Privacy policy

CommonSwift is built to know as little about you as possible.

Anonymous scans

When you scan a domain we process the domain you typed and a salted, one-way hash of your network address for rate limiting. We do not store your raw IP address. Scan results and evidence are deleted 7 days after the scan. There are no advertising trackers on this site.

Accounts

If you sign in with Google we receive your email address and a Google account identifier, and we store them against an internal account id that we generate ourselves. We also store the date and time you accepted our terms and the domains you add to monitoring. We never receive or store your Google password, and we do not ask you to create one here.

Cookies

We set one cookie, named session, and only after you sign in. It keeps you signed in and does nothing else. It carries no advertising or analytics identifier, and there are no tracking cookies on this site. Signing in with Google and the bot check on our scan form are provided by Google and Cloudflare, which may set their own cookies on their own domains. You can clear the session cookie at any time by signing out.

Where data lives

All data is stored in Google Cloud in the EU (europe-west1). Evidence pages are stored unlisted and are never made public.

Processors

We use Google Cloud for hosting and storage, urlscan.io for safe page capture, MerkleMap for certificate log search, and the Google Gemini API for automated assessment. Each receives only what is needed to run your scan.

Your rights

Under the GDPR you can request access to or deletion of your data at any time. Contact details are on the Impressum page. Anonymous scan data deletes itself after 7 days regardless.