Privacy Policy
Last updated
This policy explains what FocalScore collects and why. We keep it short and in plain language on purpose. If anything is unclear, email info@focalscore.com.
What we collect
- The URL you scan and the public pages we crawl to produce your report. We only fetch publicly accessible pages and identify our crawler honestly.
- Your email address, if you sign up to unlock the full report.
- Basic usage and rate-limit data (such as IP address) to prevent abuse and keep the free scan free.
- Where and on what you used it, when you start a scan, sign up or start a checkout: the country your IP address belongs to, and whether you were on a computer, phone or tablet, with which operating system and browser (read from what your browser announces about itself, not version numbers or the device model). We work the country out on our own server from a database we keep with the site; no lookup service sees your address.
- Visit statistics — which public pages are viewed, how often, and roughly from where. No cookie and no stored IP address; see Visit statistics.
- What you send through the contact form — your name, email address, the optional subject, your message, and the IP address it came from. These are stored in our database, not only emailed to us, because the form promises a reply and that promise can't depend on a mail provider working. We use them to answer you. Sending us a message does not add you to any mailing list.
- Payment details are handled by Stripe — we never see or store your card number.
How we use it
- To generate and deliver your report and (if purchased) your AI report.
- To email your report, and to send follow-up emails: three in your first week (one, three and seven days after you confirm your address), then one a week — a practical tip about your website, using the results of your own scan, and every few weeks an offer for our paid report. Once you've bought the AI report you get the tips without the offers. You can stop them all at any time with the link in each email.
- To see which follow-up emails are useful: when you click a link in one, we record that you clicked it and, if you go on to buy, which email led there. We don't track whether you open the emails.
- To operate, secure, and improve the service.
- To understand how people find and use FocalScore. The two founders see the facts above in a private dashboard that only they can sign in to; nobody else does.
Cookies
Three cookies of ours keep the service working, and none of them is for advertising. sl_session is your sign-in cookie: it is issued when you confirm your email address, is signed so it can't be edited or forged, and lasts 30 days. fs_device is an opaque identifier for the browser you are using; it is counted alongside your IP address to enforce the daily cap on free scans, so that one person clearing cookies or changing network doesn't exhaust the allowance for everyone else. fs_consent remembers your answer to the cookie question at the bottom of the page — Allow or No thanks — for 180 days, so we don't ask on every visit. It holds that answer and nothing else. (The two founders' sign-in to our private admin dashboard uses a fourth, fs_admin, for 12 hours; no visitor is ever given it.)
Every other cookie, and everything from Meta, is off until you allow it. If you choose Allow, we load the Meta Pixel, Meta's measurement tag, so we can tell whether our ads on Facebook and Instagram bring people here. It sets Meta's _fbp cookie (and _fbc if you arrived by clicking one of our ads), which Meta uses to recognise your browser on the websites that use its pixel. After a purchase we also set fs_px, a one-time note of what was bought and its price, so the purchase is counted once: it lasts at most an hour and is deleted as soon as it has been sent. Your browser then also keeps, in its local storage, a short list of the purchases it has already counted (fs_px_sent: a one-way code for each of the last 50, nothing about what was bought), so that one purchase is never counted twice.
With your permission, Meta receives the public pages you view here, and that you started a scan, saw your free score, signed up, confirmed your email, sent the contact form, started a checkout or bought — with the product and its price. When you sign up, confirm your email or buy, our server also tells Meta directly (Meta's Conversions API), so the event is counted even if your browser blocks the pixel. With those three, Meta receives your email address only as a one-way code (a SHA-256 hash), which it can match to a Facebook or Instagram account but cannot turn back into the address, along with Meta's cookies, your IP address and browser details. Never your email address itself, the site you scanned, your scores, your report or anything you type. The pages of your report and the agency dashboard are never sent to Meta by their address, not even as the page you came from: their events go through a blank page of ours, so the link to your report stays with you.
If you choose No thanks, or haven't answered, nothing from Meta loads. If your browser sends a Global Privacy Control signal, we treat it as No thanks and don't ask. To change your mind, use Cookie settings at the bottom of this page, or of any page of the main site: choosing No thanks there stops the pixel and deletes Meta's _fbp and _fbc cookies. Unless you allow it, nothing on this site tracks you across other websites.
Visit statistics
To see which pages people read and where they come from, each public page of this site sends one small message to our own server after it has finished loading. It carries the page's address (without anything after a ?), the website that linked you here (only its name, such as google.com), any campaign tags in the link (utm_source, utm_medium, utm_campaign), and your window's width as a rough size band. From the request itself we note the country your IP address belongs to and your kind of device, operating system and browser.
We do not store your IP address for this, and nothing is saved in your browser: no cookie, no local storage. To count how many different people visited on a given day, we keep a one-way code made from your IP address, your browser's description and a random value that lives only in our server's memory and is replaced every day at midnight GMT. The same visitor gets the same code for one day and an unrelated one the next, so visits can be counted per day but no one — us included — can follow you from one day to another or work back to your address. Recognisable automated traffic, browsers without JavaScript and the private report pages are not counted.
These statistics are ours alone: they go to no analytics company and no advertiser, and nothing is shared. Because they identify no one and follow no one across days or websites, they run whether or not you answer the cookie question, and a Global Privacy Control or Do Not Track signal does not switch them off. Each visit record is deleted automatically 13 months after it was made.
When you start a scan or ask for your report by email, the form sends the same campaign tags and linking site from the page you are on, and we keep them with that scan or signup, so we can tell which of our posts or ads brought it. They are read from the address of the page, not from a cookie, and are kept for as long as the scan or signup is.
What we don't do
We do not sell your data. A scan describes a public website, so it isn't private the way your account is: anyone can scan the same site, and for a few hours after a scan we answer a new request for the same site with that result rather than run it again. Your email address and your sign-in are yours alone, and we don't share them.
How long we keep it
Visit statistics are deleted automatically 13 months after each visit.
Everything else we keep until you ask us to delete it. That applies to your scans and the reports made from them (with the country and kind of device noted beside them), your email address, and anything you sent through the contact form along with the IP address it arrived from. None of that expires on a timer, so none of it quietly disappears either.
Two exceptions, both outside our hands. Payment records are held by Stripe under their own retention policy — we never had your card details to keep. And a deletion request cannot reach into email you have already been sent; it stops us holding your data, not messages already delivered to your inbox.
To have it deleted, email info@focalscore.com and say so. You do not have to give a reason.
Your choices
- Unsubscribe from the follow-up emails using the link at the bottom of each one: it opens a page with a single Unsubscribe button, and you don't need to sign in.
- Request a copy or deletion of your data by emailing info@focalscore.com.
- Turn the Meta Pixel on or off at any time with Cookie settings at the bottom of this page, or of any page of the main site (see Cookies).
- The visit statistics hold nothing that identifies you, so there is no switch for them; if you would rather send nothing at all, blocking JavaScript for this site stops them (see Visit statistics).
Third parties
We rely on a small set of service providers to run FocalScore — SmarterASP.NET (hosting and database), Stripe (payments), Amazon Web Services (email delivery, via SES), Google (PageSpeed Insights for performance data, and Web Risk for the malware blocklist check), and OpenAI. No analytics company is among them: our visit statistics and the country lookup run on our own server. OpenAI is used on every scan, not only for the paid report: a handful of checks send the text of the public pages we scanned to an AI model to judge, and the optional AI report is written the same way. Each provider receives only what it needs to do its job.
To check a site we also look its domain up in public records: domain registration (RDAP), certificate logs (crt.sh), Wikidata, the HSTS preload list, the Internet Archive and OSV vulnerability data. They receive the domain being scanned, never anything about you.
Google also runs reCAPTCHA on the scan box, the signup step and the contact form, to tell a person from a script. It never shows you a puzzle, but it does mean Google receives your IP address and signals about your browser when you use one of those three.
Meta Platforms receives data only if you choose Allow in the cookie question: the Meta Pixel then sends the pages and events described under Cookies from your browser, along with your IP address and browser details, as any request to Meta does. When you sign up, confirm your email or buy, our server sends Meta the same event, with your email address as a one-way code (never the address itself), your IP address and browser details. We use all of it only to measure and improve our own ads. If you didn't choose Allow, our server sends Meta nothing.