Privacy policy

Who we are

Trufend is operated by Trufend Ltd, Victoria Street, Cambridge, New Zealand. For anything in this policy, use the contact form, which reaches the person accountable for it.

This policy is written to the New Zealand Privacy Act 2020 and its information privacy principles. Visitors in the European Union and the United Kingdom have further rights under the GDPR and UK GDPR, and visitors in California under the CCPA; both are covered below.

Analytics, and the choice you are given

We use Google Analytics 4 to see which pages people read and roughly where they arrive from. It is ordinary traffic measurement: how many visits, which articles, which tools. We do not use it to build advertising audiences, and Google Signals and ad personalisation are both switched off.

Analytics needs cookies, so you are asked first. The tag is not on the page until you accept:

• Decline, or ignore the banner, and the Google tag is never loaded. Your browser makes no request to Google, and no analytics cookie is set.
• Accept, and Google Analytics sets two first-party cookies: _ga, which lasts two years, and _ga_FKBT75WM16, which lasts two years. Both hold a randomly generated identifier so repeat visits can be recognised as the same browser. Neither contains your name or your email address.

You can change your mind at any time using cookie settings, which appears in the footer of every page. Withdrawing consent clears those cookies immediately and stops anything further being sent.

What Google receives, when you have accepted, is the page you are on, the page you came from, your approximate location from your IP address, and general device and browser information. Google Analytics 4 does not log or store IP addresses. Google acts as our processor for this and may handle it outside New Zealand, including in the United States, under its own terms and standard contractual clauses. Google's own explanation is at policies.google.com/technologies/partner-sites. You can also block it everywhere with Google's opt-out add-on.

The domain you type into the scanner is not sent to Google. Checks run as a background request, so the domain never appears in a page address or in an analytics event.

What is stored in your browser

Aside from the analytics cookies described above, which are yours to refuse, these stay on your device and are never transmitted to us:

• Your work in the free tools. The SPF and DMARC generator, security headers generator, CSP builder, incident response plan and vendor register each save what you type so you can close the tab and come back. This is held in your browser's local storage under keys beginning tf_. Clearing your browser data removes it, and so does the reset control in each tool.
• The domain you type on the home page, held for a few seconds in session storage so the report page knows what to check. It is discarded when you close the tab.
• Your cookie choice, so you are asked once rather than on every page.

None of those three requires consent under the Privacy Act or the European ePrivacy rules, because each is strictly necessary for something you asked the site to do. They are stored by the browser, not as cookies, and are never sent anywhere.

What happens when you run a check

A check is passive. The scanner requests the pages and DNS records your domain already publishes to anyone, the way an ordinary visitor or a search engine would. It does not log in, submit anything, or attempt to alter what it finds.

When you run one, the server holds:

• The domain you entered, for as long as it takes to produce the report.
• A copy of the report for one hour, in a file named after a hash of the domain, so that checking the same domain again returns the same result instead of re-scanning it.
• A counter entry: a shortened SHA-256 hash of the domain, kept only so that the same domain is not counted twice in the public scan total. The domain itself is not written down in readable form.
• A rate-limit record in a file named after a hash of your IP address, holding nothing but timestamps, which expires after ten minutes. It exists to stop the scanner being used to flood a target.

Our web host keeps standard server logs of requests to this site, which normally include IP addresses. Those logs are written and deleted by the host on its own schedule rather than ours: we do not set that period, do not copy the logs anywhere, and do not use them for analytics or profiling. If you want to know how long a record of your visit persists on that server, ask us through the contact form and we will get the current answer from the host for you.

Reports are not published, not shared and not sold, and they are not sent to Google or anyone else. The only figure ever made public is the aggregate count of checks shown on the home page, which contains no domains.

If you write to us

The contact form is the one form on this site that sends anything. When you submit it, your name, your email address, your subject line and your message are emailed to contact at trufend dot com, and that is the whole of it: no copy is written to a database, no analytics event is recorded, and no third party sits in the middle. The message stays in that mailbox for as long as the correspondence is useful, and your address is used to reply to you and for nothing else. It is not added to any list.

The form asks you to read a distorted image before it will send. That image is generated on our own server, comes from no one else, and sets no cookie. Nothing about you is recorded to make it work: the answer is checked by recomputing it, and the only thing kept afterwards is a meaningless one-way value, for about fifteen minutes, so one solved image cannot be replayed. If you cannot read the image, writing to the address above reaches exactly the same place and asks nothing of you.

The mailing-list form on the home page is a separate thing, and it is not connected to a list yet. Nothing is transmitted when you use it. If that changes, this policy will be updated first, and your address will be used only to send what you asked for, with an unsubscribe link in every message.

Scanning a domain you do not own

Everything a check reads is already published to anyone who asks for it, so a report contains no private information about any person. If a domain's public pages happen to contain personal information, that information was already public; we do not extract, index or retain it beyond the one-hour report cache described above.

Where your information goes

The site and the scanner are hosted with Hostinger, on a server in the United States, in Massachusetts. That is outside New Zealand, so principle 12 of the Privacy Act applies to it. Hostinger holds this information on our behalf, under its own data processing terms, and not for any purpose of its own; those terms are what we rely on for comparable safeguards, and they are also the basis for the transfer for visitors in the European Union or the United Kingdom.

In practice, what reaches that server is what any web server receives: the requests your browser makes, the domain you type into the scanner, and the hashed rate-limit and report cache files described above. The only other party that receives anything is Google, for analytics, and only from visitors who have accepted it. Nothing else is disclosed to anyone, in New Zealand or overseas, except where the law requires it of us.

Your rights

Under the New Zealand Privacy Act you may ask what personal information we hold about you, ask for it to be corrected, and complain if you think we have handled it badly. Because we hold no accounts and no readable record of who checked what, in practice there is usually nothing to return. Ask through the contact form, choosing the privacy option, and we will answer within 20 working days.

In the EU or UK you additionally have rights of access, rectification, erasure, restriction, portability and objection under the GDPR. For running the service safely, producing the report you asked for and preventing abuse of the scanner, the lawful basis is our legitimate interest. For analytics, the lawful basis is your consent, which you give or refuse on the banner and can withdraw at any time from the footer.

In California, we do not sell personal information, and we have not done so in the preceding twelve months. Because analytics can count as "sharing" under the CPRA when it feeds cross-context advertising, we have switched off Google Signals and ad personalisation, and declining the banner opts you out entirely. We do not offer financial incentives for personal information.

Children

This site is aimed at people running websites and is not directed at children. We do not knowingly collect information from anyone under 16.

Complaints

If we have not put something right to your satisfaction, you can complain to the Office of the Privacy Commissioner in New Zealand. Visitors in the UK may complain to the Information Commissioner's Office, and visitors in the EU to their national data protection authority.

Changes

If this policy changes in any way that matters, the date at the top changes with it and the first-visit notice is shown again.