DATA MINIMISATION BY DEFAULT

Privacy policy

Effective 2 November 2026. Controller: Andreas Bosch, Dammstraße 6, 53757 Sankt Augustin, Germany. Contact: info@http3checker.com.

Visiting this website

All assets are served locally. We use no advertising, analytics, external fonts, cookies, sessions, localStorage or browser fingerprinting. No optional device storage is accessed, so no consent banner is used under § 25 TDDDG. Normal browser caching and the data necessary to deliver a requested page remain part of web communication.

Hosting and security logs

This service runs on the operator’s VPS. Caddy processes your IP address, request time, path, HTTP method, response status, user agent and connection metadata to deliver and protect the service. Logs rotate daily at midnight and at 20 MiB, retain at most five archives and remove archives after seven days; a daily cleanup also expires closed log files after seven days. Request bodies and entered domains are not deliberately written to access logs. Report paths contain random identifiers. Quota rejections may include the visitor IP and requested hostname in structured security diagnostics. Target IPs are not treated as visitor IPs. PHP and worker diagnostics use the system journal, with service-specific cleanup after seven days.

Processing is based on Art. 6(1)(f) GDPR: reliable operation and preventing abuse. The hosting provider’s identity, processing agreement and server location require confirmation by the operator; these details are not inferred from the IP address.

Submitting a domain

We retain the normalised hostname, DNS answers, tested public IP addresses, timestamps and TLS results for up to one hour. Results are reused for five minutes. Identical running checks are combined. Random report links are unlisted, excluded from indexing and accessible to anyone holding the link until expiry. Do not submit confidential hostnames. There is no public scan history.

We send DNS questions to Cloudflare’s public resolver at 1.1.1.1 over TCP without EDNS Client Subnet. Cloudflare receives the queried names and our server IP, not your visitor IP from our application. Destination servers receive TLS handshakes from our server. No web pages are downloaded. DNS queries are not encrypted on this path. Provider information: Cloudflare resolver privacy. Internet routing and these providers may involve processing outside the EU; contractual and transfer arrangements require operator review.

Rate limits and CrowdSec

Atomic application quotas use a daily HMAC of your IP address, grouped by /64 for IPv6, rather than storing your raw IP in the job database. Quota counters expire within one hour and are purged by the worker. We do not attach visitor identifiers to scan results.

The existing CrowdSec agent reads Caddy access logs and uses local attack detection. Its firewall bouncer enforces decisions against visitor IPs. Target certificate failures do not generate attack events. The local security database is configured for seven-day retention or 5,000 items, whichever limit is reached first. At inspection, the central API was not registered; console options for custom and tainted alerts were enabled. Whether any console enrolment remains active and any resulting transfers must be checked by the operator. This site adds no central API credentials or separate AppSec service.

Your rights

Where the GDPR applies, you can request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. Contact the controller above. You may complain to a data protection supervisory authority, including the North Rhine-Westphalia authority. We do not sell personal data or make automated decisions with legal effects. Contact correspondence is retained only as necessary to answer your request or meet statutory obligations.

Operational review

The controller must confirm the hosting provider, contracts, international transfer arrangements and CrowdSec console status before treating this notice as legally reviewed. Changes to analytics, storage or security integrations require a corresponding update to this policy.