Privacy

This policy describes what this site stores, why, and how to get it removed. It is short because the honest answer is short: we collect very little, and no third-party analytics or advertising code runs on any page here.

Running a check

When you submit a domain, we store:

• the domain name you submitted;
• the check results — the fifteen pass/fail verdicts and the evidence behind each one;
• the URL that was fetched, since a domain may redirect elsewhere;
• the time of the check.

We do not create an account to run a check, and a check does not ask for your name or your email address.

Because a domain is a public identifier, a check of example.com is not personal data about a person. It is a record that a public page was measured, and it is retained so the score history stays comparable.

Rate limiting

Checks are limited per address to keep the service available. To do that we process the requesting IP address and store a salted hash of it with the counter — not the address itself. The salt is per-installation and the hash is not reversible into an IP address by anyone without the salt.

Contact messages

The contact form asks for a name, an email address and a message so we can reply. It also stores a salted hash of the IP address and user agent of the submission, used only to stop spam and abuse. Messages do not expire automatically and stay until you ask us to remove them.

Cookies

This website sets no cookies for visitors. There is no analytics cookie, no advertising cookie and no tracking pixel, because there is no analytics, advertising or tracking code on any page.

The administration console — reachable only by the operator — sets one session cookie. It is HttpOnly and SameSite=Lax, and it exists only to keep an operator logged in. If you are not an operator you will never receive it.

Third parties

• Cloudflare proxies this site, terminates TLS and delivers inbound email. Requests therefore pass through Cloudflare's network, and Cloudflare may keep its own logs under its own policy.
• Our hosting provider operates the server. Data is stored in the provider's MySQL database and, for backups, on its disks.

No data is sold, rented, or shared for advertising. There is no data broker in this chain.

Your rights

You can ask us for a copy of what we hold about you, ask for it to be corrected, or ask for it to be deleted. Write to hello@aeolith.com and we will respond within 30 days.

If you want a domain's check record removed without claiming an account, say so and we will delete it — including reports that were published to the public leaderboard at your request.

Security

Credentials are encrypted at rest and never rendered into a page. Passwords are never stored in a recoverable form. Security issues should go to security@aeolith.com.