Privacy & data
What Loomaly fetches from your site, what it stores and for how long, how AI processes your pages, and how to delete your data.
This page explains in plain terms what happens to your site's data when you use Loomaly. The legal version is the Privacy Policy and the Terms of Service. If anything here differs from them, they take precedence.
What we fetch from your site
Loomaly reads only what's publicly available on the domain you add, within the path you scoped the project to, if you set one. It never logs in, submits forms or reads anything behind a password.
| What | When | How |
|---|---|---|
robots.txt and sitemap files | Every full scan | Plain requests identified as LoomalyBot |
| Your homepage and linked pages | Full scans, to find pages when the sitemap doesn't list them all | Cloudflare's crawler (CloudflareBrowserRenderingCrawler), which runs JavaScript only when a site looks like it needs it |
| Individual pages | Each scan of a representative page, and each single page you scan | A headless browser run by Cloudflare. It runs JavaScript so you see what a real visitor sees, and skips images, fonts, media and stylesheets. The request uses a search-engine user agent, so the scan sees the page the way search crawlers are served it. |
| Performance data | The same page scans | Google PageSpeed Insights (mobile) and Chrome UX Report data for the page's URL, requested from Google |
| Your homepage | When you check a meta-tag verification | A plain request that looks for the tag |
robots.txt
- Loomaly reads
Disallowrules written for all crawlers (User-agent: *) or for Loomaly. Pages they block are marked robots blocked. Loomaly doesn't fetch them at all: they get no rule checks, AI judgment or performance test, and are left out of page judgments and link suggestions. - If your
robots.txtblocks Cloudflare's crawler, or opts out of search use with aContent-Signaldirective, the scan stops andstatusreports The site owner has opted out of SEO crawling. To let Loomaly in, add this torobots.txtand ask your assistant to scan again:
User-agent: CloudflareBrowserRenderingCrawler
Allow: /What we store
| Data | What it is | How long |
|---|---|---|
| Account | Your name and email address | Until your account is deleted |
| Projects | Domain, path scope, settings, members, invitations | Until the project is deleted |
| Page list | The URLs found on your site, with sitemap dates and robots status | Until the project is deleted |
| What each scan extracted | Title, meta tags, canonical, hreflang, headings, image alt-text counts, links, structured data, word count and a text sample of up to about 4,000 characters | The latest 10 scans of each page. Older ones are deleted automatically every day. |
| Scan results | Issues and their history (fixed, reopened, ignored) | The latest 10 scans of each page, as above |
| Raw page HTML | Kept briefly so a repeat scan doesn't fetch the page again | About 10 minutes |
| Search Console | Access token and the search data Loomaly pulls, if you connect it | Token deleted when you disconnect. See Google Search Console and the Privacy Policy. |
| Billing | Plan, subscription status and pages used this period | Card details are handled by Stripe and never reach Loomaly |
Loomaly doesn't keep a copy of your full page HTML beyond that short cache. Search Console refresh tokens are stored encrypted (AES-GCM).
How AI processes your pages
During a scan, every page's path, title, meta description, headings, the first 900 or so characters of its text and a description of its length are sent to an AI model, which answers a fixed set of yes/no questions about the page (see How a scan works). The model doesn't write the issues: their explanations and fix prompts come from Loomaly's templates. Loomaly keeps the model's answers (the page type and how sure it was of each answer, no page text) with the scan, to explain findings and tune the checks. They're deleted together with the rest of that scan's stored data. When you ask your assistant to draft a fix via problem, the relevant issue and page data are sent to a model in the same way. Page judgements and the fix-first ranking also use AI on your pages and issues. To find pages that compete for the same search and to suggest internal links, Loomaly also turns page text into embeddings (numeric fingerprints of what a page is about) and keeps them in a Cloudflare vector index.
Loomaly reaches these models through Cloudflare's AI platform (Workers AI and AI Gateway), part of the same Cloudflare infrastructure Loomaly runs on. For the full list of the third parties that process data for Loomaly and the commitments that apply, see the Privacy Policy.
The free site check
The check on the homepage needs no account. It reads the site's robots.txt, its sitemap and about 20 public pages, runs the code checks on them and asks an AI model about internal links between them. The finished result is kept for 7 days at loomaly.com/check/<domain>, so the link can be shared; that page is not indexed by search engines. It holds only what the public pages showed, never anything about who ran the check.
Loomaly counts visits and key steps (a check finished, a sign-up, a first scan) with Cloudflare Web Analytics, Databuddy and its own server-side counters. None of them set cookies, and the counts aren't tied to your account or email.
Who can see your data
Inside Loomaly, a project is visible only to its members. Every member of a project can see all of that project's scans, issues and reports. See Roles. PDF reports are downloaded to your device. Loomaly doesn't publish them anywhere.
Deleting your data
- A project: the owner can delete it under
/account. This removes the project's site, page list, scans and issues, and can't be undone. - Leaving a project removes your access. The project's data stays with its owner.
- Search Console: disconnect under
/accountto delete the stored token. You can also revoke access in your Google account's permissions page. - Your account: Email privacy@loomaly.com to delete your account and its data, or to request a copy of your data.