What we do with your data
This page exists because the site asks for two things, a URL to scan and an email address to send the report to, and asks permission for more: an analytics cookie, session recording and ad pixels. You are entitled to know what happens to each before you agree.
It is deliberately short. A policy long enough to be unreadable is a policy nobody reads.
Who we are
go-find-out is built and run by Broscorp LLC, Kosmichna str. 49b, office 333, Dnipro, Dnipropetrovsk Oblast 49000, Ukraine. We decide what is collected and why, which makes us responsible for it. Write to contact@broscorp.net about anything on this page.
What we collect
A URL, when you paste one into the scan box. We load that page in a real browser and record what its tags did. We store the URL and the findings so we can send you the report. Why we may: you asked us to scan it.
An email address, if you ask for the full report. We use it to send you that report, and to tell you once when the production product opens. Nothing else. It is not sold, rented, or added to a list you did not ask for. Why we may: you gave it to us for that, and you can take that back at any time.
The form that takes it is HubSpot’s, shown under a scan result on the scan page and nowhere else. It runs inside a frame served from HubSpot’s own domain, so what you type goes straight to our HubSpot account, which is hosted in the US, not the EU. The scan page itself never sees the address; our analytics records only that the form was sent.
Which pages were viewed, and whether a scan was run. This site and the scan page use PostHog, product analytics, on its EU servers. It records page views, that a scan was started, how long it took and whether it completed (never the URL you typed or what the scan found), plus a rough location derived from your IP address, never the address itself. Unless you choose “Allow” in the banner, nothing else you click or type is recorded. Why we may: we have a legitimate interest in knowing whether our own site works, and this is the narrowest way to find out.
Unless you allow it, PostHog stores nothing on your device. The random ID that ties one page view to the next lives only in the open tab and is gone when you close it, so we cannot tell a returning visitor from a new one. That is why it runs whether or not you allow anything in the banner. It reaches PostHog through our own address, demo.gofindout.page, which passes it on unchanged and passes on none of our cookies.
If you choose “Allow”
One “Allow” in the banner covers everything in this section and the next. Until you choose it, none of it happens. Why we may: you said yes, and you can say no again at any time.
An analytics cookie, so we know when you come back. PostHog sets one cookie,
ph_*_posthog, on gofindout.page and the scan page alike, holding the random ID
that ties your visits together. It lasts six months, the same as your answer to
the banner. While a tab is open it also keeps that tab’s own ID in your
browser’s session storage, which is cleared when the tab closes.
A recording of your visit. PostHog records how you use this site and the scan page: what you scroll and click, and what is on your screen as you do. On the scan page that includes the URL you scanned and what the scan found. That is the point of it: it is how we find out why people who run a scan do not go on to ask for the report. It does not record anything you type into a box on our pages, which is masked before it leaves your browser, or the email form, which is HubSpot’s frame and cannot be recorded from our page. It goes to the same EU PostHog project as the analytics above.
Advertising pixels
We advertise on Reddit and Google, and to know which ads work we use their pixels: small scripts from Reddit and Google. They load only if you choose “Allow” in the banner, the same “Allow” as above. Until then, nothing of Reddit’s or Google’s is fetched from this site or the scan page. Why we may: you said yes, and you can say no again at any time.
If you allow them, they report three things to Reddit and Google:
- that you visited a page on gofindout.page or the scan page,
- that you submitted a scan, and
- that you asked for the report.
Never the URL you scanned, what the scan found, or your email address. On the scan page the pixels run in a separate, empty frame that cannot see the result or its address.
Scans and report requests are also reported to Reddit from our server,
under the same permission. When you submit a scan, or ask for the report under
a result, the scan page tells Reddit directly that it happened, along with your
IP address, your browser’s details and the _rdt_* IDs Reddit’s pixel set on
our domain, so it still counts when a browser blocks the pixel. Each carries an
ID that lets Reddit count it once, not twice. Never your email address. It is
sent only if you allowed the pixels before submitting.
Loading their scripts also gives Reddit and Google what any website request
gives: your IP address and your browser’s details. They set their own cookies
(_gcl_* for Google, _rdt_* for Reddit) to recognise a visitor who came from
one of our ads, and they use what they collect to tell us which ads worked and
to show our ads to people who have visited. What they do with it is governed by
Google’s privacy policy and
Reddit’s privacy policy, not
this one. Both companies are in the US.
Changing your mind. “Cookie settings”, at the foot of every page on this
site and the scan page, reopens the choice. Turning it off stops the recording
and deletes the analytics cookie and the pixels’ cookies from our domain; from
then on PostHog is back to storing nothing. One cookie of ours, cc_cookie,
remembers your answer for six months, on this site and the scan page alike, so we do not ask
on every page. If your browser sends a
Global Privacy Control signal, we treat it
as “Reject” and do not ask at all.
If you install the HubSpot app
The app is invite-only for now. We install it with portals we work with directly while we work toward a public listing on the HubSpot App Marketplace. How to install it, and what each permission is for, is on the HubSpot app page. This is what it holds for each HubSpot portal it is installed in. Why we may: the portal installed it to get these checks, and they cannot run without it.
The connections you authorise. The HubSpot connection and, if you add one, the Google Ads connection. Both are stored encrypted and are used for nothing but reading your portal and your ad account for the checks. They never appear in a log or a report.
Findings, not contacts. A run reads recent contacts, form definitions and your ad account’s conversion settings, checks them, and keeps only the result: which checks failed, with the counts that show it. It does not keep the contacts it read. Everything a run collects is thrown away when the run ends, apart from a window of at most 48 hours kept to debug a run that failed.
One store per portal. Everything we hold for a portal lives in a store that belongs to that portal alone, hosted on Cloudflare. No other customer’s data is in it, and nothing of yours is in theirs.
Data from Google. go-find-out’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: what we read from your Google Ads account is used for your checks and nothing else, it is not sold, not used for advertising, and not used to train any model. A person here sees it only to debug a run that failed, inside the 48-hour window above.
What we do not do
We do not scan a page you have not given us. We do not append a synthetic click ID to a URL you paste. Doing so would register a paid session in your own analytics, and we will not do that to a page without being asked.
The CRM and ad-account checks need a connection you authorise explicitly. Until you do, we cannot see either, and after you do, every check is a read. Nothing is written back to your systems. Your HubSpot and Google data is not sold, and is not used to train any model.
Who else handles it
Every company that touches your data on our behalf, and nothing beyond them:
| Who | What for | Where |
|---|---|---|
| Cloudflare | Hosts this site, the scan page and the browser that runs a scan, and stores scan results and each portal’s data | Global network |
| HubSpot | The email form under a scan result, and the list of addresses it collects | US |
| PostHog | Product analytics; its cookie and session recording only if you allow it | EU |
| Ad measurement, only if you allow it | US | |
| Ad measurement, from the pixel and from our server, only if you allow it | US |
Where data leaves the EU for the US, it goes under the safeguards those companies offer for EU personal data: the EU–US Data Privacy Framework, or the European Commission’s standard contractual clauses.
How long it is kept
Scan results: 24 hrs.
HubSpot app findings and connections: until you uninstall the app. Uninstalling deletes the portal’s whole store at once.
Email addresses: until you ask us to remove yours, or until the waitlist they were collected for is closed, whichever comes first.
Analytics events: they sit in our PostHog project on its EU servers. Nothing in them names you, but if you allowed the analytics cookie, its ID in your browser lets us find your visits: ask and we will look.
Session recordings: 30 days in our PostHog project, then deleted.
Ad pixel data: held by Reddit and Google for as long as their own policies say. Your consent choice: six months, then we ask again.
Your rights
You can ask us to show you what we hold about you, to correct it, to delete it, to stop or limit using it, or to send it to you in a form you can take elsewhere. You can object to the analytics, and you can withdraw a consent you gave, for the email or for what “Allow” turns on, at any time, without affecting what was done before. None of this costs anything, and we will answer within a month.
For the HubSpot app, uninstall it: that deletes everything we hold for the portal. To remove a Google Ads connection on its own, revoke it from your Google account. For the cookie, the recording or the pixels, use “Cookie settings”. For anything else, email contact@broscorp.net and ask. A person reads it, and you do not need to explain why. We will confirm when it is done.
If you think we have got it wrong, you can also complain to the data protection authority in the country where you live or work.
Children
go-find-out is a tool for people who run ad accounts and CRMs at work. It is not meant for children, and we do not knowingly collect anything from anyone under 16. If you believe a child has given us their details, tell us and we will delete them.
Changes
If this page changes in a way that affects data already collected, we will say so to the address we hold for you rather than quietly editing this page.
Last reviewed: 2026-10-12. This page is in development alongside the product