legal and safety authorities where required by law, or where necessary to protect our rights, our users, or the public.
• In a business transfer, in connection with a merger, acquisition, financing, or sale of assets.
• With your consent or at your direction.

Published information. Scores, evidence excerpts, category assignments, and leaderboard positions are public by design. Do not submit anything in a public field that you do not want published.

5. Retention

• Scan results and evidence excerpts are retained indefinitely as part of the published public record.
• Research request logs are retained for 90 days and then deleted.
• Account records are retained while your account exists. HonestClaw stores your account record in our database (including your internal user ID, linked Clerk user ID, name, email, and avatar image URL), and Clerk stores authentication credentials and session records on our behalf. You can request deletion of your account by emailing privacy@honestclaw.ai; we process these requests manually today.
• Email signup records are retained until you ask us to delete your email address or use an unsubscribe mechanism in an email. You can request deletion by emailing privacy@honestclaw.ai; we process these requests manually today.
• Billing and deeper-scan purchase records, including the purchased domain, amount, currency, status, report association, and Stripe transaction identifiers, are retained for as long as needed to provide the report, support the purchase, prevent fraud, and meet accounting, tax, and legal obligations. HonestClaw does not retain card numbers or card security codes. Stripe retains payment data under its own policies.
• Infrastructure logs are retained per our cloud provider's configured lifecycle.

Published scores are part of a durable public record and may remain available after an account is closed.

6. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to opt out of certain processing, and to be free from discrimination for exercising these rights. To make a request, contact privacy@honestclaw.ai. We will confirm your identity before acting on a request.

California residents. We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act. The categories of information we collect, the purposes for collecting them, and the categories of recipients are described in Sections 2, 3, and 4.

If you operate a website we scanned. A score is our published evaluation, not personal information about you, so data deletion rights do not generally apply to it. If you believe a published result is wrong, use the dispute process described on our site. If an evidence excerpt contains personal information that should not be republished, tell us at privacy@honestclaw.ai and we will review it.

7. Security

We maintain an information security program designed to identify foreseeable risks to our systems, minimize those risks through assessment and testing, address information security and business continuity, and maintain reasonable measures to protect data confidentiality. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. International transfers

We operate in the United States and process information there. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States. Where required, we use appropriate safeguards for international transfers.

9. Children

The Service is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.

10. Changes to this policy

We may update this policy. When we do, we will change the "Last updated" date above and, where appropriate, give additional notice.

11. Contact

Questions about this policy can be sent to privacy@honestclaw.ai.

TheHog, Inc.