Security & privacy
What each product collects, how long it keeps it, and what leaves the server. Written to be checkable rather than reassuring.
Email Analyzer — what is stored
- The uploaded .eml or .msg is not stored. It is parsed in memory and discarded.
- What is stored is the structured result: headers, authentication results, findings, links and attachment metadata.
- Signed in, free account: kept 7 days. Paid account: 30 days. Operator accounts are kept indefinitely for abuse history.
- Not signed in: kept up to 7 days for abuse review, and never shown back to the visitor — unregistered use leaves no history for the person who submitted it.
- Deletion runs daily on a timer; retention is enforced by that job, not by good intentions.
Email Analyzer — what leaves the server
Reputation lookups send only the indicators extracted from the message — a domain, a URL, an IP address or a file hash — to VirusTotal, Google Web Risk and abuse.ch. These run for signed-in users only. Message text and attachments are never forwarded. The analysis reports which providers ran and which did not, so a provider being unavailable never looks like a clean result.
Links found in a message are parsed, not fetched. Nothing submitted to the analyzer can be executed or made to run on the server.
Shorty — what is stored
- Accounts: the email address you sign up with and a password hash. Passwords are not recoverable.
- Links: the destination and the slug you chose or were given.
- Clicks: time, approximate location, device and browser family, and the referrer.
- Links expire on a schedule and their data goes with them.
Cookies and tracking
Both products use a single session cookie to keep you signed in. There are no advertising cookies, no cross-site trackers, and no third-party analytics scripts on these sites.
Reporting a problem
Email [email protected]. If you are reporting a vulnerability, describe the smallest reproduction you have and give us a reasonable window to fix it before publishing.