Privacy and how scanning works

What a public scan does

Opens your homepage and follows up to two calls-to-action that look commercially important, on a desktop and a mobile viewport.

Fills any form it reaches with clearly-labelled test data, then checks whether the Submit control could actually be used.

Takes screenshots as evidence and records which steps passed.

What a public scan never does

It never clicks Submit. A free scan will not create an enquiry, a booking, an account, or a purchase on a website we have not been authorised to test.

It never uploads files, accepts terms on your behalf, or attempts to bypass CAPTCHA or bot protection.

It does not crawl your whole site. Scans are capped at a small number of pages and rate-limited per domain.

How you can identify us

Our browser sends a user agent containing “FormWatcher/1.0”, so you can identify or exclude it in your logs and analytics.

Test data uses the name “FormWatcher Test”, an address on the reserved .invalid domain, and phone numbers from ranges regulators reserve for fiction (555-01xx in North America, 07700 900xxx in the UK). None of them can reach a real person.

Testing your own website more deeply

Once you have verified you control a domain, you can opt in to full end-to-end testing. Only then will FormWatcher actually submit a form, and the submission is clearly identifiable as a test.

You can turn this off at any time, and it is off by default.

What we store

Screenshots and the results of each test, so you have evidence and history. Reports are reachable only through an unguessable link and are never indexed by search engines.

Your account email and, if you subscribe, a customer reference from our payment processor. We never see or store your card details.

Deleting your data

Removing a site deletes its scans, screenshots and incident history. Closing your account removes everything associated with it.