Privacy, in concrete terms.
This notice describes the behaviour of the BrowserInspect application. The homepage automatically creates a core browser snapshot locally and requests your public IP from api.ipify.org for the live visitor preview. Other network requests happen when you choose to run the corresponding check.
Local processing
Browser signals, canvas pixels, offline audio, WebGL details, pasted tokens, policy text, cookies, file contents and HAR archives are processed in the page. The application does not send these inputs to its server. Local report downloads are created from the current result. Closing the tab releases application references, but JavaScript cannot guarantee secure memory erasure.
Requests to other services
| Check | Recipient | Information sent |
|---|---|---|
| Homepage visitor preview and Public IP tool | api.ipify.org | Your connection IP and ordinary request metadata |
| WebRTC | stun.l.google.com | Connection metadata required for a STUN binding request |
| DNS, DNSSEC, email DNS | This server, then Google Public DNS | The requested public DNS name and record type |
| TLS and HTTP headers | This server, then the target site | The requested hostname or URL |
| Password breach | api.pwnedpasswords.com | The first five hexadecimal characters of the password’s SHA-1 hash and connection metadata |
These providers apply their own policies. See ipify, Google Public DNS privacy, and Have I Been Pwned privacy. DNS results and public certificate information are not confidential, but the fact that you queried a domain can be sensitive.
Storage and server handling
The selected light or dark theme is stored in localStorage under browserinspect-theme-v1. Clearing site data removes it. The application sets no tracking cookies and contains no analytics or advertising tags. Fonts are hosted with the application.
The included Node server keeps a temporary request counter by connecting IP for rate limiting, with counters expiring after one minute. It does not implement input, report or access-log persistence. A future hosting provider or reverse proxy can keep independent access logs; its retention and controller details must be documented when public hosting is configured.
Handling sensitive reports
Fingerprint reports contain identifying browser characteristics. Decoded JWT reports can contain personal claims. Network archives can include credentials and response data. Share the minimum necessary information and remove live tokens or identifiers first. This site cannot recall a report after you download or share it.