Privacy

Reading needs nothing. Lookups are anonymous and cacheable. No accounts, no trackers, no third-party fonts.

Reports are public text. Whatever you write can be read by anyone. Emails and phone numbers are removed automatically before storage — write as if they are not.

Automated checks look up the domain, not you. A site page asks our server for public registration (RDAP) and DNS facts about that domain. Our server contacts rdap.org and Cloudflare's public DNS; your address is not sent, only the domain you looked up. We never visit the site you ask about.

No raw IPs. Rate limiting uses a salted hash that rotates; the address itself is never stored.

Accounts hold little. A display name, your settings, and a watch list. Your email address is stored encrypted (AES-GCM) and used only for sign-in links and alerts you turn on. Magic-link codes expire in 15 minutes and are stored hashed.

Email is sent by Cloudflare Email Service. No third-party trackers, no pixels, no advertising. Every digest has a one-click unsubscribe link.

Rejected and spam reports are deleted after 30 days. Deleting your account removes your profile and watch list; your reports stay, posted as “Anonymous”.

Email only when asked. Sign-in links, opted-in alerts, one weekly digest. Nothing else. Export or delete your data any time from account.