Last updated: July 2026
certs.lol does not collect personal data. There are no accounts, cookies, third-party analytics, or tracking pixels. The web UI loads fonts from Google Fonts, which receives your IP address when the font stylesheet is fetched.
Cloudflare processes requests as our CDN and compute provider. Their standard edge logs (IP, URL, timestamp) are subject to Cloudflare's privacy policy. We do not access, store, or process these logs.
We store an IP-derived counter in a Cloudflare Durable Object for rate limiting. These counters expire automatically and contain no personally identifiable information beyond a hashed IP key.
TLS scan results are cached for 6 hours to improve performance. Cached data is keyed by the submitted target and contains only publicly observable TLS configuration — no private information.
On a fresh scan, the submitted domain is sent to the services needed to produce the report: a Fly.io-hosted probe performs the live TLS connection to the target, hstspreload.org is checked for HSTS preload status, Cloudflare's DNS-over-HTTPS resolver is queried for DNSSEC/CAA/DANE records, and domain-intelligence signals are fetched from yoke.lol via a service binding. Only the target domain is sent — no client information is forwarded. The CLI discloses the same third-party checks on its CLI page.
We keep aggregate counters for service health: scan totals, cache hits and misses, errors, and rate-limit events. We also temporarily keep the last 50 scrubbed error messages (domains and IPs redacted via scrubIdentifier) for debugging — no personal data, no requested domains. These counters do not include requested domains, IP addresses, or per-request identifiers.
Questions? hello@certs.lol