Privacy policy

SpoofLens works without sign-up, without cookies, without ads and without third-party analytics. Below is everything that happens to data when you use the site.

In short

• No account is needed, and you never have to enter a name or email to run a check.
• No cookies are used at all.
• There are no ads, social media pixels or third-party counters on the site.
• We do not sell data or share it with third parties for marketing.

What happens when you check a site

When you enter a site address, our server connects to that site itself and makes public queries: DNS, RDAP (domain registration data), IP lookups in public blacklists (Spamhaus, SpamCop, Barracuda, PSBL, SORBS) and network identification via Team Cymru. These services see our server's IP address and the site being checked, not your IP address.

The result of a full check (score, SSL status, availability, security headers, blacklists) is saved as a snapshot and is available at a public link of the form spooflens.com/en/report/domain. A site's technical parameters are public anyway, but keep this in mind if you check a site you do not want to show yet.

The "My IP" page

The page shows your IP address and the data your browser already sends to every website. To identify your network operator and country, the server makes a DNS query to Team Cymru and a reverse DNS query using your IP address. If you press the blacklist check button, your IP address is checked against public DNSBLs.

This data is not stored anywhere, and the page is served with caching disabled. The browser fingerprint, time zone and other signals are computed inside your browser and are not sent to the server.

Browser check

To cross-check the data, the browser check page sends our server, once, the characteristics your browser already tells websites: system and version, languages, time zone, screen size, graphics card, font list, canvas, WebGL and audio fingerprints. The server compares them with the request headers and your IP address, returns the result and forgets them right away.

Only a count of how many checks ran that day is kept. You alone see the full result; the "Copy JSON" button copies it to your clipboard, not to the server.

Visit statistics

We count visits without cookies. To count unique visitors we use a hash of the date, IP address and browser string. It changes every day and cannot be turned back into an IP address, and the IP address itself is not stored in the statistics.

To tell people from bots, the browser sends a short signal with no personal data once per session and sets a tg_v flag in sessionStorage, which disappears when the tab is closed.

Abuse protection

To limit request rates and to stop the tools from being used against other people's sites, we briefly keep request timestamps tied to a hash of the IP address. These records are deleted automatically within an hour.

Waitlist

If you join the waitlist on the home page, we store your email, the plan you picked, your use case and the site language. We need this only to tell you about the launch. We send no newsletters before the launch and do not share addresses with third parties. To delete your entry, write to hello@spooflens.com.

SSL expiry reminders

If you subscribe to a reminder, we store your email and the domain so we can write to you before the certificate expires. Every email has an unsubscribe link that removes all reminders for your address.

Telegram bot

The bot processes the messages you send it in order to run a check. For flood protection it keeps a short-lived counter tied to a hash of the chat ID. Telegram's own policy applies to conversations on Telegram.

Data in your browser

The list of your recent checks is stored only in your browser (localStorage, key tg_recent) and is never sent to the server. You can clear it at any time by deleting the site data in your browser settings.

Server logs

Like any web server, the hosting server keeps standard request logs (IP address, time, requested page). They are needed for security and troubleshooting, are kept for a limited time and are not used for profiling.

Who processes the data

The site is run by SpoofLens and is hosted on servers of the hosting provider TomisHost. Data is not shared with anyone else, apart from the technical queries described above, without which a check is impossible.

Your rights and contact

To ask a question, get a copy of, or delete data linked to your email or domain (for example, a check snapshot on a report page), write to hello@spooflens.com.

Updated 21 October 2026 (browser check and waitlist added)