Version of 21 September 2026. Written to say what actually happens, not to be long.
The short version. This site sets no cookies, runs no analytics, has no tracking pixel and no tag manager. The free check happens in your own browser and nothing about it reaches me or is recorded anywhere. If you email me, I hold your email and your domain so I can do the work and keep an invoice. Ask me to delete it and I will.
When you type a domain and press the button, your own browser asks Cloudflare's public DNS
resolver (cloudflare-dns.com) what that domain publishes. Those records are public: every
mail server in the world reads them without asking permission.
The request goes from you to Cloudflare. It does not come to me. I do not see the domain you typed, I do not count the checks, and there is no database behind this page. Because your browser makes the request, Cloudflare sees your IP address, as it would for any website you visit.
The page also loads a web font from api.fontshare.com, which is a request to a third
party. Nothing else on the page is loaded from anywhere but this site.
What I hold: your name and email address, the domain the work relates to, what we said to each other, and the record of what was invoiced and paid. On the monitoring option, the DMARC aggregate reports your domain generates, which describe sending servers and authentication results and do not contain the content of any message.
Why: to do the work you asked for, and to keep ordinary business records.
Lawful basis: performance of a contract with you, and, for the business records, my legal obligations.
How long: correspondence and reports for as long as the work is live and a reasonable period after. Invoices and payment records for six years, because tax law requires it.
Who else sees it: payments are processed by Stripe, who become the controller of your card details and never share them with me. Email is hosted by Google. Nobody else, and nothing is sold or used for any other purpose, ever.
I write to UK businesses about email authentication. Where the contact is a named person at a company, that name and work email address are personal data, and the lawful basis is legitimate interests: a short, factual, one-off message to a business about a risk to that business.
The source is almost always the company's own published website or Companies House. Nothing is bought from a list broker and nothing is scraped at volume.
Say the word and it stops, permanently. Reply with anything meaning "don't contact me again" and that is the end of it. I keep the minimum record needed to make sure you are never contacted again, and that record exists for that purpose alone.
Email is the route for all of it, and there is no form to fill in.
In the United Kingdom, except that Stripe and Google may process it outside the UK under the safeguards their own terms set out.
None. The free check reads public records and reports what they say. Nothing about you is scored, profiled or decided by a machine.
If this changes, the version date at the top changes with it.