Evidence Engine Watch the walkthrough

Privacy

Privacy

Evidence Engine · 28 October 2026

Evidence Engine is a Windows desktop app that checks a site from your own PC. Your scans stay on that PC.

What stays on your PC

  • Every scan, finding, screenshot, audit record, and export is stored only on your PC, in your Windows user profile.
  • A password you type for HTTP Basic Auth is kept in memory for that session and is not written to disk. Evidence Engine does not collect the website-login password. You enter it directly into the isolated browser.
  • When you are signed in for a scan, the site's session storage is copied in memory so a recheck in that same sign-in can see it. That copy is not written to disk and is dropped when the sign-in session ends.
  • The app has no analytics, tracking, or telemetry.

What the app sends

  • To the site you scan: the built-in browser opens the pages you point it at, from your PC. The app also sends header-only requests to that site to check links. If you signed in for the scan, that site's own cookies go with them, and only to that site.
  • To Lemon Squeezy, for the license only: activation sends the license key, an instance id for that activation, and a name built from the PC name ("Evidence Engine on" followed by that name), so the activation can be told apart from another PC. About once every 7 days, at the start of a scan, the app sends the key and the instance id to confirm the license is still active. Deactivate on this PC sends those same items to free the seat. This does not make the buyer anonymous. Lemon Squeezy already has the name and email from checkout.
  • To other hosts the scanned pages use, whatever options you choose: a page you scan loads scripts, images, fonts and similar resources from other hosts, and a page can redirect the browser to another site. The built-in browser requests those exactly as any browser opening that page would, from your PC and its network address, so those hosts can see the request. Evidence Engine does not send your Basic Auth password or the scanned site's cookies to them: those go only to the site you scan.
  • To other sites your pages link to, only if you turn the option on: the optional link check asks up to 25 (at most 100) addresses on other sites whether they answer. For each address it sends an anonymous HEAD request, and a GET request if the site refuses HEAD. If the address redirects within that same site, each further hop is another request to that site; a redirect to a third site is reported and not followed. No cookie, login or session is sent, and Basic Auth is never sent. Those sites can see the requests and your PC’s network address.
  • To Google, only if you choose PageSpeed Insights and agree on the screen that says so: the address you choose is sent to Google’s PageSpeed Insights service, with your own Google key if you saved one. The key is stored encrypted on your PC and is never shown again. An address written as a local name or as a private-network IP address (IPv4 or IPv6) is refused before anything is sent. Names are not looked up first, so a public-looking name that points to a private address is not caught by Evidence Engine; Google’s servers simply cannot load it and the answer says so.
  • The scan may also read the scanned site’s /robots.txt and sitemap files, which are requests to that site.
  • Buy and the customer portal open Lemon Squeezy in your own browser.

If the PC is offline, scanning continues for up to 30 days after the last successful license check. Trial terms state how that interacts with trial expiry. After that offline period, the next scan needs one online check. Reports already stored on the PC do not need it.

Payments

Lemon Squeezy is the merchant of record. It collects the name, email, billing address, and payment details. Evidence Engine QA receives the order details Lemon Squeezy shares with sellers, such as the name, email, and order. We do not receive the full card number. Lemon Squeezy's own notice is its privacy policy.

This website

These pages set no cookies and load no analytics and no third-party scripts. The only script blocks are the product details search engines read (name and Windows); the browser does not run them. When the site is published, the host may keep ordinary server logs, such as the page address and the time. Those logs are not used to build a profile.

Contact

Privacy questions: evidenceengine.support@gmail.com.