What this tool collects

Scout is a free tool with a short list of data behind it. This page is that list. Last updated 3 November 2026.

When you run a report

Scout is free and asks for nothing - no email, no account. We do keep a record of every run, and this is it: the website address you entered, where it resolved to, the market and depth you chose, what Scout worked out that the site sells (its product, category and audience), the competitors it found, how many pages and keywords were in each tab, what the run cost us, when it started and finished, and the full report.

Why we keep it. This is how CoreAEX sees who the tool is useful to and what they sell - which is the thing we would otherwise have to ask you for your email to find out. We would rather keep the tool free and read the runs.

We also store a one-way hash of your IP address - not the address itself - so one visitor cannot start unlimited paid runs (3 a day). The hash cannot be turned back into an address.

Run data, the report included, is deleted automatically after90 days. Data we fetch about a domain from our search-data provider is reused for up to 7 days, so re-running the same site costs nothing, and is deleted on the same schedule.

If you ask us to email you the report

There is a box under every finished report that emails you a copy. It is optional and buys nothing: the whole report is already on the page whether you use it or not.

If you do use it, we store the email address you give us, your name and company site if you fill them in, the domain the report was about, and whether you ticked the marketing box. We store the exact sentence you were shown next to that box - "Send me occasional CoreAEX tips on content and SEO. Unsubscribe any time." - together with the time, because consent that cannot be reproduced word for word is not evidence of consent.

We use your email to send you that report. We only send anything else if you ticked the box. To stop marketing emails, reply to any of them or write to zarko@coreaex.com. We do not sell or share your details.

Cookies

One cookie, and only once you start a run or connect an account. It ishttpOnly (JavaScript on the page cannot read it) and it holds a signed random id and nothing else - no email, no name, nothing derived from you. It lasts90 days, and it is there so a run can find the account you connected to it.

There are no advertising or analytics cookies on this tool, and no third-party tracking scripts - you type other people's domains into this thing, and that is nobody else's business.

If you connect another account

If you connect Google Search Console, we store a token that lets us read your search query data - read only, and nothing outside Search Console. If you connect an Ahrefs key, we store that key. Both are encrypted at rest and are used only while one of your own runs is executing. Disconnecting revokes them immediately.

What we do with what comes back is narrower than for anything else on this page. Search Console queries and Ahrefs data are yours, not ours. They are used for one thing: building the report you are waiting for. A run that used either is marked as such, and the numbers that came out of it - the competitors, the per-tab counts, the keywords - are left out of every internal report, export and total CoreAEX looks at. We can see that the run happened, on which domain, in which market, and what it cost us. Not what your own data said.

If you ask for Search Console early access. Google is still verifying our app, and until it has, Google only signs in accounts we have added to the app's test-user list by hand. So the card asks for the Google account address you use for Search Console. We store that address, the site you gave with it, the random id in the cookie above, and whether you ticked the marketing box - with the exact sentence you were shown next to it. The address is used for two things: adding you to that list in Google's console, and emailing you once it is done. If you ticked the box we may also send the occasional update; if you did not, we will not. Ask us at zarko@coreaex.com and we will delete the record and take the address off the list.

It is deleted with the rest of the run after 90 days, and the credential itself the moment you disconnect.

Who else sees it

• DataForSEO - receives the domains and keywords we look up. It does not receive your email.
• Anthropic - receives your homepage text and keyword lists to sort them. It does not receive your email.
• Google - delivers the report email, and holds the leads sheet.
• Cloudflare Turnstile - checks the Run button is a person, not a script.
• Our database is hosted by Neon, in the United States.

Having it deleted

Email CoreAEX and ask. If you gave us an email address, write from it and we will delete that record and any connected credentials.

If you never gave us one - which is the normal case - tell us the website address you analysed and roughly when, and we will delete the runs for it. There is nothing linking those runs to you as a person, so the domain and the date are what we can find them by. Run data older than 90 days is already gone.

Data: DataForSEO