Privacy Policy

Overview

ProbeKit is operated by NFI ApS (45583112). We collect as little data as we can.

The website

Neither the website application nor our reverse proxy keeps access logs: neither stores IP addresses or the pages you visit, and the site sets no cookies. Cloudflare processes requests as CDN in front of the site; see Infrastructure and third parties below.

What the free check processes

When the free browser check is enabled on a tool page, the domain or other field you enter is sent to our web application, which forwards it to our internal check API so that it can be checked. The result is shown to you and nothing you enter is stored: the website does not keep the domain, the result or a history of your checks.

The web application writes one operational log line per check. It contains a request id, the tool, the outcome, the HTTP status, the duration of the request and a hashed IP address. The hash is an HMAC-SHA256 of your IP address, shortened, using a random salt that exists only in memory and is replaced every day (UTC). The salt is never written to disk, so after the daily change an old hash can no longer be linked to an address. The log never contains your raw IP address, the domain you entered, the Turnstile token or any credentials.

To limit abuse the check allows a limited number of runs per IP address per minute and per day. These counters are kept in memory only, keyed by the hashed IP address, and disappear when the application restarts.

Bot protection with Cloudflare Turnstile

Where the check is protected by Cloudflare Turnstile, the Turnstile script and widget are loaded from Cloudflare on tool pages only, not on other pages. Turnstile distinguishes people from automated bots. Cloudflare processes signals such as your IP address, TLS fingerprint, User-Agent header and the site key and origin. When you submit the form, our server verifies the Turnstile result with Cloudflare and passes your IP address along as part of that verification. For bot detection Cloudflare acts as our processor; Cloudflare also uses the signals to improve Turnstile, for which it is an independent controller. Read more in Cloudflare's Turnstile Privacy Addendum and in our cookie notice.

API logs

The paid API's operational logs contain a request id, the endpoint, the outcome, the status code, the duration of the request and a hash of the paying wallet address that changes every day. They do not contain IP addresses or the domains you check. The logs are used for security, abuse prevention and fixing errors.

Payment records

When you pay for an API request we keep a payment record: the paying wallet address, the payment nonce, the amount, the network, the endpoint, a hash of the request, the transaction hash and the times. For 24 hours the stored result, including the checked domain, is kept with the record so it can be delivered again. The record is kept for 90 days to settle and reconcile payments and to prevent reuse. After 90 days we remove the paying address, the nonce and the request id from the record. The transaction hash, amount, network, endpoint and times are kept for bookkeeping and deleted after five years. Because transactions are public on the blockchain, the transaction hash still points to the paying wallet. We never store private keys or payment signatures.

Cookies, tracking and analytics

The site sets no cookies, uses no tracking cookies and has no analytics. See the cookie notice.

Infrastructure and third parties

We use Cloudflare as infrastructure and CDN provider. Cloudflare processes IP addresses and request metadata as part of delivering the site and protecting it from abuse. Checks send DNS queries to public resolvers (Cloudflare and Google), so the domain names you check are visible to the resolver that answers.

Your rights

If you are in the EU or EEA you have the right to ask for access to personal data about you, to ask for correction or deletion, and to object to or ask us to restrict processing. You may also complain to your data protection authority. Because we do not store raw IP addresses or the domains you check ourselves, we may not be able to link any data to you.

Retention

Logs are kept only as long as needed for security and operations.

Contact

NFI ApS, Langfreddal 3, 8471 Sabro, Denmark. Email: [email protected].

Changes

If this policy changes, the new version is published here with a new date.