Terms of Use and Privacy

Permitted use

Scan only domains you own or have the owner’s explicit permission to inspect, and confirm this each time you start a scan. You are responsible for the scans you start, for the truth of that confirmation, and for how you use the results.

Prohibited use

Do not:

• use the service or its results unlawfully, or to harm or attack anyone;
• scan systems you are not authorised to inspect;
• circumvent its limits, overload it, or access it with automated scripts.

How scans work

Every scan queries public sources: certificate transparency logs, public subdomain databases, a public web archive, and DNS. Passive scans never contact the target site. Standard and full scans also send it a limited number of ordinary, rate-limited page requests. The service never logs in, submits forms, guesses URLs or hostnames, or tests for vulnerabilities. Its requests name it and link to a page for site owners that explains them and how to have a domain excluded.

Third-party information

Results are compiled from public third-party sources and from what target sites serve publicly. We do not control, verify or endorse that information, and listing a host or page says nothing about who owns or operates it.

No warranty

The service is free and provided “as is”, without warranty of any kind. Results reflect what public sources have recorded. They may be incomplete, outdated or wrong, and are not a full inventory of any site. We may change, suspend or discontinue the service at any time.

Limitation of liability

To the extent permitted by law, we are not liable for any loss or damage arising from your use of the service or reliance on its results.

Indemnity

You agree to indemnify us against claims, losses and costs arising from your scans, your use of the results, or your breach of these terms.

Our rights

We may limit, refuse or stop scans, and remove results, at our discretion. For example, we may do this to prevent misuse or at a site owner’s request.

Governing law

These terms are governed by the laws of India. If any part of them is found unenforceable, the rest still applies.

What we store

• The domain, scan mode and results are kept on our server for up to 7 days, then deleted automatically (sooner if storage runs low).
• Anyone with a result’s link can view it while it is stored. Share the link only with people you want to see it.
• Our server keeps brief operational logs, including scanned domains, to run and protect the service. For each scan they record that you confirmed you may scan the domain and accepted these terms.
• The domain you enter is sent to the public sources above. In standard and full scans, the target site also receives page requests from our server.

Your connection

• Your IP address is held in memory only, to limit scans per visitor. Our logs do not record it.
• Before a scan, Cloudflare Turnstile checks that you are human. To do this, your browser sends signals to Cloudflare.
• Our hosting providers, Vercel and Cloudflare, process your requests and may keep their standard logs.

Usage statistics

We use PostHog (EU-hosted) to count scans started, finished or cancelled, tabs opened, and downloads. These events never include the scanned domain, its hosts or URLs. PostHog sets no cookies, stores nothing in your browser and does not record your screen, but it receives your IP address with each event.

Cookies and browser storage

We set no cookies. While a scan runs, its ID is kept in your tab’s session storage so you can cancel it; it is cleared when you close the tab. Cloudflare Turnstile may use its own storage for its check.

Contact, removal and objections

To ask a question, request removal of a stored result, or object to a scan of your domain, open an issue on GitHub. Do not post personal details there; we will reply on the issue.

Changes

We may update these terms; the date above shows the latest version. Continuing to use the service after an update means you accept it.