Privacy policy

In short: we only process what your test needs, delete your test email after 24 hours and the report after 30 days. No cookies, no tracking, no third-party services.

1. Controller

Maximilian Scharsich (scharsich.dev), Gorrenberg 18, 14776 Brandenburg an der Havel
Email: kontakt@scharsich.dev

2. Your test email

When you send an email to your test address, we store the complete message (headers and content) and the delivery details: IP address and name of the sending server, envelope sender, encryption and time. We use them to create your report.

• Purpose and legal basis: performing the check you requested (Art. 6(1)(b) GDPR). For the spam score the message is processed by the open-source software rspamd on our servers; no content is sent to third parties.
• Retention: we delete the complete message after 24 hours. The report with the results and the delivery details is deleted after 30 days.
• Please note: only send test messages without confidential content, e.g. with the subject "Test".

3. Checking your domain

For the report we query public DNS records of your sender domain, fetch files from its web servers where needed (MTA-STS policy, BIMI logo and certificate) and briefly connect to its receiving servers to check encryption. We do not transmit any data about you.

For the blocklist check we ask the operators of PSBL, UCEPROTECT Level 1, Abusix via DNS whether the IP address of the mail server that delivered your test email is listed. Only this IP address is transmitted – no content, no sender address, no domain (Art. 6(1)(b) GDPR). If you run your own mail server, this IP address may be attributable to you.

4. Visiting the website

• No access logs with IP addresses: neither our application nor the reverse proxy in front of it keeps logs with visitors' full IP addresses.
• Abuse protection: so that nobody can use the service automatically at scale, we count started tests per IP address. We only store a non-reversible hash (HMAC) of the IP address and delete it after one day (Art. 6(1)(f) GDPR; our legitimate interest is protecting the service).
• Bot check: after an unusually high number of tests we ask for a short check with ALTCHA, in which your browser solves a small computation. It runs entirely on our servers, without cookies or third-party services.
• No cookies, no tracking: we set no cookies and use no analytics or advertising services. If you choose a colour scheme, your browser remembers it locally (local storage); it is not sent to us.
• Share link: every report has a link that cannot be guessed. Anyone who has it can see the report, so share it with care.

5. Hosting and recipients

The service runs on our own servers in Germany. We do not pass your data on to third parties, except for the IP address of the delivering mail server in the blocklist check (section 3). We use Let's Encrypt for the certificate of our receiving server; no data about you is transmitted.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). Contact us at the address above. You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow.