Privacy

A domain name, and optionally an API key. That’s the whole input. We don’t have accounts, we don’t ask for your name or email to run a scan, and there’s nothing to sign up for.

A scan queries the domain’s authoritative nameservers, mail servers and web endpoints, and stores the resulting report so it can be shared and compared over time. Each report gets a share URL. That URL is unguessable but not secret: anyone who has it can read the report, and reports are not password-protected.

Reports and their change history are kept indefinitely, so a domain’s history stays comparable over time. You can have a domain’s history removed at any time — see Contact.

Scanning a domain does not add it to any public directory, home-page list or sitemap. Report pages are marked noindex so they stay out of search results. A report is reachable only by its share URL or by scanning the same domain again.

You can scan any domain, because the data is public and the checks are read-only. If you run a domain and don’t want us scanning it, tell us and we’ll block it — see Contact. We honour blocks and don’t work around them.

We use self-hosted Umami to count page views. It sets no cookies, doesn’t track you across sites, and doesn’t build a profile. We use it to see which pages get used, nothing more. We do not use Google Analytics or any advertising or cross-site tracking.

Asked first. If you are in the EEA, the UK or the Crown Dependencies — or we can’t tell where you are — nothing loads until you accept. We also honour Do Not Track and Global Privacy Control: with either on, nothing is loaded and no event is sent, from your browser or from our server. Nothing here needs analytics to work.

A key is optional and only raises your rate limit and moves rate-limit identity off your IP address. We store the SHA-256 hash of the key and its usage counts, never the key itself. We don’t sell, share or mine your query history.

You can link an assistant such as ChatGPT or Claude to your account, so it runs on your account’s rate limit instead of a shared one. Linking needs your email address (to sign you in, as for API keys) and your approval on a screen that names the app and where its access is sent.

For each linked app we keep the app’s name, its client identifier and the addresses it asked us to send you back to — as the app published them, not anything about you — plus your email address, when you linked it and when it last made a request. The access it holds is a pair of random tokens of which we store only SHA-256 hashes; they expire after an hour and thirty days, and expired ones are deleted a day later. The app receives those tokens and nothing else from us: not your email address, not your API keys.

Disconnecting an app on the keys page ends its access at once. What it did with reports it fetched while linked is governed by that app’s own privacy policy.

Like any web service we keep short-lived request logs — timestamp, requested path, response code — to run the service and stop abuse. Your raw IP address is never stored. The only thing we derive from it is a salted daily hash — sha256(address + secret + day), which cannot be reversed to an address — used for rate limiting and re-check enforcement.

Those hashes are deleted after 24 hours. We do not retain IP addresses tied to individual scans — there is no raw address to retain.

Checking a domain means connecting to that domain’s nameservers, web server and mail servers. Those operators will see requests from this service, identified by a User-Agent naming the tool and linking back here. We never send MAIL FROM or RCPT TO to a mail server, so this is not, and cannot be used as, an address validator.

No passwords, no payment details, no third-party cookies, no fingerprinting, and no data sold to anyone.

Our servers are in the United States, and we may also host in Australia.

If this policy changes materially we’ll update this page and its date. The current version is always here. About explains what each check does and why.

Abuse reports, scan opt-out and privacy questions all go through the contact form.