Privacy
Last updated Oct 22, 2026
What we store and for how long
- What we store: the domain you enter, your email, your verification token, the time and a one-way hash of your IP when you agreed to the terms, and a random cookie that ties your verification to your browser.
- Check results (domain, detected version, label) are kept for 30 days, then deleted automatically. Your saved-site history is made of these same results, so it never goes back more than 30 days.
- Saved site: after you verify, we create a private recheck link. We store only a one-way hash of it, plus your domain, your original verification token and method, and a random badge ID. If you don't recheck for 30 days after your verification ends, the saved site is deleted. You can delete it yourself at any time from the saved-site page.
- Badge: the badge shows "patched" only while your latest check, made within the last 30 days, found a likely patched version. Otherwise it shows "no current check". It never shows "vulnerable".
- Anonymous statistics: for each check we keep the time, the PHP branch (e.g. 8.3), the label, and a salted one-way hash of the domain so we don't count the same site twice. We never display the hash or any domain. Totals are shown only once at least 100 sites have been checked.
- Never published, sold or shared: your domain, your result, or your email. There's no public list, directory or leaderboard.
- Email: we don't send verification emails. If you join patch alerts, we store your address for that list only, with a random unsubscribe code. Every alert email has an unsubscribe link that deletes your address.
- Requests we make to your site: one DNS lookup or one file fetch each time verification runs (after you press verify, the page retries at most 3 times, 30 seconds apart), then one or two normal homepage requests per check.
- On your device: the checker page remembers your progress in your browser's local storage (the domain, your verification code and, once verified, your private recheck link) so a reload doesn't lose your place. It is never sent anywhere else. "Start over" clears it, as does clearing your browser data.
- To delete your data, use the contact form.