Privacy Policy

1. What this service is

The Connection Risk Scanner is a security tool that produces a probabilistic risk score, not a definitive statement about who you are. A high score means the connection has traits commonly associated with automation, tunnelling, or spoofing — it is not proof, and false positives and false negatives are possible. See our Terms of Service for how the score may and may not be used.

2. Network signals (collected automatically from your connection)

When you connect, the server passively observes properties of your TCP/IP connection, TLS/QUIC handshake, and HTTP request. This happens for every visitor and does not require JavaScript.

These signals live only in volatile RAM. Once a signal's window elapses it is no longer used and is overwritten as new traffic arrives; all of it is also cleared whenever the service restarts. None of it is written to a database.

3. In-browser signals (only if JavaScript runs on the scanner page)

If your browser runs the page script, it submits a one-off measurement set to the /me and /api/fp/observation endpoints so the server can compute a cumulative score. This includes:

• WebRTC ICE candidates, which can include local/private and, in some configurations, public IP addresses beyond your connection IP (used to detect split-tunnel VPNs);
• automation / headless indicators (e.g. navigator.webdriver, driver properties, permission-state anomalies);
• time-zone, locale and languages;
• an active timing measurement over a WebSocket in which your browser hashes a challenge, so the server can time the true round-trip and compare it to the network RTT;
• an OPFS/storage-timing measurement (read/write latency distribution) used to tell physical devices from virtual machines — this measures timing only, it does not read file contents;
• screen metrics, and whether the page's honeypot images finished loading;
• bucketed GPU/WebGL renderer, audio, canvas, WebGPU, media-codec, WASM and User-Agent Client Hints values used by the consistency scorer.

These raw browser measurements are processed within the request and are not written to a database or aggregated into a profile. The response is sent with Cache-Control: no-store. Some of the values you submit (for example a leaked WebRTC IP or a mismatched platform) may be echoed back to you inside the explanation of your own result.

Short-term comparison hashes. To notice abrupt changes and count how often a similar profile has been seen very recently, the server keeps small HMAC-SHA256 hashes derived from these signals for up to 15 minutes. These hashes contain no raw values, are keyed to a coarse network prefix (a /24 IPv4 or /48 IPv6 block, not your exact IP) plus a device hash, and build no cross-site or long-term identity graph.

4. Honeypot images & the DNS-leak check

Honeypot decoy images

The page embeds a few invisible decoy images at unique, single-use URLs (/h/<token>/N.bmp). The server records which of them your client actually fetched — a genuine browser loads them, many bots do not. This record (your IP, the per-page token, and which tiles loaded) is held in memory for up to about 10 minutes.

DNS-leak check

To detect when a VPN/proxy is used but DNS still resolves elsewhere, the page includes a resource hint for a unique host name under our own zone. Your device's recursive DNS resolver (your ISP's resolver, or a public provider such as Cloudflare, Google or Quad9) then queries our authoritative name server. We record that resolver's IP address — a piece of your network infrastructure, not typically your own device — for up to about 10 minutes, and compare its country/network to your connection's. We look the resolver up against the same on-server database; its IP is not sent to anyone.

5. What we deliberately do not do

The scanner intentionally avoids covert and persistent tracking techniques. In particular it does not:

• read pixels back from your canvas (it only checks that the API exists);
• plant supercookies via HSTS, favicons, or ETags;
• use external STUN servers to harvest your public IP;
• run GPU execution-timing (DrawnApart), sensor-calibration (SensorID), TCP clock-skew, or TLS session-ticket tracking to link you across connections;
• set any tracking cookie, or load any third-party advertising, analytics, social, font, or CDN script;
• sell, rent, or share your data with data brokers.

6. Cookies, local storage & theme

We set no cookies and use no sessionStorage or IndexedDB. The site keeps a single small value in your browser's localStorage: cg_privacy_ack, which records the version of this notice you dismissed so it can reappear when the policy changes. It does not identify you and is never sent to the server. The light/dark appearance follows your operating-system preference automatically — there is no theme switch and no theme preference is stored. You can clear the stored value any time in your browser settings.

7. Sharing, third parties & data location

We do not share or sell your personal data. The limited external relationships are:

Our servers are located in Mumbai, India, so the limited data above is processed in India.

8. Server logs

For security and debugging, the server writes operational log lines to its standard error output. Most decision logs use only a coarse network prefix and non-reversible hashes. However, some security log lines — for example when we detect a spoofed User-Agent — may record your full IP address and the associated TLS fingerprint. These logs are used only for operating and defending the service; they are not aggregated into visitor profiles, and their lifetime depends on our host's standard log handling.

9. Legal basis, your rights & children

Processing relies on our legitimate interest in detecting and preventing automated abuse, fraud, and bot traffic (Art. 6(1)(f) GDPR where the GDPR applies). Because our servers are in India, data is processed under the Digital Personal Data Protection Act, 2023. If you access the site from the EU/EEA or the UK, the GDPR / UK GDPR also applies and using the site involves a transfer of the limited data described here to India.

You have the rights of access, rectification, erasure, restriction, and objection. In practice we hold no persistent, searchable record tied to your identity: everything is short-lived in-memory data that expires within the windows above and cannot be looked up after the fact, so in most cases there is nothing left to retrieve or delete by the time a request reaches us — erasure effectively happens by waiting out the short window. The service is not directed at children, and we do not knowingly collect data from anyone under the age required by their local law.

10. Security & changes

All traffic is served over TLS (HTTPS, including HTTP/2 and HTTP/3). Scanner data lives only in process memory for its short lifetime and is not exported. If this policy changes materially, the on-site notice will reappear so you can review it. Questions or requests: hello@pwn-all.com.