Version: 2026-10-29.1
Publisher: Eray Turan. Contact: auditmoth@bitswot.com, +90 850 255 0318. Address: Çağlayan Mahallesi, 2017 Sk. No: 11, Muratpaşa, Antalya, Türkiye.
This notice covers the AuditMoth desktop application. Website hosting and emails you send for support are separate data flows from scan reports that remain on your device. If you attach a report to a support request, the attached data is also sent to the recipient.
Scan targets, selected settings, findings, reports, scan history and batch job information are stored in the application's user data area on your device. The agreement acceptance record contains the agreement version, a hash of its text and the acceptance time. The operating system and third-party tools' own network behavior must be considered separately.
Lighthouse runs on your device using Node.js bundled with the application and Google Chrome or Microsoft Edge installed on your device. The Google PageSpeed API, a AuditMoth scan server and a server-side report cache are not used. The target URL and report are not uploaded to an analysis API for this purpose. The browser connects to the target site and the resources it loads. Each scan uses temporary, independent browser profiles; your personal browser profile and sessions are not used. Reports retained from previous versions preserve their original measurement provider and time information.
Scanning sends requests to the target site and its resources. Target and resource providers can see your IP address, request time and the HTTP information sent. DNS resolution and DNSBL queries use the operating system's/device's DNS configuration; information about queried domain names and IP addresses is sent to those providers. Session information or headers entered by the user may be sent to the selected targets. Use targets containing sensitive information only if you are authorized to do so.
The distribution package includes Node.js and Nuclei; Chrome, Edge and Chromium browsers are not bundled or automatically downloaded by AuditMoth. If Chrome or Edge is not installed, browser-dependent checks are unavailable; other analyses continue to work. Preparing Nuclei templates may connect to GitHub services. Selected Nuclei templates may also send requests to services other than the target. Templates using out-of-band verification may process unique test addresses and connection information through callback services such as Interactsh; do not assume all Nuclei traffic goes only to the target server. The installed browser's update behavior and connections to its provider depend on its own settings and its provider's terms. AuditMoth uses options that reduce background connections during scans; these do not guarantee that all provider connections are blocked. Inter and Space Grotesk fonts are bundled locally with their OFL licenses; the interface does not connect to Google Fonts to load fonts. The Technology tab uses local letter indicators instead of external brand logos. Providers' own privacy terms apply. This notice does not guarantee the absence of all third-party telemetry behavior.
The audit uses separate browser contexts for initial-visit, accept and reject scenarios. Reports include observed cookie names and security attributes, network request domain/type/timing information, and local/session storage keys. Cookie values may be read temporarily to verify supported consent signals; those values are not included in the privacy report. An observed third-party connection alone is not proof of tracking or unlawful activity.
Downloading a report or an export prepared for AI does not, by itself, upload the file to an AI service. You choose whether to share it. Exported data may contain domain names, URLs, technical findings or personal data. Anonymization options do not eliminate all re-identification risks. Community data submission is not enabled in the current application.
You can clear history using the application's history deletion features. Exported files, backups, tool caches and the agreement acceptance record may not be deleted by this action. These can be removed separately from the relevant files on your device. Uninstalling the application may not automatically delete user data folders on every platform. No fixed automatic deletion period applies to local files.
You can send requests concerning data processing carried out by the publisher to the contact address above. Local reports that the publisher cannot access must be managed on your device. This notice does not limit rights under applicable law. When data flows change, this notice is updated with a new version number. The notice in the application package describes the behavior of the version you downloaded; the website text may be newer.
The local MCP connection is off by default. Connected AI clients can access saved scan summaries, sanitized module/finding details, historical comparisons and AI notes for the domains you permit. History reading, scan initiation and Markdown note writing are separate permissions. Existing sharing preferences do not automatically grant scanning or writing. You may pre-authorize scanning new domains with selected profiles; this permission also covers reading and annotating all saved scans for domains added this way. Active security profiles and private network targets require additional permission.
Domain names remain visible; URL paths/queries, cookie/storage contents and secrets are limited or sanitized in detail tools. Masking does not guarantee complete anonymity or removal of every secret. Markdown AI notes are stored and shared with authorized clients as written; do not include secrets in notes. The client may send reports and notes to its provider; usage, retention and model-training terms depend on that provider and your account settings. AuditMoth does not call a model provider API or read your account keys through this connection.
Permitted scans send network requests to targets and may continue in a local job process after the app window or AI connection closes. The client connects over STDIO; the local scan coordinator listens only on this device's loopback address and uses an access key stored in your user application directory. Job records, permissions, Markdown notes, revisions and source references are stored on the device. Temporary export resources remain accessible for 24 hours; expired files are cleaned during the next export. Deleting notes or history removes the related application records; scans containing notes are preserved during automatic history trimming.
You can remove permissions in Settings, cancel jobs in AI scans and delete notes from the corresponding report. History deletion is not exposed through AI tools. Revocation prevents subsequent access and causes queued/running scans that are no longer permitted to be stopped. Copies already transmitted to clients or downloaded as exports cannot be recalled.
In direct-distribution builds, Settings offers manual update checks and an optional automatic check, disabled by default. When enabled, AuditMoth checks at most once a day while open. Requests go to GitHub-hosted update feeds and release downloads; these providers can receive your IP address, request time and technical request metadata. AuditMoth does not include scan targets, domain selections, reports or AI content in these requests. Sparkle system profiling and automatic package installation are disabled. Available updates are shown by the native updater; downloading, installing and restarting require your confirmation. Updates wait for scans and local MCP sessions to finish. App Store builds do not use this updater.