Privacy Policy

What we process

We receive the email you intentionally send to your test address. The analysis server processes its original MIME content, headers, envelope sender and recipient, sending IP, hostname, and the TLS details of that delivery. Technical findings and a copy of the received message source, HTML and plain text are stored so you can access your private report and message preview.

Service administration

Authorized administrators can review account information, technical analysis results and delivery metadata to support the service and investigate abuse. Original message bodies are excluded from the administrative report view. Administrative changes are audited. Access-denial monitoring uses protected IP identifiers, retains events for 30 days and samples repeated requests.

Your report link is an access key

Anonymous reports require the complete URL and an eligible viewing allowance. Account-owned reports require the owning account. Treat it like a private document link. Do not put sensitive personal information, credentials, or confidential attachments in a test email. Individual reports are marked noindex and are excluded from our sitemap.

Retention

New timestamped addresses accept one message for 24 hours. Anonymous reports are available for 14 days after receipt. Account-owned history and database results have no automatic expiry and remain until you delete the test or account. Original SMTP spool files follow a separate retention period of approximately 30 days after successful synchronization; indefinite storage of the original file is not promised. Expired report details are removed by scheduled cleanup. A minimal record of the used test address is kept to prevent reuse. Original message files are cleaned up separately after their results have been saved. Queued messages awaiting synchronization may be retained longer to prevent loss.

What we don’t do

HTML previews are sanitized and isolated; email scripts, forms and active content are disabled. We do not open attachments or visit message links. External images are blocked by default and load only if you explicitly choose the HTML view with external images and confirm loading them. This may notify the sender or image provider that the message was viewed. We do not sell test messages.

Tool usage records

For each submitted tool check and email test request, we keep the visitor IP address, tool name and date for 30 days. We do not include submitted domains, selectors, message contents, results or account identifiers in this usage log. Only authorized administrators can access it. The local EML viewer sends a content-free usage notification after parsing; the email file stays in your browser. IP addresses can identify visitors, so these records are not fully anonymous.

Standalone tools

Domain and IP tools send your submitted public domain, selector or IPv4 to our server and query Google Public DNS over HTTPS. Public DNS replies may be cached for up to five minutes. MTA-STS policies and BIMI logos are fetched from the published HTTPS hosts with security and size limits. The EML/EMLX viewer parses message files locally in your browser without uploading their contents. Remote images are blocked until you explicitly enable them. These tools do not create an email test or consume a test allowance. Website analytics and normal web-server logs may include domain/IP lookup URLs.

Public IP reputation checks

The analysis server queries SpamCop, PSBL and DroneBL over DNS using the sending server’s public IP. These queries reveal that IP to the relevant DNS infrastructure and blocklist providers. Email contents, addresses and private report links are not included in these reputation queries.

Website analytics

We use Matomo, hosted at mtm.static.bg, across the website to measure page visits and link interactions. This includes account and report pages. Administration pages are excluded. Analytics may receive page URLs, including report links, browser information and connection metadata.

Cookies and service logs

Encrypted, essential session cookies support CSRF protection. Matomo may use analytics cookies to measure website usage. Request limits help protect service availability. Operational logs may include connection information and failure categories. Private report addresses need to be concealed in production access logs; confirmation that this is applied across all logging systems is pending. Keep report links private and do not submit confidential content.

Before you send

Only send messages you have permission to submit. Use a test copy and remove information that the technical analysis does not need. If you do not want a message processed, do not send it to the generated address.

Accounts and viewing allowances

We store your account name, email, verification timestamp and an optional stable Google identity ID. Sign-in uses a one-time email link, code or Google. Sign-in links are signed and work only in the browser where they were requested. Using a link or code invalidates both. Email codes are stored as keyed hashes, expire after 10 minutes and are limited to five attempts. Expired challenge records are removed after one day. Legacy password hashes, where present, can no longer be used to sign in. Google access and refresh tokens are not stored. Guest allowances use separately HMAC-protected visitor IP values and a protected browser session identifier. IPv6 addresses share a /64 allowance; users behind a shared NAT may share an IP allowance. Guest admission records are kept for 15 days; account admissions are kept while the account exists to avoid charging repeated report views. Test ownership requires creation while authenticated or proof that the address was generated in your authenticated browser session, not merely possession of a shared link. Google sign-in contacts Google only when you choose it.

Contact enquiries

When you use the contact form, we send your name, reply email, subject and message to our support mailbox to handle your enquiry. The form does not add you to a mailing list. Please avoid sending confidential information. If you include a report link, it gives us access to the report and message preview. Contact correspondence is separate from test-message retention and is kept as needed to respond and follow up on your enquiry.

Last updated: 11 Oct 2026