How the scan works

What we read

For a single website, in one pass, we fetch:

• your home page, and a few of the pages it links to on the same site;
• robots.txt, ai.txt, llms.txt, and your sitemap;
• one plain http:// request to your site;
• your Google Tag Manager container file — the public file every visitor's browser downloads, fetched from Google's own servers at googletagmanager.com rather than from you;
• your public DNS records — address, mail, SPF, DKIM, DMARC — read from public DNS, not from your server.

We also load your home page in a real browser — once to watch it, once to press Deny on your cookie banner and follow one link, and, when Google Ads is present, twice more with test click ids while every tracking request is blocked. Each load renders the page the way a visitor's browser does, so your own analytics may record each one as a visit. It is also how we take the picture of your home page that appears on a results page.

What we cannot see

• Anything behind a login. We have no credentials and we do not attempt any.
• Any form. We do not submit them and we do not fill them in.
• Any page your home page does not link to. We read your home page and a few of the pages it links to on the same site. We do not crawl the rest of it, and we do not guess addresses. The one exception is a site whose owner connects Google: then we also read the pages their own Analytics says get the most views.
• Anything about your visitors. We see what your tags are configured to do. We do not see who came to your site, and we do not receive your analytics unless you grant us access yourself.
• Anything behind a bot wall. If your site refuses automated visitors, we record that it does and move on, ungraded — we do not rotate through a pool of addresses to get around it. The one thing we do try is reading the page from an ordinary home internet connection, described below.

What we store

The result of the check: which tools we found and their account IDs, your container IDs, whether a consent platform was detected, the DNS and security-header findings, and the score. When somebody asked for a check of your site — the case where we load it in a real browser — we also keep a picture of the home page for their results page. A site we looked at on our own gets no picture, because that pass never opens a browser. We keep one result per website address, and a new check replaces the old one.

No page on our site lists the sites we have checked, and no result is published. One thing worth saying plainly rather than letting you find it: a home-page picture is served from a plain web address with no sign-in on it. It is a photograph of a public page, so there is nothing in it a visitor could not see — but it is not behind a lock, and we would rather tell you that than call it private.

We never take a name, an email address or a phone number off a page we read, and we never build a mailing list out of one. Our own outreach goes only to people who already subscribed to us.

How our scanner identifies itself

Our fetches carry this user agent:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 CleanDataRoadmapBot/1.0

The part to match on is CleanDataRoadmapBot.

Some visits come from an ordinary home internet connection, in a normal browser. Those look like an ordinary Chrome visitor, because that is what they are — a real browser on a real connection. That is the one case where you will not see our token in your logs.

How often

• If someone asks for a check of a site, we run it then. A recent result is reused rather than fetching your site again, and so is a recent picture of your home page.
• For our own research we read your home page and a few of the pages it links to, as plain fetches rather than a browser, and we read a small number of sites at a time. We do not crawl a site.

If you connect Google

Connecting Google is free. You can do it from your results page without buying anything, and it answers the eight checks in the Analytics & Tag Manager group there. The paid report reads the same way. Either way, it is two read-only permissions, and nothing else, and only if you approve them.

• https://www.googleapis.com/auth/analytics.readonly — view your Google Analytics data
• https://www.googleapis.com/auth/tagmanager.readonly — view your Google Tag Manager containers

Neither can write. We cannot change a tag, a property or a report, and there is no code path in the app that tries. What we read with them:

• Your GA4 settings. The property's name, currency and time zone; your data streams and their enhanced-measurement settings; your Google Ads links; your BigQuery links; your custom dimensions, custom metrics and key events; how long the property keeps event data; and each web stream's redaction settings.
• Event and traffic totals, over the last 28 days. Event names with their counts and values; session source, medium and campaign with session counts; sessions by channel and by country; referrers; your total sessions and the share of them with a key event; and, when Google Ads is linked, your Ads cost and the sessions from google / cpc. Totals only — no user ID, no client ID, no demographics, no audience, and nothing about any one person's visit.
• Your hostnames, over the last 28 days. Which hostnames receive traffic in your property, with their share of sessions, so we can suggest your other sites to scan.
• Your most-viewed pages, over the last 28 days. The page paths with the most views, so we can read those pages the same way we read your home page.
• Page and event data, over the last 30 days. To check for personal information, one report of page paths, page URLs, page titles and event names with their event counts, plus your event-scoped custom dimensions when you have them. From it we keep counts and a few masked examples, like j***@example.com — never the values themselves.
• Your live Tag Manager container. Its tags, triggers and variables, as published — and, if you choose one, your server container's, as published.

Disconnect Google whenever you like, from your results page, your site's page in the app, or your own Google account. Any one of them stops any further reading. What we have already read, and how long we keep it, is in the privacy policy.

What the $29 report adds

Your results and the Google connection are free. The report is one PDF built from the same reads, and it adds what the results page does not: every problem we found across Collection, Labeling, Enhancement and Alignment, in the order to fix them, with what we saw printed beside each one, who usually makes each fix, and where it is made.

To build it, we load your site in a real browser once more and record the tracking requests it makes. The page's HTML is kept so we can show you what we saw, and a stored request URL keeps only the account-identifier parameters — the visitor identifiers other tracking tools would keep are dropped.

A report describes your site on the day it was read. Change something and order another.

How to ask us to stop

Tell us which domain it is, and show us you speak for the site — a message from an address at that domain is the simplest proof. Write to us at app@measureu.com. We will stop checking it, and delete what we have stored about it if you ask in the same message.

We keep that list by hand today, so a person reads your message and acts on it. Worth knowing before you try something faster: we read your robots.txt, but we do not yet treat it as an instruction — so a rule in there will not stop us, and we would rather tell you that than let you think the job was done.

What we will not do with it

We do not sell it. We do not pass it to advertisers or data brokers. When we publish research from it, we publish counts and percentages only — never a named site, and never a group smaller than ten sites.

Contact

Removals, opt-outs, a question about a visit in your logs, or a security report — write to us at app@measureu.com.

What we hold and what we do with it is in the privacy policy. What you get when you buy is in the terms.