Privacy Policy

Until this page carries real terms, here is plainly what the tools do with what you give them:

• · After 72 hours, what you gave us is gone — not just the report. The recovered files, the log, and the input itself: the list you pasted, the domain, the server names. What is kept is that a job of that kind ran, for counting against your limits.
• · Credentials for a migration are encrypted while the job needs them and wiped the moment it ends — including if the process dies or the job never runs. They are never written to logs.
• · A message sent to the mail tester is stored only to analyse it. The raw message is kept for as long as its report exists — up to the same 72 hours — and the two are deleted together, not when the address stops accepting mail.
• · A job gets its own key, handed out once. The id alone no longer opens anything: when a job starts we give it a key, your browser keeps it next to the id, and reading the report or cancelling the run needs it. That is what lets the free lane work without an account and still not leak — pasting an id into a ticket used to be pasting the report, and an IMAP migration report names your servers and your mailboxes. Sharing one is now a deliberate act: the share link carries the key in it. We never store the key itself, only a fingerprint, so we cannot recover it for you. This browser keeps the list of runs you started; the button under that list forgets them, keys included.
• · Monitoring is the exception, and on purpose. If you ask us to watch an IP, a certificate, a domain or its DNS, we keep that target and what we last saw for as long as the monitor exists — otherwise there is nothing to compare against and nothing to tell you. The history of what changed is capped per monitor, so it cannot grow without end. Stop the monitor and all of it goes, history included, in the same moment.
• · There is no tracking on this site, and nothing is sold or handed to anyone.
• · And the page itself loads nothing from anyone else. No web fonts, no analytics, no CDN, no embedded anything: opening this site connects your browser to this site and to nowhere else, and it sets no cookies. That is checked on every build, not promised — a single font from a font service would put a third party in the middle of every page view, and it would be silent.

But the tools work by asking third parties, and it would be dishonest to write "nothing is shared" and leave it there. Concretely:

• · Mail Doctor queries public DNS and eight blacklists — Spamhaus, Barracuda, SpamCop, PSBL, blocklist.de, DroneBL, GBUdb, UCEPROTECT — which therefore learn the IP being checked, and connects to your own MX hosts.
• · List Verification resolves each domain. If you turn on mailbox probing, it connects to the recipients' mail servers and names the address in RCPT TO: that server learns you are checking it. It never sends the message.
• · Mail Tester opens the first twelve links in your message to see if they respond — so those servers see a request, including any tracking token the link carries. Spam scoring runs on our own machine, not on a third-party service.
• · Archive Recovery downloads from the Internet Archive. IMAP Migration talks only to the two servers you name.
• · Monitoring asks whoever holds the answer, and each of them learns what you are watching: the same eight blacklists for an IP; your own host, over TLS, for a certificate; the DNS for records; and for a domain's expiry date, the registry that runs that TLD — over RDAP, directly, with the list of which registry serves which TLD taken from IANA. We do not route that through a public RDAP redirector: it would put a stranger in the middle of a fact we are about to email you about.
• · And where a registry has no RDAP — .it, .io, .co, .me and .pt among them — the same question goes to its WHOIS server on port 43, asked directly, with the address of that server taken from IANA too. It is one query per round and it names your domain, which is what any WHOIS query does; nothing else about you travels with it.

There is no contact address yet — this is not open for signup, and putting up a mailbox nobody reads would be worse than saying so.