Privacy policy

Short version: we collect as little as we can, we don't track you, and we never sell data.

What we collect

• Domains you enter for a scan. We use them to run the check. We don't keep your list. Results for individual domains (certificate, registration and DNS details) are cached briefly to speed up later checks, and are deleted within 30 days at most.
• IP addresses, for rate limiting. To limit how many scans one visitor can run, we keep a one-way hash of your IP address for up to 24 hours. Short-lived counters also cap how often the sign-up form can be used.
• Early-access sign-ups. If you join the early-access list, we store your email address, your answer to “How many client sites do you manage?”, whether you ticked “Email me when monitoring launches”, the page you signed up from and the time.
• Privacy-friendly analytics. We count events such as “scan started”, “scan completed” or “CSV downloaded”, with a scan ID and a number (such as how many domains were checked). No IP addresses, no device fingerprints, no third-party analytics.

What we don't collect

• We never load or store the content of the websites you check. We only connect to port 443 to read the certificate, and look up public registration and DNS records.
• No tracking cookies and no advertising pixels.
• We don't sell, rent or share your data.

Spam protection

The sign-up form uses Cloudflare Turnstile to check that you're not a bot. Cloudflare processes technical signals from your browser for that check only.

How long we keep it

• Scan inputs and cached results: deleted within 30 days.
• Rate-limit hashes: up to 24 hours.
• Early-access sign-ups: kept until you ask us to remove them.

Your choices

To see, correct or delete anything we hold about you, email chayut@dewlinehq.com. We'll act on it promptly.

Plain-language draft.