Privacy

What happens to what you scan

This page describes what Cloaker Checker actually does with the URL you submit, your IP address, and the evidence a scan produces — plainly, and only to the extent we can genuinely guarantee it. Where something is outside our control (like our hosting provider’s own infrastructure logs), we say so instead of promising something we can’t verify.

We don’t store your scan results

Cloaker Checker has no database. When you run a scan, the server fetches the target page, compares the results, and sends the report back to your browser in that single response — nothing about the scan is written to disk or any persistent store on our end. Close the tab, and that report exists only in your browser’s memory until you reload.

This also means: results aren’t publicly accessible. There’s no ID, link, or archive that would let someone else look up a scan you ran — because no such mechanism exists.

What we do handle, and for how long

The target URL. The full URL you submit (including its query string) is used to perform the fetches. If a scan fails unexpectedly, we log the error server-side for debugging — but the URL’s query string is stripped before it’s written to that log, since a query string can carry tokens or identifiers you didn’t intend to hand us just by asking us to scan a page.

Your IP address. Used two ways: standard request handling (your browser sends it with every request, same as any website), and rate limiting, which keeps a short-lived in-memory counter keyed by IP to slow down abusive request patterns. That counter lives in server memory only, resets automatically on its own schedule (currently every 60 seconds), and is never written to disk.

The evidence in a report. Response headers that could carry session or authorization data (cookies, Authorization) are stripped before a report is ever assembled — not filtered out later, removed at the point we receive them. Raw HTML and header values are also scanned for patterns that look like exposed API keys or tokens and redacted if found. This is heuristic pattern-matching, not a guarantee — see Limitations.

Third-party services

This site uses Vercel Speed Insights to measure page-load performance (things like load time and Core Web Vitals) for the Cloaker Checker site itself — not for the sites you scan. It’s provided by Vercel, our hosting platform. We don’t run Google Analytics, Meta Pixel, or any other tracking or advertising script on this site.

What’s outside our control

We host on Vercel. Like any hosting provider, Vercel’s own infrastructure may retain standard request/access logs as part of running the platform — that’s Vercel’s data handling, governed by their own privacy policy, not something we control, configure, or can delete on your behalf. We don’t claim otherwise.

Deletion

There’s nothing of yours in our own storage to delete, because we don’t store it in the first place. The one thing we do hold — your IP address in the rate-limit counter — expires on its own within the current window; there’s no manual deletion request to make because there’s nothing that persists long enough to need one.

Reporting a security issue

Found a genuine vulnerability — something that could bypass the fetch protections, expose data it shouldn’t, or affect other users — rather than a general bug? Please don’t open a public issue. Reach out through colinjanoshegyi.com/#contact with details and, if you can, steps to reproduce. We’ll acknowledge genuine reports and work on a fix before any public disclosure.

A note on what you scan

Cloaker Checker fetches whatever page you point it at and displays what it finds, including the raw HTML and text of that page. If you scan a page containing personal or sensitive information, that content will appear in your report exactly as it does on the page itself (aside from the credential redaction described above) — only scan pages you have the right to inspect.