Privacy
We check the link, not you.
url.vet needs the link you paste, and nothing else. Here is exactly what happens to it.
In short
No accounts. No cookies. No ads. No trackers. No profiles of you. No IP addresses in our logs. No data sold.
When you scan a link
The link goes to our server, which runs the checks and sends back the result. Our server sees your IP address while it answers, and uses it for one thing: limiting how many requests one address can make per minute. It keeps only a scrambled version that can't be turned back, and deletes it after a minute.
Our logs never contain your IP address or the link you scanned. They record one line per request: which page, whether it worked, how long it took. If an error mentions a web address, everything after the ? is cut before it's written.
What we keep, and for how long
- Scan results 24 hours
- Cached by link, so a repeat or shared check loads instantly. Some individual checks expire sooner.
- Page screenshots 24 hours
- Stored on our server, then deleted automatically.
- Recent searches Until restart
- The last 100 scans (link, verdict, score, time), held in the server's memory for the admin dashboard. Never written to disk.
- Reports you send Until fixed
- The link, our verdict and score, your suggestion, your comment and the time. No IP address, no account.
Who else sees the link
Some checks need outside help. These are the only others involved:
- Vercel, our host
- Hosts this website, so it sees your IP address and the page you open (for a share link, that includes the scanned link). It keeps request logs briefly. See Vercel's privacy policy.
- The website you scan
- Our server visits it and takes a screenshot. The site, and any trackers on it, see our server, not you.
- PhishTank
- Nothing, normally. We download its list of reported phishing every few hours and check your link against it on our server. Only if that list hasn't loaded yet do we send PhishTank the link.
- Google Safe Browsing
- A few short codes worked out from the link, never the link itself. Many different links share each code, so Google can't tell which one you checked. It sends back matches from its list of dangerous sites, and our server finishes the check. See Google's privacy policy.
- DNS resolvers
- Receive the domain name only, to find the servers behind it.
- Domain registries
- Receive the domain name only, so we can look up its age.
Everything this website loads (fonts, images, code) comes from url.vet itself.
Sharing a result
A share link contains the scanned link, the verdict and the score, so anyone you send it to (and any app that shows a preview of it) can see those. Nothing about you is in it.
In your browser
Your browser remembers your light or dark theme and whether you've met or hidden Vetty. That stays on your device, and clearing your site data removes it.
The browser extension
It checks pages as you open them, by sending only the page's address, the same way as a scan here. The 10,000 best-known sites are never sent: the extension keeps that list on your device. Your settings and trusted sites are kept by your browser, and synced by it if you use browser sync; url.vet never receives them. You can turn the automatic checks off in its settings.
Your rights
url.vet is run by abhizaik. We hold nothing tied to your name. To ask what we hold about a link you scanned or reported, or to have a report deleted, email [email protected].
Verify it
Everything above is in the source code, and you can run your own copy if you'd rather not use ours. Every change to this page is public too, in its history on GitHub.
Got a link you're unsure about?
Check it now