Privacy

Last updated October 11, 2026. Contact: [email protected].

What the checker processes

When you submit a public HTTPS URL, our server retrieves that page and up to 20 static, same-origin JavaScript files. It analyzes their content in memory and returns a report with masked evidence. The application does not save fetched page bodies, full matching strings, or submitted URLs in its metrics file. Reports and rescan comparisons stay in your browser tab unless you choose to download a JSON report. If you use Copy fix steps, a masked action plan is placed on your clipboard.

Usage and service data

The application stores daily aggregate counts of scans and interface events on the VPS. It does not include URLs or secret values in those counts. The application uses your network address in memory for short-window abuse limits; it does not add that address to the aggregate metrics file. We do not currently set application analytics cookies or embed third-party analytics scripts.

Cloudflare handles incoming requests, HTTPS, security controls, and delivery to our server. Cloudflare and the VPS provider may process network addresses and request metadata under their services and logging settings. Cloudflare security features may set their own cookies. We do not claim that these providers keep no logs. The application is designed not to write fetched bodies or full matches to its service log.

How to limit exposure

Only submit URLs for public pages you are authorized to check. Do not place credentials, tokens, or personal information in the URL path. If a real credential is exposed, revoke or rotate it first. A scan result is not a guarantee that a site is secure.

For questions about this tool or its data handling, email [email protected].