Privacy — in plain language

What OuterCheck does

When you submit a URL, OuterCheck visits it from the outside the way any visitor (or search bot) would: a handful of ordinary GET requests — the page itself, /robots.txt, the sitemap, and a few optional agent-discovery files (/llms.txt, /.well-known/*). Nothing else. No logins, no forms, no scanning of ports, no attempts to bypass anything.

What we store about you

• No accounts. You don't sign up and we don't ask who you are.
• An anonymous client identifier: a keyed HMAC-SHA256 (with a server-side secret) of the client token your software sends us — or of your IP address if it sends nothing. The raw token/IP is never stored, and because the hash is keyed, it cannot be reversed by guessing (a plain hash of an IP could be). The key is rotated periodically; identifiers are used only for rate limiting and counting "returning users".
• Telemetry: timestamps, which endpoint was called, check categories, result status, whether it was your first visit or a repeat, recheck usage, latency, errors. The hostname you verified is stored so the service can work (rechecks, proof links); this can be disabled per deployment.
• Rate-limit counters (anonymous identifier + count per minute window) are kept for a few minutes and then deleted.

What we store about the sites you check

Verifications are snapshots of public pages: response headers, the HTML (first ~256 KB), robots.txt, sitemap facts, TLS certificate facts. No cookies beyond what a plain GET technically needs, no private panels, no credentials, no data from logged-in areas.

Proof pages

Each verification gets a shareable page at /r/<32-hex-character id>. The id carries 128 bits of cryptographic randomness — it cannot be guessed or enumerated in practice. Pages are marked noindex, there is no public catalog and no listing endpoint, and proof pages are rate limited. Anyone who has the link can see it — treat a proof URL like a secret you may share deliberately.

How long we keep it

• Snapshot contents: 30 days, then removed (hashes stay for integrity).
• Verification records: 180 days, then deleted.
• Aggregated counters (e.g. "N verifications ran") are kept without links to individuals.

What we never do

We don't sell data, don't embed third-party trackers, don't build profiles of people or teams, and don't verify private/authenticated pages. Future market-intelligence features, if any, would be built only on public data, aggregated telemetry and explicit opt-in.

Deleting your data

Want a hostname's verifications and snapshots removed? Write to the contact listed in the repository (SECURITY.md / README) and we will delete them — the storage is small and this is easy to honour.

Questions about this policy: see the project repository — docs/privacy.md is the engineering-level version of this page.