The short version

436.io is an independent personal project, not a company. Running a scan requires signing in with Google, and each completed scan’s report is saved to your account so you can come back to it, download it as a PDF or delete it later. The only things that touch our server at all are: your Google account details from signing in, the pages/sitemap you ask us to look up, the report a completed scan produces, your IP address (briefly, to enforce fair-use limits), and, if you use the contact form, whatever you type into it.

Running a scan

When you scan a website, your browser sends us the website address (or an uploaded sitemap file) and the list of check categories and device types you picked. Our server uses that to look up the site’s sitemap, then calls Google’s PageSpeed Insights API once per page/category combination, using a single API key we hold, so you never need one of your own. Once a scan completes, its report is saved to your account and appears in your scan history, where you can open, download or delete it whenever you like; a scan you cancel partway through is not saved.

The pages you ask us to check are, by definition, sent to Google as part of that API call; see Google APIs Terms of Service for how Google handles that. 436.io itself does not use scan data for anything beyond generating the report shown to you.

Signing in with Google

Running a scan requires signing in with Google. Google shares your name, email address and profile picture with us, which we store so you stay signed in between visits. We don’t request or receive access to your Gmail, Drive or any other Google data, only that basic profile information; see Google’s Privacy Policy for how Google itself handles the sign-in. Being signed in is what lets a scan’s report be saved to your account afterward, and is used to identify who’s running the scan; it doesn’t change how the scan itself is run. You can delete individual scans, or your whole account and everything tied to it, at any time from the account page, or ask us to using the contact page.

Your IP address and rate limiting

Because the PageSpeed Insights key is shared across every visitor, we keep a short-lived counter per IP address (via Upstash, a managed Redis provider) to stop any one visitor from using more than a fair share of it. These counters exist only to enforce that fair-use limit, expire automatically within hours, are never linked to any other data and are never used to identify you.

What’s stored in your browser

436.io saves a light/dark theme preference and your analytics choice (see below) in your browser’s localStorage, neither of which ever leaves your browser or is readable by us. If you sign in with Google, a session cookie is set so we know you’re signed in; it’s not readable by other sites and isn’t used for advertising or tracking. 436.io doesn’t run any advertising scripts, and doesn’t use tracking that identifies you individually or follows you across other sites; see Analytics below for exactly what does run.

Analytics

436.io can use Google Analytics to understand overall traffic, such as how many people visit and which pages they use — but only if you say yes. The first time you visit, a banner asks you to accept or decline; nothing from Google Analytics loads until you accept, and declining (or ignoring the banner) means it never runs at all. Your choice is remembered in your browser’s localStorage so you’re not asked again on the same device. See Google’s Privacy Policy for how Google itself handles that data.

436.io also uses Vercel Analytics and Vercel Speed Insights — our hosting provider’s own analytics — to see aggregate page-view counts and real-world loading performance (Core Web Vitals) across the site. Unlike Google Analytics, these don’t use cookies or any identifier that persists across visits or could tie your visits together, so they run for every visitor rather than waiting on the consent banner above. See Vercel’s Privacy Policy for how Vercel itself handles that data.

The contact form

If you send a message through the contact page, the name (optional), email address and message you provide are sent, using Resend (an email-delivery service), to the inbox we use to answer messages. That message is kept only for as long as it takes to read and respond to it, in that ordinary email inbox, and is never written into our database. You can ask us to delete a message you sent at any time using the same contact form.

Hosting

436.io runs on Vercel, which, like essentially any web host, keeps its own standard infrastructure-level request logs (for reliability and abuse prevention) independent of anything described above. 436.io doesn’t control or access those logs beyond what Vercel’s own tools surface. Your account and scan history are stored in a Postgres database hosted by Neon.

Fonts

436.io’s typefaces are bundled with the site at build time (via Next.js’s font optimization) rather than loaded from Google Fonts’ servers each time you visit, so no font-related request is made to Google as you browse.

Children

436.io isn’t directed at children and we don’t knowingly collect information from anyone under 13.

Changes to this policy

If what 436.io collects or how it’s handled changes, this page will be updated and the date at the top will change. There’s no mailing list to notify, since we don’t collect emails except when you send us one.

Questions

For anything about this policy, including asking what (little) data we might have and requesting it be deleted, use the contact page.