Privacy
SaytYoxla needs no sign-up and does not ask for your name or phone. An e-mail address is needed only if you choose ongoing watching yourself.
What is kept
- The checked address and its result: stay in the server's memory for up to 10 minutes to speed up a repeat check. The result is not tied to your name.
- Your IP address: stays for up to 1 day in the counter that limits the number of checks, to prevent abuse.
- Hosting logs: the site runs on Vercel, which may keep technical request logs to operate its service.
What is not used
The site has no ads, no tracking scripts and no cookies. Fonts are loaded from our own server too.
What the checked site sees
During a check, the site's home page, robots.txt and sitemap.xml are opened once from our server. The site sees our server's address, not your IP address.
Deep analysis
The deep analysis sends the domain name to certificate logs (Cert Spotter, crt.sh), a registration database (rdap.org, along with the IP address) and DNS blocklists, and the name and version of a library visible on the site to a vulnerability database (OSV). A server program's version goes to NVD (nvd.nist.gov) and plugin names to wordpress.org, and when keys are set WPScan, Spamhaus and Google Safe Browsing are asked too. On the site itself the home page, its own scripts (6 at most), robots.txt and security.txt are read, and TLS connections are tried. The comparison with an earlier check is kept only in your browser (localStorage) and does not reach the server.
The deep check (exposed files, folders, ports, the DNS zone and reading up to 30 pages of the site, and testing address parameters for SQL injection and reflected XSS with read-only, non-destructive requests) runs only after you prove the site is yours with a DNS record or a file. If a file or key is found, only its path and kind are shown; its content is neither shown nor stored.
Watching
If you start ongoing watching yourself, your e-mail address, the site's name and the last check's result are kept in Upstash Redis, and messages are sent through Brevo. The address is kept only after you confirm by its link, and the link in each message deletes it.
If you press "Message on WhatsApp", a prepared message opens in WhatsApp and you send it yourself. WhatsApp's own rules apply from there.