Legal
Privacy Policy
Last updated: 18 August 2026
Norr is a website security scanner. This page explains what happens to information when you use it. The short version: we don't store your scans, we don't use cookies, and we never have accounts or passwords to lose.
What happens when you run a scan
- You type a website address. Your browser sends it to our server — never directly to the site being scanned.
- Our server requests that address the way a browser would, and reads the response: the status code and the security headers.
- We work out the letter grade from those results, in our own code.
- We ask an AI service to write plain-English explanations of the issues found (see below).
- We send the results back to your browser and display them.
We do not keep the address you entered, the results, or any history of scans. Nothing is written to a database, because there isn't one. Close the tab and the result is gone.
What we send to the AI service
The plain-English explanations and fix prompts are generated by a language model accessed through OpenRouter. We send it only the types of issues found — for example “missing Content-Security-Policy header” — along with a severity level and a generic description of what that kind of issue means.
We do not send the website address you scanned. The AI service never learns which site the findings came from.
OpenRouter processes that request under its own privacy policy.
Analytics
We use Vercel Web Analytics to count page views, so we can see how many people visit and which pages they land on. It records the page viewed, the referring site, and a coarse country and device type.
It sets no cookies and does not follow you across other websites. We see aggregate numbers only — not individual people. Scanned URLs are never sent to analytics.
Cookies
Norr sets no cookies, and stores nothing in your browser.
Hosting and server logs
The site is hosted by Vercel. As with any web host, Vercel keeps short-lived operational logs — things like IP address, timestamp, and which page was requested — in order to run, secure, and debug the service. That happens under Vercel's privacy policy.
Accounts
There are none. You don't sign up, and we never ask for your name, email, or payment details to run a scan.
Your data rights
Because we don't store scans or personal information, there is nothing for us to look up, export, correct, or delete on request. If you believe that's wrong, or you have a question about this policy, email us and we'll answer.
Changes to this policy
If any of the above changes, we'll update this page and the date at the top.
Contact
Questions about this policy: contact@usenorr.com