Privacy Policy

L-Scan is a non-commercial hobby project. It is provided for authorized security diagnostics and educational use, not as a commercial service. There is no advertising, no user accounts and no selling of data. This policy explains, in plain terms, what limited data is processed when you use it.

This project is operated from Germany / EU.

The site operator has not published a privacy contact for this deployment. Ask the operator for a contact channel before using a public instance.

The project is designed to process as little personal data as possible. Depending on how you use it, the following may be processed:

• Server access data. When you load the site or start a scan, the server and the hosting/CDN provider may process technical request data such as your IP address, date and time, the requested URL, HTTP status, user agent and the referrer (where your browser sends it), plus error and security logs.
• Data you submit to the tool. The scan target (domain or IP address), port range, protocol selection, optional subdomain hints and the bot-verification token. This input is processed in memory to perform the scan you requested and to stream results back to you.
• Bot / abuse protection. A self-hosted proof-of-work and browser-instrumentation challenge is used to deter automated abuse. When replay storage is configured, short-lived challenge nonces and verification-token hashes are stored temporarily. Your IP address is used transiently for rate limiting.
• Optional subdomain discovery. If you enable subdomain scanning, the target domain name is sent to third-party passive-DNS and certificate-transparency data sources to look up known subdomains.
• Optional usage analytics. Analytics are disabled for this deployment.

• Legitimate interest (Art. 6(1)(f)). Operating the service securely and reliably — including access and security logs, rate limiting, bot protection and aggregate cookieless analytics.
• Performing the function you request (Art. 6(1)(b)/(f)). When you intentionally submit a target and start a scan, including any optional subdomain lookups you enable.
• Consent (Art. 6(1)(a)) is used only where optional, non-essential analytics, tracking or marketing cookies, or non-essential third-party embeds are used. This project does not currently use such technologies, so no consent banner is shown.

Scan input and results are processed transiently in memory to answer your request and are not written to an application database. Cap challenge nonces and verification-token hashes, when replay storage is configured, expire automatically within ten minutes. Without that storage, production uses signed expiring tokens without strict one-time consumption. Rate-limiting counters are held briefly in memory and pruned automatically. Server, security and hosting/CDN logs are kept only as long as needed for operation, security and debugging, then deleted or rotated according to the hosting/CDN provider's configuration. No custom retention period is configured by the application itself.

Some processing necessarily involves service providers. The exact hosting provider depends on the deployment configuration:

• Hosting / CDN / network provider that serves the site and runs the scan backend (a Node-capable host fronted by a CDN/WAF, depending on deployment configuration).
• Managed Redis provider (Upstash in the recommended Vercel deployment) for short-lived Cap replay-prevention records. It receives random challenge signatures, token hashes and expiry times, but not scan targets or results.
• Vercel Web Analytics for aggregate, cookieless usage analytics, only on deployments that enable it.
• Passive-DNS / certificate-transparency data sources used only when you enable subdomain discovery (for example Certificate Transparency logs / crt.sh, CertSpotter, HackerTarget, AlienVault OTX, RapidDNS, BufferOver, JLDC/Anubis, the Wayback Machine and ThreatCrowd). These receive only the target domain you entered.

This project does not set advertising, tracking or analytics cookies.

• Cap runs locally in your browser using application-hosted JavaScript and WebAssembly. It does not set a cookie or use browser storage, and the verification flow does not contact a third-party CAPTCHA service.
• Aggregate analytics, when enabled, are cookieless.

Because only technically necessary mechanisms and cookieless analytics are used, no cookie consent banner is shown. If optional tracking is ever added, consent will be requested first.

Under the GDPR you have the right to:

• access the personal data processed about you;
• rectification of inaccurate data;
• erasure (“right to be forgotten”);
• restriction of processing;
• object to processing based on legitimate interest;
• lodge a complaint with a data protection supervisory authority.

Because the project stores very little and generally cannot link transient technical data to your identity, fulfilling some requests may require you to provide information that identifies the relevant data. To exercise your rights, use the contact details above.

This policy may be updated as the project evolves. The “last updated” date above reflects the current version.