Privacy

Last updated September 23, 2026

Sutros is a community for people who need help with websites and people who can offer it. wekup is our AI website checkup feature. This page explains what we collect and why, in plain words.

Choose an underlined term to read its definition.

Private checkups

A confirmed account is required to run a website checkup or recheck a finding. Saved checkups are private to the account that ran them and authorized administrators. Your scan history is private. Other people can read a report only after you post it to the community bulletin for help.

The server can see your connection address and browser information. We use connection and account limits to slow abuse. People on the same network can share a connection allowance for feedback and account actions. Your recent checkup can delay another checkup of that site from your account. Reading a public help post without an account does not hide your connection from Sutros or its hosting provider.

What a checkup reads

A checkup loads public pages, reads response headers, and requests a fixed list of common file addresses. It does not sign in or submit forms. For a possible exposed file, the checker reads a sample of up to 4,000 bytes to identify the file type, then cancels the remaining response. It does not keep the file contents in the report.

When AI assistance is enabled, limited page screenshots may be sent to the configured AI service for sexual-content screening and evidence review. Screenshots captured only for content screening are not saved by Sutros as report pictures or screening records. AI services apply their own retention policies to the data they receive. The separate retention rules for saved report pictures are described below.

Reports and pictures

Checkups include the site address, result, findings, evidence, and the checks that completed or could not complete. Posting a checkup for community help makes those details and its pictures public. Your account identity, connection address, and private feedback notes are not published with the report. Page addresses and contact details found on the website can appear in a report. Pictures may show personal details visible on the page. Specific secret checks omit matched secret values from their evidence; they cannot guarantee that every private detail will be detected or removed.

Use a public website address when starting a checkup. We reject addresses with embedded login details or a query after the question mark, because those can contain private information. We remove the fragment after the hash mark. Ordinary links found on the site can still be checked.

Pictures are scheduled for removal from our database after about 60 days. Reports can remain after their pictures are removed. Copies saved by other people can remain available.

Your feedback

Feedback totals, automatic outcomes, and verification guidance follow the report's visibility. They become public when the report is posted for community help. Your note is not published. The engine processes feedback automatically using saved evidence and, for supported disputed availability findings, a limited check of recorded addresses. A current website response does not establish whether an earlier observation was right or wrong.

When AI assistance is enabled, bounded feedback notes and finding details may be sent to the configured AI provider to select verification guidance. We do not send account identifiers with that request. Avoid including private information in your note. Authorized reviewers can also read notes and add an optional, separate public explanation. Votes remain unverified reader responses.

For feedback without an account, a random browser cookie lets you change your answer. We store a keyed digest of that cookie, not its raw value. A separate connection limit slows repeated submissions. Different browsers or cleared cookies can produce different identities, so the totals do not count verified unique people.

Feedback notes remain stored unless you replace your note or we remove the data. We do not automatically delete old feedback. Future scans receive fixed verification reminders selected through automatic processing, never the private notes themselves. Guidance for one site can activate after one processed case. General guidance requires a recurring pattern across at least three sites and three signed-in accounts. Guidance expires after 90 days unless supported by newer processed feedback. This adapts the engine's instructions; it does not retrain model weights or rewrite saved reports. Optional human reviews can still supply separate evaluation examples.

Your conversations with wekup

A verified account is required to talk with wekup. Your messages and AI replies are private to your account in the app. Sutros stores them so you can return to the conversation. We do not automatically delete old conversations. Contact us below to request removal.

When AI assistance is enabled, your current message, a limited recent conversation history, and relevant website evidence are sent to the configured AI provider to write a reply. We do not include your account identifier, name, or email from your profile. Anything you type can be sent, so avoid sharing passwords, personal details, or private links.

When you challenge a finding, wekup can make a limited new check of addresses already recorded in the report. New evidence assessments follow the report's visibility. Your chat text and AI reply are not published in those assessments. A new assessment appears beside the original finding; it does not change the saved grade or signed evidence.

Statements that a finding is right or wrong can also update your feedback for that finding and enter the automatic process described above. Questions alone are not votes. Later checkups receive selected verification reminders, not your conversation. This changes the engine's guidance without retraining the AI model. Rechecks may be inconclusive, and AI replies can be mistaken.

Your account

If you create an account, we store your email address and optional profile details. Google or GitHub sign-in also provides a profile ID, name, and avatar. Passwords are stored as salted hashes. We keep the account association with your checkups so you can find them again and manage your bulletin posts. These account details are not published with reports or posts.

We use your email for account verification, password resets, and messages you request. When AI assistance is enabled, public website observations may be sent to the configured AI provider to help explain them. Account identity and private reader notes are not part of those report-writing requests.

The bulletin and helper directory

A confirmed account is required to publish a help post, offer help, or join the helper directory. Posting a checkup is your choice. Bulletin notes, offers, and the contact details you submit are public. Helper entries publish the name and contact details you enter. Email contacts must match your confirmed account email. We check that website links return a readable public page; that check does not establish who owns the website or whether a business is legitimate.

You can remove your help posts and helper listings from your account. Removing a help post hides its offers and makes the report private again, including its evidence, pictures, badge, and feedback. Copies already saved by other people can remain. Removed entry records remain in our database for posting limits and support; contact us to request deletion from storage.

Cookies and connection records

The sign-in cookie lasts up to 30 days and can renew while you use your account. Google and GitHub sign-in use a separate temporary cookie for up to 10 minutes. The feedback cookie lasts up to 90 days. These cookies support account access and feedback.

Account session records include the connection address and browser information. A session can expire without its database record being deleted. Technical logs may also contain connection details and timestamps; the app does not enforce an automatic retention period for those logs. We do not publish these records.

Site owners

If your site was checked and you would like a report taken down or your site excluded from future checkups, email us and we will do it.

Contact

Questions or requests: vedh@kanos.biz.