Privacy

“Email me this report”

The public report page lets you have a report sent to yourself. Entering an address there does not create an account, a subscription or a mailing-list entry, and it is not treated as consent to anything beyond that one message.

What we store, and for how long. Until you confirm, we hold your address, the domain you asked about, and a hash of the confirmation token — never the token itself, so a copy of our database contains no working links. The confirmation link is valid for 30 minutes. Once the report is sent the record is deleted immediately, and there is no field recording that it was sent. If you never confirm, the record is removed by the next cleanup: every new request triggers one, and a scheduled sweep runs every hour, so the guaranteed maximum is one hour.

Where it goes. Sending those two messages necessarily discloses your address to Resend, our email provider and processor, who transmits them and records them in a delivery log. That log holds the recipient address and the subject, and it stays readable to us through their API after our own record is gone. We cannot delete individual entries — their API offers no such operation — and their data-processing agreement commits only to deleting customer data within 90 days of an account being closed. It states no retention period for the delivery log of an active account, so we do not know one and will not guess. Their current terms are at resend.com/legal/dpa.

What is in our logs. Runtime logs record the domain and the first eight characters of the token hash, which is enough to trace one request. They never contain the address.