This site does not use cookies.

What we store in your browser

Nothing. No cookies, no local storage, no session storage, no IndexedDB. Nothing is left behind when you close the tab, and nothing recognises you when you come back.

There is also no third-party code on any page: no analytics product, no advertising or retargeting pixel, no A/B testing tool, no chat widget, no embedded video, no hosted fonts, no CDN. Every page is one HTML file served from this domain, with its styling and its few lines of JavaScript written inside that same file. The only requests a page ever sends go to our own addresses on this domain: one as the page opens, so the form can suggest the city you are in, and one when you submit the scan form.

Why there is no cookie banner

A consent banner exists to ask permission for storage that is not strictly necessary - analytics and marketing cookies, mostly. An “Analytics cookies” switch that controls nothing would be theatre, and this is a company that sells measurement. We would rather say plainly that the storage does not exist.

If we ever add analytics, this page will say so, and a real consent banner will ship in the same release.

How to check this yourself

Do not take our word for it. In Chrome, on this page:

1. Press F12 (Cmd-Option-I on a Mac) to open DevTools.
2. Open the Application tab. In the left column, under Storage, click Cookies, then Local storage, then Session storage. Each one is empty for this site.
3. Open the Network tab and reload the page. Every row is aichoosingyou.com. Nothing is fetched from anywhere else.
4. Right-click the page, choose View page source, and search for “script src”. There are no matches: no script is loaded from another site, because no script is loaded from a separate file at all.

The same four checks on most marketing sites return a list of cookies, a dozen outside domains and a tag manager.

What our own server receives

Seven addresses, all of them on this domain, are everything a page here calls. You can watch all seven in the Network tab:

• /api/geo - as a page opens, so the form can suggest the city you are in. The answer is our host’s own reading of the connection your request arrived on. We look nothing up anywhere else, and nothing about that request is written to our database.
• /api/prefill - only if you followed a link from one of our emails. That link carries a short code, the page hands the code back to us, and the form fills in with what we already knew about your business. It is also the moment we count the link as opened. The code travels in the address bar, not in your browser’s storage: delete it from the address and the page behaves like any other visit.
• /api/r - only if you followed someone’s invite link, the one with ?r= in the address. It asks us one thing: the name of the business that sent you, so the page can say who it was. Nothing about you goes with the question, and the answer carries nothing but that name. It is also the moment we count the invite as opened - a number on their side, never your name.
• /api/resolve - only if you paste a website address into the first field of the form instead of a name. Our server opens the front page of that site once, from our side and not from your browser, reads the business name written on it and shows the name back to you to confirm or change. The site you pasted sees a request from our server; it learns nothing about you. Nothing is stored at this step - the address itself is saved only when you submit the form.
• /api/scan - when you press the button on the form, and not before.
• /api/badge-check - only on a customer’s own badge page (/b/, reached by its own link), and only when that customer presses Check my badge. Our server opens the one page of their site they gave us, from our side and not from your browser, and looks for the badge. Nothing about the visitor goes with it.
• /api/e - twice per page at most: once as the page opens, once as you leave it. It carries counters, not you: which page, which blocks of it came onto your screen, which buttons were pressed, how far down the page you reached and how many seconds the tab was in front of you. No name, no address, and nothing that would let us recognise you on a later visit - the page makes up a random number for this one visit and forgets it when the tab closes. These counters go to our host’s aggregate store, separate from the database that holds form submissions. If you followed a link from one of our emails, the short code from the address bar travels with them, so we can see how that email performed. And if your browser sends “Do Not Track” or Global Privacy Control, this address is never called at all.

One more address of ours is reached from other people’s sites: /badge/img/, the small badge image a customer may put in their footer. When their page loads it, the browser asks our server for the picture, the way it asks for any image. We keep only a count of how often each badge was drawn and from which site - never the address of the person looking at it - and the image sets no cookie and stores nothing.

The form is the only place this site collects anything about you. When you submit it we receive what you typed - business name, city and state, website, trade and work email - and store it in our own database, so that we can run the scan and email you the result. Stored beside it is what any web server receives with a request: your browser’s user-agent string, and the country, region and city our host works out from your connection.

The result email is sent through our mail provider. We do not sell any of it, and we do not hand it to advertising networks or data brokers.

Our host

The site runs on Cloudflare Pages. Cloudflare may set a short-lived security cookie of its own, named __cf_bm, when it has to tell a person from a bot. That one comes from the network in front of our site rather than from our pages, it carries no advertising profile, and we cannot read it.

If this ever changes

This page changes first. Anything that stores data in your browser has to be written down here in the same release - and the build itself refuses to publish a page that calls out to a domain that is not ours. That part is a test, not a promise.

Last checked: 7 September 2026. Questions about any of this: the address below.