Privacy Policy
Last updated July 2026
This is an interim policy — it hasn't had legal review yet — but it is accurate: it describes what Rollouts actually collects and does today, not a boilerplate wish list. The short version: we hold your email, your password (hashed), the scan data for the site you connect, the starter sites you generate, and — only if you install our counting snippet on a site you control — anonymous, aggregate visit counts for it. Nothing is sold, and nothing is sent to ad networks.
Information we collect
Your email address and a password. The password is stored only as a scrypt hash — we never keep or see the plaintext.
The domain you connect, its ownership-verification token, and the scan data Rollouts produces about it — page checks, scores, findings, and the activity feed.
If you use the site builder: the brand details our slurp extracts from the URL you point it at, the starter sites it generates, and — when you choose to publish one — the published copy. A credits ledger records what your account spent on builds and scans.
If you install the optional analytics snippet on a site you control: aggregate daily counts only — pageviews, session counts, top paths, referrer hostnames, and your goal counters. We store no IP addresses, no user agents, no cookies, and no per-visitor records of any kind, so there is nothing identifying to hand over or leak.
That's the full list. Rollouts' own pages set no analytics trackers or ad pixels on you, and we don't ask for your name, company, or payment details.
How we use it
To run the service: signing you in, verifying you control the domain you connect, scanning that site, and showing you the results.
We never sell your personal data, and we send no marketing email.
How scanning works
Rollouts only scans a domain after you prove you control it (a meta tag, a well-known file, or a DNS record).
The scanner fetches your site's public pages, and it honors your robots.txt for every page it discovers on its own.
AI and your data
Our data terms commit that your content is never used to train third-party models.
Data sharing
Your data lives on our hosting infrastructure (Vercel), which processes it under contract to run the service. No other third parties receive it.
Where the law compels it, we will disclose what's required.
Your rights
Everything is self-serve, effective immediately, and built into the product: view your data on the dashboard, download all of it as JSON from Settings → Export your data, or erase your account and every record we hold from Settings → Delete account.
Security
Stored records are encrypted at rest (AES-256-GCM), passwords are scrypt-hashed, sessions are HMAC-signed cookies, and the scanner's outbound requests run through strict server-side request guards.
Questions? Reach us at support@rollouts.ai.