Privacy Policy

The short version

We do not require an account, we do not sell data, and we do not build advertising profiles ourselves. The tools need the domain, host, or IP you submit in order to run the check you asked for, and that is essentially all we handle.

What you submit to the tools

When you run a check, the domain, hostname, IP address, URL, or pasted email headers you enter are sent to our server so it can perform the lookup. This input is used only to produce your result. We keep short-lived in-memory caches (typically minutes, up to an hour for WHOIS) so repeated identical lookups are faster; these expire automatically and are lost whenever the service restarts. We do not write your queries to a permanent database and we do not associate them with you.

Tools under /utilities run entirely in your browser. Passwords, hashes, JWTs, and JSON you paste there are never transmitted to our servers at all.

Server logs

Our web server keeps standard access logs — IP address, timestamp, requested path, user agent — which are used for rate limiting, abuse prevention, and debugging. Rate limiting also keeps a short-lived in-memory counter keyed to your IP address.

Third parties the tools contact

Some checks necessarily query systems we do not control, and those systems see the query:

• Public DNS resolvers, including the 85 resolvers used by the propagation checker.
• Cloudflare and Google DNS-over-HTTPS endpoints for record types a stub resolver cannot request.
• WHOIS/RDAP registry and registrar servers for domain lookups.
• Public DNS blocklist operators for blocklist checks.
• RIPEstat for ASN lookups.
• The host you name, when you ask us to test a port, TLS certificate, HTTP headers, or redirects.

Analytics

We keep first-party, cookie-free counters of a few events (a check started, a check finished, a next-step link clicked, an alert requested). Each event is a name and a date — never the domain, address, or text you entered, and never an identifier for you. They tell us whether the tools work, nothing about who used them.

We also run Umami, an open-source analytics tool hosted on our own server, to count page views. It sets no cookies, stores no identifier for you, and receives the page path without its query string, so the domain or address you look up is never included. Do Not Track turns it off.

Separately, optional Google Analytics 4 measures page visits only after you choose “Allow analytics”. We do not load the Google tag or send analytics requests before permission. You can decline or withdraw permission using “Analytics preferences” in the footer. All tools work without it. Global Privacy Control and Do Not Track keep Google Analytics off.

Google Analytics receives a fixed page title, an approved page path or page group, the referring website origin, and technical information such as browser and device details. Google processes your IP address when receiving a request. We exclude URL queries, fragments, lookup targets, email addresses, pasted text, and form entries. Advertising features and Google signals are disabled. Your choice is stored locally for 183 days; analytics cookies also expire after 183 days. Withdrawing consent stops measurement and removes accessible Google Analytics cookies.

Advertising

This site may display advertising from Google AdSense to keep the tools free. When ads are enabled, Google and its partners may use cookies or similar technologies to serve and measure ads. Where required by law — including for visitors in the EEA, UK, and Switzerland — consent is collected through a Google-certified consent management platform before any personalised advertising is served, and you can change or withdraw that choice at any time through the consent controls on this site.

You can review Google’s own practices at policies.google.com/technologies/partner-sites and opt out of personalised ads at google.com/settings/ads.

Local storage

Your browser’s local storage holds a few conveniences: your light or dark theme choice, the last targets you checked and any you starred (so the “Saved” page and result comparisons work without an account), whether you closed the alert offer, the day of your last visit, and your analytics consent choice. None of this local storage leaves your device, and clearing site data removes all of it.

Email alerts

If you ask for an alert (for example “email me when my DNS records agree” or “before this certificate expires”), we store your email address, the domain, the alert type, its settings, and the last observed state needed to detect a change. We send a confirmation first and nothing before you click it. Each alert is a single requested service, not a mailing list: you receive only what that alert describes, at the cadence shown when you requested it, and every email carries a link that stops it. Unconfirmed requests are deleted after 7 days; stopping an alert deletes its record, and “stop every email” deletes everything we hold for that address.

Product updates are a separate, optional opt-in with its own confirmation email (double opt-in). Ticking it is never required to receive an alert. Email addresses never appear in URLs; links use random tokens.

Children

These tools are aimed at technical professionals and are not directed at children under 13.

Your rights

Because we do not maintain accounts or user profiles, there is generally no personal data set tied to you for us to export or delete. If you believe we hold information about you and want it addressed, email [email protected].

Changes

If this policy changes materially, the date at the top of this page changes with it.