Last updated 13 October 2026.
| Thing | What happens |
|---|---|
| Browsing the site | No account, no tracker. One security cookie from our host, Cloudflare (see Cookies). Page views are counted anonymously. |
| Your first site scan | No account needed. We store the address you scanned and the result. |
| Making an account | With Google or GitHub: your name, email address and avatar, and nothing else. With an email and password: your email, the name you choose, and a one-way hash of your password — never the password itself. |
| Asking for a website | What you tell the assistant or the form — the business, the site, what it should do and how to reach you — is stored so we can reply, and we are notified of it. To recognise a returning request we keep a one-way hash of the contact you gave and of a random id this browser keeps, never the contact itself as a key. |
| QR codes and image codes | Never uploaded. The link, the picture and any logo are read and drawn entirely inside your browser. |
| Selling your data | Never. Not to anyone, for any price. |
| Advertising | We run none, and we place no advertising or cross-site tracking cookies. |
Cash Callin is a digital studio that builds websites, e-commerce storefronts, AI integrations and small games. We are the controller of the personal information described here.
| Trading as | Cash Callin |
| ABN | 78 121 593 082 |
| Based in | New South Wales, Australia |
| Privacy contact | [email protected] |
The company is registered in Australia, which is why Australian law is named in a few places below. A business our size is generally outside Australia's Privacy Act unless it does one of a short list of things — trading in personal information, health services, credit reporting — and we do none of them. We are telling you that rather than quietly relying on it: we hold ourselves to the standard whether or not the law currently compels us to, and where the GDPR or your own country's rules are stricter, those are what we follow for you.
Signing in with Google or GitHub gives us three things: your name, your email address and the URL of your avatar, plus the account identifier that provider uses for you. We ask for no other permission and we cannot read your contacts, files, repositories or anything else.
With Google or GitHub we never receive your password. That is the whole point of signing in that way — there is no password of yours for us to store, and none for us to lose.
You can also make an account with an email address and a password. In that case we store your email, the name you choose, and a one-way hash of your password — PBKDF2-SHA256, 100,000 iterations, with a salt unique to you. A hash cannot be turned back into a password, so even we cannot read yours, and neither could anyone who took a copy of our storage. (100,000 is the ceiling the platform we run on allows, not a number we picked to sound good; a higher count is simply refused there.)
An address is only verified once you prove you can read its mailbox — by entering a six-digit code we email you, or by signing in with Google or GitHub on the same address. Until then the account is unverified, and either of those two acts will delete the unverified password and end every session opened with it. That is deliberate: it is what stops someone registering your address before you do and keeping a way in afterwards.
The codes we email are six digits, expire after ten minutes, work once, and are stored only as a hash — the email is the only place the code itself exists. Five wrong attempts and it is destroyed. The same code mechanism resets a forgotten password, and a reset ends every other session on the account.
Those emails are sent through Resend, which therefore sees your address and the message. Nothing else about you is sent to them, and they are listed in the third-party table below.
One thing worth saying out loud: registering with an email and password does not prove the address is yours — nothing is verified until you enter a code we emailed, or sign in with Google or GitHub on that address. Until then the account is marked unverified, and it can be signed into with that password. That is why either of the two verifying acts deletes the unverified password and ends every session opened with it.
We use it to keep you signed in, to attach your scan history to you, and to email you about your own account or a scan you asked for. Not for a newsletter you did not ask for.
Cash Callin Pulse is a browser extension with four tools for the page you are on. What each one reads, and only when you press its button:
cashcallin.net is the only host the extension contacts. It never reads your cookies, your form fields or your browsing history. The last scan is kept in the browser’s session storage so reopening the popup does not start again; closing the browser clears them. There is no analytics in the extension.
We store the address you scanned and the result, so you can look back at it and see whether a site improved. If you send it to us to ask for a quote, we store the email address you gave.
The scan itself is performed by Google PageSpeed Insights on the address you enter, plus our own fetch of that page to see what an AI assistant could read from it. If the address is not yours, be aware that you are asking a third party to fetch it.
Scan results are cached for 24 hours against the address, so scanning the same unchanged page twice does not re-run the measurement. The cache is keyed by the address only — it holds no record of who asked, and anyone scanning that address in that window gets the same stored answer.
The free-scan limit is counted against a one-way hash of your IP address, which expires by itself after an hour. A cached answer costs no work, so it does not count against that limit.
A partner link looks like cashcallin.net/?r=CODE. When you arrive on one, the code is saved in your own browser for 90 days and immediately removed from the address bar, so a link you then share onward does not carry someone else's code. It is attached to an enquiry you later send, so the right partner is credited.
It is not a cookie, it is not sent to any third party, and it identifies nobody: it is a short code belonging to the partner, not to you. Clearing your browser data removes it.
The scan-result email and the Pulse waitlist each send us what you typed into them — usually a name and an email address. We use it to reply.
Joining Referral gives your account a code. Applying for Work stores what you send: your skills, a link to your work, where you are, hours a week and any note, with your account's name and email. For each job you take we keep its status, the agreed amount, the link you deliver and the dates, to review the work and pay you. Your level and record (jobs done, on time) are seen by us and by you, not by other partners. Kept while you are a partner and for as long as tax law requires after; ask and the rest is deleted.
Our host, Cloudflare, keeps standard server logs including IP addresses, for security and abuse prevention. We use those logs to enforce the free-scan limit — the count is stored against a one-way hash of your IP address, and it expires after an hour.
Page views are measured with Cloudflare Web Analytics, which sets no cookie and does not build a profile or follow you to other sites.
The QR studio and the image-code builder run entirely in your browser, on your own device. That means:
This is not a policy promise we ask you to take on trust; it is how the tool is built. You can watch it in your browser's network panel: making a code produces no requests at all.
| Cookie | What it is for | How long |
|---|---|---|
cc_sess | Keeps you signed in. Strictly necessary; set only after you choose to sign in. It holds a random opaque identifier and nothing about you — no name, no email, no permissions encoded in it. It is HttpOnly (no script on the page can read it), Secure (never sent over plain HTTP) and SameSite=Lax (not sent from another site's page). | 30 days, or until you sign out |
cf_clearance | Set by our host, Cloudflare, as part of its protection against automated attacks: it records that this browser passed Cloudflare's check, so you are not checked again on every page. Strictly necessary for security. It is not used for analytics or advertising and we cannot read it. HttpOnly and Secure. | Set by Cloudflare; up to a year |
That is the entire list. There are no analytics, advertising or preference cookies. The small notice you see once says the same thing: it asks you to choose nothing, because there is nothing optional to refuse.
A few small things are kept in your browser's own storage rather than in a cookie. None of them is sent to us, and clearing your browser data clears all of them:
| Who | What they see | Why |
|---|---|---|
| Google / GitHub | That you signed in to Cash Callin | Only if you choose to sign in with them |
| Google PageSpeed Insights | The address you asked us to scan | It measures the page |
| Google Places | The area and kinds of business you search for in the lead finder — not who you are | It returns the businesses. Pulse only |
| OpenStreetMap | On the Lead Studio page only: your IP address, the map area you look at and any place you type into its search box (your browser loads the map and the place search from openstreetmap.org). Our server sends the area and kinds of business you search for to public Overpass servers (overpass-api.de and maps.mail.ru, asked together; overpass.private.coffee and overpass.kumi.systems when both are busy) — not who you are. If our server cannot reach them, your browser asks them directly, and they then see your IP address | The map, place search and the business list |
| The site you copy | When you type an address into the Layout Studio, our server fetches that page, its stylesheets and its fonts — the site sees requests from us, not from you. The page may be opened in a headless browser run by our host, Cloudflare, so that it looks as it does to a visitor. The copy is sent to you and not kept | To make the copy you asked for |
| Cloudflare | IP address, standard request logs | Hosting, security, anonymous page counts |
| WhatsApp, Messenger (Meta) | What you send us there, under Meta's own terms | Only if you choose to message us there; the site only links to them |
| Resend | Your email address and the message we send you | It delivers sign-in codes and password resets |
| Stripe | Your name, email address, and the card details you give it — directly, on Stripe's own pages | It takes the payment for Pulse. Only if you subscribe |
| Our form handler | What you typed into a form | So the message reaches us |
We never see your card. Paying for Pulse sends you to a page hosted by Stripe; the number is typed there and never touches this site or its servers. What comes back to us is a customer reference and whether the subscription is active. That is the whole of it — no card number, no expiry, not even the last four digits.
That is the whole list. No AI company is on it, because no AI company is involved — see the next section.
We do not sell, rent or share personal data with anyone else, and we do not use it to train anything.
This site sells a tool called an AI-visibility scan, so it is fair to ask what AI it is actually using. The honest answer is none.
The AI-visibility half of a scan is plain parsing: we fetch your page's public HTML and its robots.txt and read them with ordinary code. We count the words that exist before JavaScript runs, look for schema.org markup, read the title and description, count the headings and the images without alt text, and check which named crawlers your robots.txt lets in. Every one of those is something you can verify yourself with view-source.
What the scan reports is whether an assistant can read your page. It never claims to know whether an assistant will recommend you, because that is not something this or any tool can measure.
If we ever add a feature that does call a model, it will be described here, named on the page that uses it, and it will be its own separate disclosure — not folded quietly into this sentence.
For anyone in the UK or EU, under the UK GDPR and the EU GDPR:
| What | How long |
|---|---|
| Account | Until you delete it. Ask and it is gone. |
| Scan history | With your account; deleted with it |
| Cached scan results | 24 hours, keyed by the address only — no record of who asked |
| Free-scan counter | One hour, then it expires by itself |
| Lead finder searches | A count of free area searches per day — per account when you are signed in, otherwise per a one-way hash of your IP address — kept about 30 hours; and, for Google searches on Pulse, a count per account per month, kept about 40 days. Without Pulse, the areas searched and the results are not stored: they stay in your browser tab. On Pulse, each finished search (the place name, the area, the kinds and criteria, the counts and, for OpenStreetMap searches, up to 300 of its businesses — open data) and your pipeline (statuses, follow-up dates, notes) are kept with your account so you can open them on any device: the last 30 searches, each for up to about 13 months unless you delete it sooner in your account. Google results are never stored |
| Tool activity | When you are signed in: the last 120 tool events (a tool name, a short phrase, a host name or a count — never what you typed), for up to about 13 months. Delete it any time in your account |
| Sign-in codes | Ten minutes, as a hash, then destroyed |
| Form messages | As long as we are talking, and up to two years after |
| Partner payment records | As long as tax law requires |
| Server logs | Cloudflare's own retention, currently a matter of days |
Wherever you are, you can ask us to show you what we hold, correct it, delete it, export it, or stop using it. In the UK and EU those are rights under the GDPR; in California under the CCPA; in Australia under the Privacy Act. We apply them to everybody rather than sorting people by passport.
Email [email protected]. We will answer within 30 days, usually far sooner, and we will not ask you why.
If you think we have got it wrong, complain to the regulator where you live — your national data protection authority in the EU or UK, the OAIC in Australia, your state Attorney General in the US. We would rather you told us first, and a person reads that address — but you never have to go through us to complain about us.
If we ever have a breach likely to cause you serious harm, we will tell you and the relevant regulator. We would do that whether or not any particular scheme obliged a business our size to.
Wherever you are, your data is almost certainly handled outside your country, because the services this site runs on are global. Rather than bury that in a sentence, here is the list:
| Who | Where, broadly |
|---|---|
| Cloudflare | United States, and a worldwide edge network |
| Stripe | United States, with Australian payment operations |
| Resend | United States |
| Google / GitHub | United States |
Using this site, or subscribing, means personal information about you is handled by those providers, in those places. We choose providers who publish binding terms about it — but no company can control another country's law, and you should know that before you decide, wherever you happen to live.
The site and its data run on Cloudflare's network, which is worldwide. Where data leaves the UK or EEA, the transfer relies on the UK Addendum and the EU Standard Contractual Clauses in Cloudflare's terms.
This is a service for businesses. It is not directed at children, and we do not knowingly collect anything from anyone under 16. If you believe a child has made an account, tell us and we will delete it.
Sessions are held in a cookie your browser will only send back to us, over HTTPS, and which no script on the page can read. The value in it is a random identifier that means nothing on its own. Sign-in runs through Google's own authorisation flow with PKCE, so an intercepted code is useless without the matching secret your browser kept. Passwords, where you set one, are stored only as a salted one-way hash and never in a form anyone can read. We hold no payment card numbers at all — card payments go straight to Stripe, our payment provider, and card details never touch our servers.
When this changes, the date at the top changes. If a change is significant — a new kind of data, a new third party — we will say so on the site rather than edit quietly and hope nobody notices.
[email protected]. A person answers.