Updated September 25, 2026
Inspect with context.
Keep control of your data.
The Web scanner processes the public URL or JSON you submit to produce an inspection report. This page describes this scanner, which has different data flows from the main AgentCollusion website.
What is processed
For a public URL, we retrieve the card and supported same-origin public key documents. For pasted or uploaded JSON, the card text and any public JWKS you provide are sent to the inspection service. JSON key discovery is off by default. Do not submit private signing keys or credentials.
Local card comparison
The Compare updates page processes both JSON cards entirely in your browser. It does not send card contents or comparison results to our servers, store them in browser storage, or record comparison activity in the pilot. A page-level content security policy blocks network connections from its scripts. Static page assets are still served by Cloudflare. Use Clear cards to remove the inputs from the page.
What we retain
One-off inspections do not save cards, keys, target URLs, or inspection reports. Results remain in the current browser tab until you leave or reload; you can choose to download a report. Comparisons stay in memory in the current tab. There are no analytics scripts or advertising cookies. Saved history is available only in the separate, optional Release Workspace described below. You do not need to register to inspect cards.
To control traffic, Cloudflare temporarily stores request counters and salted, minute-specific hashes of client IP addresses. These counters expire after two idle minutes. They do not contain the submitted URL or card. Hosting providers can retain infrastructure and request metadata under their own retention policies; we do not claim that infrastructure leaves no logs.
Optional Release Workspace and billing
If you create a Release Workspace and explicitly save cards, we store their original JSON (up to 64 KiB each), project names, review notes and static comparison summaries in Cloudflare storage. These contents are encrypted at rest with a service-managed key and separated by workspace. This is not end-to-end encryption. Free retains one project and two recent revisions; Pro retains five projects and twenty recent revisions each. Saving beyond that revision limit removes the oldest revision.
We store a hash of your private access key, hashed session tokens, consent versions and activity dates. A Secure, HttpOnly, same-site session cookie lasts up to 14 days. Keep the original key privately: it is the only workspace recovery credential. Changing it invalidates other sessions. Workspace creation and login also use short-lived, salted IP hashes for rate limits. Signing up, saving a fictional card or making a test payment never automatically counts as a verified external user.
Paddle handles checkout details and payment methods under its own privacy policy. We store the environment, transaction/customer/subscription identifiers, paid periods, price, status, minimal adjustment data and checkout consent needed to deliver and manage access; we do not store payment-card details, billing addresses or buyer emails from webhooks. The Paddle client script loads only when you choose checkout. The billing button opens the public Paddle merchant portal and requires Paddle email verification. Our application never returns the customer-wide authenticated portal token to the workspace browser and does not save it.
You can export or delete projects inside your workspace, including after cancellation. After 90 days without workspace activity or a verified completed payment, project data and sessions may be deleted when there is no current paid Pro access. Access and minimal billing records remain to handle account security, payment reconciliation and support; they are not removed by deleting a project. For deletion of the entire workspace and associated records, contact contact@agentcollusion.ai. Do not send your access key; we will arrange verification and explain any records that must be retained for payment obligations. Deleting data does not cancel a Paddle subscription: use Manage billing or Paddle support.
Optional developer pilot
If you explicitly join the pilot, we store your email, optional project description, consent date, count of completed non-example inspections, active dates, feedback and our external-participant verification note for up to 90 days after joining. This helps us improve the product and measure real use. These records do not contain card documents, keys, target URLs or reports. A Secure, HttpOnly, same-site cookie identifies your pilot session. Only a hash of its random value is stored by the application.
Participation permits follow-up about your pilot experience; it does not opt you into a marketing list. Registration is not email verification, and does not itself count as an active external user. The internal tally requires a real inspection plus independent confirmation that a participant is external; demo and team activity are excluded. We do not sell pilot data or publish identifiable feedback without your permission.
You can leave and delete your record from the pilot panel in the same browser. If the cookie is lost, email us from the address you registered to request deletion. Records expire automatically; the session cannot be recovered by entering an existing email. Deleting browser cookies alone does not delete the server record.
Where processing happens
Cloudflare serves the site and controls admission. A Node.js function on Vercel runs the same inspection core as the CLI. Request bodies are sent through that service for processing. The application does not intentionally log those bodies or reports.
For data that must stay local
Use agent-card-scanner compare before.json after.json for offline comparison or agent-card-scanner verify for inspection on your own device. It makes no network requests unless you explicitly add --network. Public keys supplied through --jwks are authoritative.
Sharing a report
Reports omit raw card documents and redact URL credentials and queries. They can still contain publisher text, endpoint paths and key identifiers. Review a report before sharing it with others.
Contact
For privacy questions, use contact@agentcollusion.ai.