TreewalkRFC 9989

Privacy

Last updated 21 August 2026.

What is not collected

• No cookies. None are set, for any purpose.
• No analytics and no third-party trackers. There is no client-side JavaScript at all.
• No IP addresses are stored.
• The domains you audit are not recorded. Which domain you looked up is not written to storage.

What is collected

For rate limiting and to count how many people use the service, each request is recorded as: a salted one-way hash derived from your IP address and user agent, the date, whether the request came from the web page or the API, the numeric score, and the verdict category.

The hash uses a secret salt and is truncated. It cannot be reversed to an IP address, and it cannot be used to identify you or to link you across a salt rotation.

DNS queries

Audits are performed by querying public DNS over HTTPS via Cloudflare's public resolver at 1.1.1.1. The domain being audited is necessarily visible to that resolver, as it would be to any resolver.

Hosting

Served from Cloudflare Workers. Cloudflare processes requests as an infrastructure provider and may retain operational logs under its own policies.

Requests

Because no personal data is stored, there is generally nothing to export or delete. If you believe otherwise, contact the operator via the support page.