Privacy

No accounts, no cookies, no trackers

There is no sign-up, no session cookie and no analytics. The page loads its stylesheet, its script and its icon from this host and nothing else, so nothing about your visit is shared with a third party.

What is stored

Each lookup is written to a SQLite file on this server: the indicator (hash, URL, domain or IP), its kind, the verdict, the score and the time. The most recent ones are published at /recent. No IP address, user agent or referrer is attached to a lookup, and nothing ties two lookups to the same visitor.

Rate limiting keeps a per-IP counter in process memory only. It is never written to the database and is gone when the service restarts. A bulk upload is stored in the same database as a job, with the indicators you sent, so that it can be polled and exported.

Labels you add to the local corpus are public, notes included. Do not put anything private in a note.

What leaves the server

A lookup is an outward request: the indicator is sent to every active source for its kind — sample repositories, engine APIs, blocklists, DNS resolvers and RDAP registries. That is the point of the service, and it means the indicator is disclosed to those providers under their terms, not this one's. /sources lists them and the key each one needs. API keys live in the server's environment file and are never sent to a browser or written to a page.

Logs and retention

The web server in front of the app writes ordinary access logs. Those logs include the requested path, and for a search the path carries the indicator in its query string; they are rotated by the system's log configuration and are not joined to the lookup history.

Nothing is deleted automatically: the lookup history and the corpus stay until the operator removes them. The whole store is one SQLite file, so an operator can archive or delete it without asking anyone.