Privacy Policy

This Privacy Policy explains how [OPERATOR NAME] (the "Operator", "we") handles information when you use the Wsec web security checker (the "Service"). For information that identifies a person, the Operator is the controller (the party that decides how and why it is used). Words defined in the Terms of Service have the same meaning here.

This policy describes how the Service is built to work. The Service is open about this because it is meant to be checked: the way each kind of data is handled below is how the software behaves.

The table lists what the Service processes, why, whether it is stored, and for how long.

Data	Why	Stored?	How long
Scan record. The address you entered, the host name, the time, the results of the scan (findings, scores, selected header values and short evidence excerpts, the Target's IP address and certificate details), and the version of the Terms you accepted.	To run the scan, show you the Report, show the change since the last scan, and keep a record of acceptance.	Yes, in the Service's database.	Deleted automatically after 30 days. The deletion job runs hourly.
Your IP address.	Rate limiting and abuse prevention.	Held in the server's memory only, to count requests within a rolling one-hour window. It is not written to the database and is not part of the scan record.	Up to one hour, and cleared when the server restarts.
Application log. One line per request with the method, the path (without the query string), the status code and the time taken. It does not contain IP addresses, request bodies, uploaded files or scan results.	Running and fixing the Service.	Written to the server's log output and kept by the hosting environment.	As set by the host: [LOG RETENTION PERIOD].
Web server or proxy logs. The host or any reverse proxy in front of the Service may record connection details, including IP addresses, outside the Service's own software.	Operating and securing the hosting environment.	Held by the hosting provider ([HOSTING PROVIDER AND REGION]) under its own settings.	As set by that provider and described above.
Uploaded source code.	To produce the source code Report.	No. It is read from the request, analysed in memory and discarded. It is not written to disk, not logged and not kept in any report.	Only for the seconds the check takes.
Ownership proof record. A host name and a random token created for it.	To let you prove control of a host for deep checks.	Yes, in the Service's database.	Until the Service is shut down or you ask us to delete it.
Messages you send us. For example abuse reports, opt-out requests and deletion requests, with your email address.	To answer you and to keep a record of requests.	Yes, in the Operator's email system.	As long as needed to deal with the request and meet legal duties.

The Service does not ask for your name or an account, and it does not record which scans came from which person. A Report is found by its link, which contains a long random identifier. Anyone who has the link can open the Report, so share it with care. Report pages ask search engines not to index them.

Backups: if the Operator makes backups of the database, they may hold scan records for a short time after the live copy is deleted. Backups are kept by the Operator only for restoring the Service and are not used for any other purpose.

To produce a Report the Service reads what a Target sends to any visitor: response headers, certificate details, DNS records, the home page and well-known files. It keeps only the findings and short excerpts needed to explain them. It does not intentionally collect personal data from Targets. Some public information can include personal data, for example an email address in a security contact file, and if so it may appear in a Report and is kept and deleted with that Report.

The Target's operator will see requests from the Scanner Addresses with a Wsec user agent in their own logs.

Files you upload are sent to the Service, analysed by automated pattern checks in the server's memory, and discarded when the response is sent. They are not written to disk, not placed in a log, not included in any stored Report, not read by a person, and not used to train any model. Zip files are opened in memory and are not extracted to disk.

The results are returned only to your browser. A finding shows the file name, the line number and the line itself. Where the Service recognises a secret (for example a cloud key or a token), it shows only the first characters of it. Other sensitive text on the same line may appear in the result that is returned to you, and the result is not stored by the Service. Your browser and any device you use may keep it, so close the page when you are done.

Do not upload secrets or personal data of other people. If you would prefer that your code does not leave your computer, you can run Wsec yourself; the project's README explains how.

The Service is hosted on infrastructure that may handle memory in ways outside our control (for example swap files or crash diagnostics). We have not designed the Service to retain uploaded code, but we cannot promise that no trace could ever exist at the infrastructure level.

We use data only to: run scans and source checks and show you the results; apply rate limits and prevent abuse and attacks on the Service or on Targets; investigate complaints; keep a record that the Terms were accepted; keep the Service running and fix faults; and meet legal duties and enforce our terms.

We do not sell personal data, we do not use it for advertising, and we do not build profiles of visitors.

Where the law requires a legal basis for processing personal data (for example the GDPR in the European Union and the United Kingdom), we rely on: performance of the contract with you, to provide the Service you asked for; our legitimate interests in keeping the Service secure and free from abuse, in responding to complaints, and in protecting our legal position (we balance these against your rights and interests); and legal obligation, where we must keep or give information. We do not rely on consent for any processing, because the Service does not use cookies or tracking.

We share data only in these cases:

• Providers. The hosting and infrastructure providers that run the Service for us ([HOSTING PROVIDER AND REGION]), who process data on our instructions, and our email provider for messages you send us.
• Target owners and their providers. If someone complains about scans of a host, we may tell its owner or hosting provider that scans were run, when, and from which addresses. We do not need to name you, and we do not record who started a scan.
• Legal and safety. Where required by law, court order or a valid request from an authority, or to protect the rights, property or safety of anyone, including to investigate abuse.
• Business changes. If the Service is sold or transferred, data may pass to the new operator, who must honour this policy.
• Anyone with a Report link. See above.

The Service does not load third-party scripts, fonts, analytics or advertising, so your visit does not send data about you to such services. Links to other sites, such as reference documentation, leave the Service; those sites have their own policies.

The Service does not set cookies and does not use analytics, advertising or fingerprinting. Your browser may remember your confirmation of the Terms in its own local storage on your device, so that you are not asked on every scan. That value stays on your device. You can clear it in your browser settings. The Service ignores "Do Not Track" signals only because it does not track.

Scan records are deleted automatically after the retention period shown in the table. You may ask us to delete a Report sooner by writing to [CONTACT EMAIL] with the Report link. You may also ask us to delete the ownership proof record for a host you control. We will confirm what we deleted. We may keep information that we must keep by law, or that we need to deal with a dispute or abuse, for as long as that purpose lasts.

Because the Service does not keep IP addresses or accounts, we cannot find "your" scans without the Report link or host name you give us.

We use measures that fit the Service, including encrypted connections where the Service is served over HTTPS, a strict browser security policy for the pages, limits on what a scan may connect to, and keeping uploaded code out of storage. No system is completely secure. If a breach affects your personal data, we will notify you and the authorities where the law requires.

Data is processed where the Service is hosted: [HOSTING PROVIDER AND REGION]. If you are in a country with different data-protection rules, your data may be moved to and processed in a country whose rules differ from yours. Where the law requires safeguards for such transfers, we use them.

Depending on where you live, you may have the right to ask us for access to personal data we hold about you, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable form, and to complain to a data-protection authority. To use these rights, write to [CONTACT EMAIL]. We may need the Report link or other details to find any data, and we may need to confirm your identity first. We answer within the time the law sets, and we do not charge for reasonable requests.

The Service is for adults and is not directed to children under 18. We do not knowingly collect personal data from children. If you think a child has given us data, write to us and we will delete it.

We may update this policy. The version date at the top shows the current version, and we will ask you to accept the Terms again when a change is material.

[OPERATOR NAME]
[REGISTERED ADDRESS]
Email: [CONTACT EMAIL]