Privacy Policy

Web Scanner: Dead Links & Security (Chrome extension). Effective October 9, 2026.

Summary

• We do not collect, sell or share your personal data. The extension has no account, no analytics and no advertising.
• Scans run in your browser. Scan results, history and settings stay in your browser's extension storage.
• The extension contacts other servers only for the scans you start, for public DNS lookups, and for license checks. Each case is listed below.

What the extension does with data

Link scans

When you start a link scan, the extension requests the pages of the website you entered (or the pages listed in its sitemap.xml, or a list of addresses you paste) and checks each link found on them once, directly from your browser, to read their HTTP status and redirects. For each broken link it keeps the pages it was found on and the link text, so you can fix it. Requests go only to the sites you scan and the sites they link to, and are sent without your cookies.

Whole-site security checks (Pro)

During a link scan with Pro, the extension also reads the response headers, cookie headers and HTML of up to 200 pages of that site it already fetched, and runs the same passive checks on each. The results stay in your browser.

Security scans

When you start a security scan, the extension reads the HTTP response headers (including cookies the site sets on that request) of the address you entered, and requests a small set of public files from that site, such as robots.txt, up to 8 of its own script files and their source maps, and a header-only request to up to 10 third-party script addresses the page already loads, to see whether they still resolve. If the page is open in your active tab, it also reads that page's HTML, forms, script addresses and the names of its local storage keys. Storage values such as tokens are not copied into results or exports. Nothing from these checks leaves your browser.

Email security lookups (SPF and DMARC)

To check SPF and DMARC records, the domain name you scan is sent to Cloudflare's public DNS-over-HTTPS service (cloudflare-dns.com). Only the domain name is sent. Cloudflare's own resolver privacy policy applies.

Network Inspector (Pro)

Only while you turn it on, the Network Inspector records the metadata of requests made by the site you are inspecting: method, address, status, type, timing and response headers. It does not record request or response bodies. The log is kept in memory, is limited to that site, and is deleted when you clear it or close the browser.

Licenses and payments

Purchases are handled by Lemon Squeezy, which acts as the merchant of record and processes your payment and email address under its own privacy policy. When you activate, check or remove a license, the extension sends your license key and an instance identifier to the Lemon Squeezy license API (api.lemonsqueezy.com). The license key is stored only in your browser.

Storage

Settings, the last scan, a history of up to 30 security scans and 30 link scans (used to show what changed since the previous scan), client report settings you enter (agency name, client name and logo image) and your license status are stored in Chrome's extension storage on your device. Some on/off settings use Chrome sync storage, which Chrome syncs to your other devices if you have sync turned on. You can delete the history in the extension at any time. Removing the extension deletes all of this data.

Reports you print or text you copy with "Send to developer" are created on your device and go only where you send them.

Permissions

• Access to websites is requested when you start your first scan, because checking links and headers on arbitrary sites requires it. You can revoke it in Chrome's extension settings at any time.
• activeTab and scripting let the extension read the page in your current tab when you start a security scan on it.
• webRequest is used by the Network Inspector while you have it turned on, and during a security scan to read the cookie headers of the scan's own request.
• storage keeps your settings, results and license status.
• sidePanel shows the extension next to the page you are checking.

What we never do

• We do not send attack payloads or try to exploit the sites you scan. Checks are passive.
• We do not collect browsing history, scan pages in the background, or track you across sites.
• We do not sell or transfer data to third parties, use it for advertising, or use it to determine creditworthiness.

Children

Web Scanner is a developer tool and is not directed at children under 13.

Who is responsible

Web Scanner is published by Önder Bakır, an individual developer based in Turkey, who is responsible for this policy. Because the extension does not send your scan data, history or settings to us, we hold no personal data about you. Lemon Squeezy holds your purchase details as merchant of record.

This website

This website (webscanner.onderbakir.com) counts page views with Cloudflare Web Analytics. It does not use cookies or local storage and does not track individual visitors. The extension sends nothing to it.

Changes and contact

If this policy changes, the effective date above changes with it. Questions or requests: reply to your Lemon Squeezy receipt or open an issue.