Privacy policy

Summary

• iframecheck has no accounts, no sign-up and no ads.
• iframecheck sets no cookies. It loads one analytics script from Databuddy, which counts visits without cookies. The fonts and the site search load from iframecheck.com.
• When you check a URL, our server requests that URL once and reads its headers. It keeps the result in memory for up to 60 seconds. It does not save the URL to a database.
• The preview loads the page that you test directly in your browser. That site then sees your IP address and your browser, under its own privacy policy.
• To send you a page, Cloudflare, which runs our server, must see your IP address. Our server log keeps no IP address and no URL that you tested.
• If you email us, we keep your message so that we can reply.
• We do not sell your personal data. We do not share it for ads.

Who is responsible

Dobroslav Radosavljevič, a private person in the Czech Republic, runs iframecheck and is the controller of your personal data. The controller is the person who decides why and how personal data is used. In this policy, "we" and "us" mean Dobroslav Radosavljevič.

Email: business@dobroslavlabs.com

We have no data protection officer. Article 37 of the GDPR does not require one: we do not monitor people on a large scale, and we do not process special categories of data.

What we process and why

When you open a page

Each request to iframecheck.com goes to Cloudflare. Our server runs on Cloudflare Workers, in the Cloudflare data centre nearest to you. Cloudflare sees the data that your browser sends with each request:

• your IP address
• the address of the page and the time of the request
• your user agent: a short text that names your browser, its version and your operating system
• the referrer: the page that you came from, if your browser sends it

Our own server log keeps no IP address and no location. Each line holds the path of the page, without the query string, the answer status, the time that the answer took, your user agent with the browser, operating system and device type read from it, and the sizes of the request and the answer. The log keeps each error, each slow request and 1 in 10 of the other requests. Cloudflare keeps this log for us in Workers Logs and deletes it after 7 days. We turned off the Cloudflare log of each request, because it holds your IP address.

Cloudflare uses your IP address to send you the page and to stop attacks. Cloudflare gives us totals only, for example the number of requests for each day and each country. These totals do not identify you. Cloudflare does not give us a log of single requests.

Network error reports. Cloudflare adds the NEL and Report-To headers to our pages. If a page does not load, your browser can then send Cloudflare a short report about the network error. This is Network Error Logging, a standard browser feature. The report holds the page address, the error type and your IP address.

Why we use this data: to send you the pages, to keep the site safe from attacks and abuse, and to find and fix errors.

Legal basis: our legitimate interest in a site that works and is safe (Article 6(1)(f) GDPR).

When you check a URL

When you enter a URL, your browser sends it to our server. Our server then does these steps:

1. It refuses addresses on private networks and URLs that contain a user name or a password.
2. It requests the URL once and reads the response headers. It stops before it reads the page body.
3. It follows up to 5 redirects.
4. It shows you a verdict (embeddable, partial, blocked or unreachable), the headers and the fixes.

The site that you test gets this request from our server, not from your browser. It sees the address of a Cloudflare server, not your IP address.

Our server keeps each result in memory for up to 60 seconds, so that it can answer the same check again fast. Then it drops the result. We do not save the URLs that you test, or the headers that we get, to a database or to a file.

The bulk check works the same way, for up to 100 URLs in one run.

Do not put secrets or personal data in a URL that you test, for example a login token in the query string.

Why we use this data: to give you the result that you asked for.

Legal basis: our legitimate interest in a tool that works (Article 6(1)(f) GDPR).

Rate limit

To stop abuse, our server counts the checks from each IP address. It keeps each count in memory for the length of its time window. The next check after that removes it. By default, the window is 5 minutes for a check and 10 minutes for a bulk check. Then it drops the count. It writes nothing to disk. If an IP address sends too many checks in one window, the server refuses more checks until the window ends.

Why we use this data: to keep the tool available for all users, and to stop people who use it to send a lot of traffic to other sites.

Legal basis: our legitimate interest in a tool that is safe and available (Article 6(1)(f) GDPR).

Analytics

We use Databuddy to learn which pages people read, which links they follow and which errors and slow pages they see. Databuddy uses no cookies. Each page loads the Databuddy script from cdn.databuddy.cc, and the script sends events to basket.databuddy.cc.

The script sends:

• the address and title of the page, without the query string
• the referrer, without the query string, and campaign parameters such as utm_source
• a random visitor ID and a session ID, and the time of each event
• your browser, operating system, device type, screen size, language and time zone
• clicks on links to other sites, clicks that do nothing and repeated fast clicks
• the type of each site search result that you open. It never sends the text that you type into the search.
• the verdict of each check that you run, for example "blocked", and the failure type when a check fails. It never sends the URL that you test.
• the server or the code format when you copy a fix or an embed code, for example "nginx" or "html"
• errors in the page code, and how fast the page loads and reacts

Databuddy uses your IP address to find your approximate country, region and city. Then it removes the IP address from the event. It stores the visitor ID only after a hash with a salt that changes every day. We do not give Databuddy your name or email address, and we cannot connect the events to you.

If your browser sends Global Privacy Control or Do Not Track, the script sends nothing.

Why we use this data: to learn which pages are useful, and to find and fix errors and slow pages.

Legal basis: our legitimate interest in a site that is useful and works well (Article 6(1)(f) GDPR).

When you email us

When you write to us, we get your email address, your name if you give it, and your message. We use them only to reply to you and, if you report an error, to fix the tool or a guide.

We delete the message when we do not need it for the conversation any more. We keep it for 2 years after the last message at the most.

Legal basis: our legitimate interest in answering your questions and in correct results (Article 6(1)(f) GDPR).

If you write to us on X, the privacy policy of X also applies.

Pages that you test

The preview loads the URL that you test in an iframe in your browser. The responsive preview and the sandbox playground do the same. Your browser connects to that site directly. Our server is not between you and that site.

So that site sees your IP address, your browser and its own cookies, as if you opened the page yourself. It can also run its own scripts inside the frame. Its own privacy policy applies, not this policy. We do not control what that site does.

Only test URLs that you trust.

Cookies and browser storage

iframecheck sets no cookies.

If you choose the light or the dark theme, your browser saves the choice on your device. It uses local storage, with the key theme. The choice never leaves your device, and we never read it on the server. The law allows this without consent, because you asked for it. To remove it, clear the site data for iframecheck.com in your browser.

The Databuddy script saves a random visitor ID in local storage, with the key did. It saves the session ID in session storage, with keys that start with did_session. Your browser deletes the session storage when you close the tab. To remove the visitor ID, clear the site data for iframecheck.com in your browser.

Cloudflare can set a cookie such as cf_clearance if it must check that you are a person and not a bot. Cloudflare can also set __cf_bm for bot protection. It expires after 30 minutes of inactivity. These cookies are necessary for security. Cloudflare does not use them to track you.

A page that you load in the preview can set its own cookies. Those cookies belong to that site, not to iframecheck.

Who receives your data

We use these services. Each one processes data for us only:

• Cloudflare, Inc. (United States): hosting, network, DNS and protection from attacks. Our server runs on Cloudflare Workers, in the Cloudflare data centre nearest to you. Privacy policy
• Google (Google Workspace): our email. Privacy policy
• Databuddy Analytics, Inc.: analytics. Privacy policy

We give your data to no one else, unless a law or a court order makes us do it. The sites that you test are not on this list. They get a request from our server, and your browser connects to them for the preview, but we do not send them your data.

Transfers outside the EU

Cloudflare and Google are companies in the United States, so your data can go to the United States. Cloudflare also answers, and runs our server, in the data centre nearest to you, which can be outside the EU.

Each of these companies must rely on a transfer mechanism that the GDPR allows, for example the EU-US Data Privacy Framework or standard contractual clauses. The European Commission decided that the EU-US Data Privacy Framework gives an adequate level of protection (Article 45 GDPR).

How long we keep data

• Check results: in server memory, up to 60 seconds.
• Rate limit counts: in server memory, for the length of the time window (by default 5 or 10 minutes), until the next check removes them.
• Our server log in Cloudflare Workers Logs, with no IP address and no tested URL: 7 days.
• Cloudflare: Cloudflare keeps no request log for us. It keeps its own security and network data for the times that its privacy policy gives.
• Databuddy analytics events: while the iframecheck project exists in Databuddy. We can delete them at any time.
• Emails: until we do not need them, 2 years after the last message at the most.
• Your theme choice and the Databuddy visitor ID: on your device, until you clear the site data.

Your rights

Under the GDPR, you can ask us to:

• show you the personal data that we have about you, and give you a copy
• correct data that is wrong
• delete your data
• limit how we use your data

To use a right, email business@dobroslavlabs.com. We reply within 1 month. It is free.

Our server log holds no IP address, no name and no email address, so we cannot find your log lines. Logs older than 7 days are already deleted. Check results are gone after 60 seconds, and rate limit counts soon after their time window ends. The analytics events hold no IP address, so we cannot find your events.

Your right to object

We use your data on the basis of our legitimate interest. You have the right to object to this at any time, for reasons that come from your own situation (Article 21 GDPR). After you object, we stop, unless we have strong legitimate reasons that override your interests, or we need the data for a legal claim.

Complaints

You can complain to a data protection authority. In the Czech Republic, this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. You can also complain in the EU country where you live or work. In the United Kingdom, this is the Information Commissioner's Office.

Please write to us first. We can often fix the problem fast.

Other points

• You do not have to give us personal data. Without your IP address, we cannot send you the pages.
• We make no automated decisions about you, and we do not build a profile of you. The verdict is about the page that you test, not about you.
• iframecheck is for web developers. It is not made for children. We do not knowingly collect data from children under 15.
• We do not sell or share personal information, as the California Consumer Privacy Act uses these words. We do not use it for targeted ads.

Changes and contact

When this policy changes, the "Last updated" date at the top changes too. Before we add a service that processes your data, for example a form, we update this page.

For each question about your data, write to business@dobroslavlabs.com.