Privacy

xhttp.lol does not collect personal data beyond rate limiting. There are no accounts, cookies, third-party analytics, tracking pixels, or third-party scripts.

Cloudflare processes requests as our CDN and compute provider. Their standard edge logs (IP, URL, timestamp) are subject to Cloudflare's privacy policy. We do not access, store, or process these logs.

Rate limiting uses an IP-derived counter in a Cloudflare Durable Object. These counters expire automatically after one hour and contain no personally identifiable information beyond a hashed IP key.

Scan results are cached for one hour in Cloudflare KV, keyed by domain and scan type (full, cors, csp, headers, chain, cache). Cached data contains only publicly observable HTTP response data and derived analysis — no private information.

TLS enrichment is performed by a Fly.io-hosted probe (yoke-probe.fly.dev). The probe receives only the target domain name — no client information is forwarded. Fly.io processes these requests subject to Fly.io's privacy policy. We do not store probe logs.

We log aggregate scan counts per day (no domain names, no IPs), retained 7 days for capacity planning.

hello@yoke.lol for questions.