What gets scanned on upload, and where it goes

Before a trial site is served for the first time we automatically check its visible text for abuse: phishing, imitation of banks or brands, scams, malware, illegal content. We put your site under our own domain, so we want to know what will be there.

Only the visible text goes out, at most around 12,000 characters, no images, code or file names. It is sent to Anthropic, which does not train on it and deletes it within 30 days. A normal site of a hairdresser, a practice or a shop passes; so do empty pages, test text and half-built sites.

If a site is blocked you get an HTTP 422 with error blocked and a short reason. A person looks at every block. Think it is a mistake? Reply to the email or open a ticket at /support and we check it by hand. Trying to get around the check is not an option; it is fail-closed by design.

The same check runs on the start page of an app after its first start.