Privacy Policy

Last updated: October 27, 2026

This policy explains what whack.sh collects, why, and your choices. As a defensive security tool we aim to collect only what we need to run the Service.

1. What we collect

• Account data: your email and name, and, if you sign in with Google, your Google account identifier (we never receive your Google password).
• Scan data: the URLs you submit and the artifacts we capture for them (HTTP metadata/HAR, screenshots, and a derived cloaking score). Any payload we retain is quarantined server-side for detection, not stored against your account. For a sampled portion of free datacenter scans, we may also load the same URL through a third-party residential network to compare what the site serves to different visitors; that comparison is not billed to you, and only a divergence indicator (whether the results differed) is retained against your account.
• Anonymous scans (no account): the URL you submit and the scan results. The network capture and page copy are deleted after 24 hours and the report link after 7 days; no screenshot is taken. After 7 days we keep a reduced record: the URL's query string is removed, and so is its path unless the scan flagged the link as malicious or deceptive. Our scanner servers log only the host name of an anonymous scan, never the full link, and keep those logs for at most 7 days. To enforce scan limits we keep keyed hashes of your IP address and of its network block (the /24 for IPv4; the /64 and /48 for IPv6), your network's AS number, and a keyed hash of a random browser identifier. We delete the browser hash after 7 days and the IP, network and AS data after 30 days. A scan under an abuse or legal hold is kept as it is until the hold ends; the deletions and reductions above then follow. Rate-limit counters are deleted after a day without use. To apply our country restriction we look up the country of your IP address with Cloudflare and with WorldIP, an IP-location service we operate; we keep the result for up to 6 hours under a keyed hash of your IP address. We do not ask for your name or email.
• Usage & billing: credits consumed, plan, and your activity ledger.
• Technical data: IP address, user agent, and server logs needed for security and abuse prevention. Web-server logs record each requested URL, including report links, and are kept for 14 days.

2. How we use it

To provide and secure the Service, run scans, meter and bill usage, prevent abuse, respond to support, and improve the product. We do not sell your personal data.

3. Cookies

We use strictly necessary cookies: an httpOnly session cookie that keeps you signed in and protects forms, and, on the free URL scanner, a __Host-wsa cookie with a random identifier that counts your free scans and shows you your own recent scans (it expires within 7 days of your last visit to the scanner). Cloudflare Turnstile runs on sign-up, sign-in, password reset, contact and the scanner to block automated abuse. Google Analytics 4 sets analytics cookies on public pages, including shared scan reports; you can block them in your browser. We also measure aggregate usage with Umami, which we host ourselves and which sets no cookies, on public pages and in the signed-in app. Anonymous scan reports carry no analytics.

4. Third parties

We rely on a small set of processors: Google (Sign-in with Google, and GA4 / Search Console analytics), Cloudflare (CDN, TLS, DDoS protection, and Turnstile bot checks on forms and the scanner; Turnstile receives your IP address and browser signals), MailerSend (transactional email such as verification and password reset), PayPal (payment processing for credit purchases and subscriptions; your payment details are entered directly on PayPal and are never seen or stored by whack.sh), and third-party residential, mobile, and datacenter proxy networks that carry the vantage-point traffic for multi-egress scans, geo-pinned datacenter egress, and free-scan comparison legs (the submitted URL is loaded through them; they are not given your account data), and, for the optional plain-English scan summary, Google (Gemini API), which receives only aggregated finding metadata (verdict, signal categories, and counts), never your personal data or the raw target page content, under a no-retention key tier. Each processes data only to provide its function.

For scans run from an account, we check the scanned URL, its redirects and the resources it loads against Google Safe Browsing, and we look up the IP addresses of the sites a scan reaches with IP-reputation services (WorldIP and Team Cymru). Anonymous scans skip these lookups.

When a scan from an account captures a file that is confirmed malicious, we contribute that file to VirusTotal and abuse.ch (MalwareBazaar, or YARAify for archives) and its hashes to AlienVault OTX. We may also contribute the URL of a confirmed-malicious page to abuse.ch (URLhaus and ThreatFox) and Netcraft; you can turn URL contribution off in your account settings. Contributions never include your identity or account details. Nothing from a scan run without an account is contributed. See Community contributions.

5. Retention

Scan artifacts are retained while useful for your investigation and then periodically purged. Account data is retained until you delete your account. We may keep limited records as required by law or for security. A malware sample contributed to a public research platform (VirusTotal, abuse.ch MalwareBazaar or YARAify, AlienVault OTX) is retained by that platform under its own policy and cannot be recalled or deleted by us. Captures from account scans are kept for 30 days; the scan record stays in your history. Anonymous scans: page copy and network capture 24 hours; report link 7 days; scanner logs (host name only) at most 7 days; network-address hashes 30 days; a reduced scan record is kept as threat-intelligence data, with the URL's query string removed and, unless the scan flagged the link as malicious or deceptive, its path. These periods are extended only while a scan is under an abuse or legal hold.

6. Your rights

You can access, export, or delete your account data: contact us via the contact page and we'll action verified requests. Depending on your location you may have additional rights under GDPR or CCPA. To delete an anonymous scan, send us its report link while it is active, or the scanned URL and the date of the scan after it expires.

7. Security

Data is encrypted in transit (TLS). Credentials are stored hashed, never in plaintext. Access to internal systems is restricted and network-isolated.

8. Children

The Service is not directed to anyone under 16 and we do not knowingly collect their data.

9. Contact

Privacy questions or requests? Reach out.