Privacy & data
Service operator and contact
Pietro Petrocchi
Maestri Comacini 29B, 6834 Morbio Inferiore, Switzerland
info@sitemapxml.app
About this service
SitemapXML is a free service for generating and inspecting public XML sitemaps. Location: Switzerland. No account or payment is required.
Data used to run an analysis
We process the submitted URL or XML, analysis results and a technical session identifier. Results are accessible through the browser session that created them for 24 hours. The submitted input is removed when processing finishes. Do not submit confidential XML, credentials or URLs containing access tokens. We also keep daily aggregate counters for tool page views, scan starts and outcomes, exportable URL counts and XML downloads. These counters contain no submitted URLs, email addresses, IP addresses or individual visitor identifiers. A marker in the existing technical session counts sessions starting scans once per day; it does not identify unique people. Aggregates remain after individual reports are deleted.
Requests to the analysed website
An analysis of an online resource sends HTTP requests from our server to the submitted website. The receiving server can record those requests in its own logs. SitemapXML only accepts public HTTP and HTTPS resources.
Access, downloads and browser sessions
A result is associated with the browser session that started the analysis. Copying its address into a different browser does not give that browser permission to read it. Clearing session cookies can prevent you from reopening the result, so download the XML or export the rows you need while access is available. A downloaded file is stored on your device and is outside the result retention process. The public tools, guides and example sitemap can be read without starting an analysis. When you supply an online sitemap, its public address is requested by our server; when you paste XML, do not include information you would not want processed by the service. Before submitting content, inspect query parameters, temporary download addresses and embedded credentials. Prefer the public canonical URL instead of links copied from an administration panel, private preview or signed sharing screen. The crawler cannot use your personal login to visit protected pages. XML can also contain addresses you did not intend to share, so check its entries before pasting or uploading a file. Exported spreadsheets and copied rows can be shared independently of the original result; check their contents before forwarding them to anyone.
Domains in scan requests
To understand and improve tool usage, we separately record the normalized domain of the initial address in online scan requests, the UTC day and a count. These counters contain no paths, query parameters, fragments, email or IP addresses, session identifiers or report identifiers. We do not extract domains from pasted or uploaded XML. www is merged with its corresponding domain; other subdomains remain distinct. Only the private dashboard displays these data, limited to the last 30 UTC calendar days; older rows are deleted from the active database hourly. Provider backups may retain earlier copies under their own retention policy. Personal domains may be personal data: this collection is not described as fully anonymous and is not used to derive sales contacts. For data requests contact info@sitemapxml.app.
Optional email delivery
If you request email delivery, we process your email address solely to send that analysis result. The address is encrypted in the application database, excluded from analytics and queue payloads, and removed after one delivery attempt or, if unprocessed, after 24 hours plus the next minute-based cleanup. A technical delivery status remains with the report for up to 24 hours. Delivery uses OVHcloud SMTP; the provider receives the recipient address and XML attachment and may retain its own delivery and security logs. Hosting backups may contain earlier encrypted records until those backups expire. Deletion from the live database does not recall delivered messages or copies in your mailbox. No marketing subscription is created. Contact info@sitemapxml.app to exercise your data protection rights. Abuse prevention also uses pseudonymous HMAC keys, separate from aggregate analytics: recipient keys are valid for up to 24 hours and IP address keys for one hour.
Matomo analytics
We use Matomo at analytics.pietropetrocchi.it with tracking cookies disabled before page tracking starts. Page visits and link interactions are measured. The application also records aggregate daily page-view counts. This setting does not assert that all analytics data, including IP addresses, is anonymised.