No accounts, and no table to hold one

There is no sign-in on this site. No email address, no password, no OAuth, no API key, no session, and no notification destination.

This is not a feature we have not got to. Accounts were designed and then removed: they existed for exactly one purpose — delivering an alert somebody had asked for — and when that feature was cut, an account would have been a person's identity stored for nothing. Two migrations dropped the tables and then the last two person-shaped columns anywhere in the schema.

The difference matters. “We do not store your email address” is a promise somebody has to remember to keep. There is no column in this database in which an email address could be stored, and the next person who wants one has to write the migration and make the argument in public.

No cookies, and no visitor identifier

This site sets no cookies. Not a session cookie, not a preference cookie, not an analytics cookie. There is no consent banner because there is nothing to consent to.

There is no visitor identifier of any other kind either: no localStorage fingerprint, no device identifier, no tracking pixel, no third-party analytics script. Nothing on any page loads from another domain, except the Turnstile widget on the paste box.

No IP addresses

No IP address is stored anywhere in this product, in any form, including hashed. Not in the database, not in a log we keep, not in any response.

Rate limiting genuinely needs to tell callers apart, and that is the only place an address is used at all. It is turned into a short-lived token and then discarded:

• Salted with a secret generated in memory when a Worker starts — never written down, never logged, never transmitted, and gone when that Worker is. So the token cannot be reversed by hashing the whole address space and matching.
• Time-bucketed, so the same address produces a different token in the next window. Correlating one caller across windows is not possible for us either.
• Truncated to 12 characters — enough to separate callers within one window, too coarse to be an identifier.
• Expiring: the token lives in a Durable Object, is deleted by an alarm when its window closes, and never reaches the database.

What we do store

The endpoint, and what it served: a URL, the HTTP 402 payment challenge behind it, when we observed it, and what changed since last time. All of it is public data the endpoint hands to anyone who asks, and none of it describes the person who asked.

A scan records whether it came from a person, an API caller or the crawler. That is which kind of surface it arrived through, not who arrived — and there is no table beside it that a person could be joined to.

Share links and replay traces

A share link stores a snapshot of a scan so a result can be sent to somebody without re-probing the endpoint. Its identifier is 128 random bits, it is excluded from the sitemap and from robots.txt, it expires after 90 days with the date shown on the page, and it can be revoked. It contains what the endpoint served and nothing about whoever made it.

A replay trace can contain secrets, so redaction happens in your browser before anything is uploaded, using the same redactor the SDK uses on its own diagnostic stream. Sharing is opt-in per trace: if you do not share it, it never leaves your machine. The command-line tool and the MCP server go further — the offline verifier makes zero network calls, and a test asserts it.

Analytics, and Turnstile

Availability and latency go to Cloudflare Workers Analytics Engine, which is sampled and kept for three months. What is written is a probe outcome — an endpoint, a host, a status, a latency. There is no visitor in it because there is no visitor identifier to put in it, and we only ever read it as an aggregate.

The paste box carries a Cloudflare Turnstile widget, which tells a person from a script without a CAPTCHA and without a cookie. We receive one thing from it: a yes or a no. We do not log or store the token, and there is nothing in the exchange we could tie to you afterwards. It appears only where somebody submits a URL for us to fetch — reading any page here involves no Turnstile at all.

The infrastructure layer, stated honestly

This site runs on Cloudflare, and Cloudflare's edge — like every CDN — processes request metadata including your IP address in order to route and serve the request. We do not enable Cloudflare Web Analytics or any other visitor-analytics product on this zone, and nothing from that layer is retained by, exposed to or queryable by this application.

We say this rather than claiming an absolute, because “no IP address anywhere” would be untrue at the network layer for any website on any host, and a policy that overclaims is worth less than one that draws the line where it actually is. The line is that nothing about you crosses from the network layer into this application.

Your rights, and the honest limit on them

There is no data about you here to access, correct, export or delete, so there is no request to make and nobody to make it to. That is the intended outcome rather than an evasion: the deletion story for data that was never collected is the only one this product can offer completely. There is also no way to authenticate such a request, because there is no sign-in — and building one would mean collecting an identity in order to service requests about the identity we collected.

If you operate an endpoint we have observed, that is a different and real thing with its own process: claim it by proving control of the origin with a DNS TXT record or a well-known file, see exactly what has been recorded, correct a wrong fact, or opt out entirely. The proof is control of the domain, never an identity we hold about you.

Checking any of this

None of the above is meant to be believed. The two biggest claims on this page take about ten seconds to check in your browser's devtools.

The long form — with the source file and migration behind each claim — is in docs/privacy.md. If you operate an endpoint we have observed, the crawler page is where you claim it, correct it or opt out.

Changes and contact

This policy changes in the same commit as the change it describes, in a public repository with a full history. There is no mailing list to notify because there is no mailing list.

• Privacy questions: security@tx402.io
• Endpoint opt-out and abuse: abuse@tx402.io

Last updated 2026-08-15.