Privacy Policy

The short version

• xlogs is free and needs no account, so we do not ask for your name, email, or payment details.
• A scan is not kept after it returns, unless you choose something that keeps it: a share link, Watch, or a verified badge. Each is listed below under "What we keep, and for how long". We never keep a value from your data.
• We do keep anonymous counts: which builder platform an app appears to use, which checks ran, and whether they found something. No URL, no address, nothing identifying. See "What we count" below.
• We do not set tracking cookies or sell your information to anyone.

What you give us

The only thing you provide to run a scan is the URL of the app you want checked. You do not create an account and we do not ask for personal information.

What we do with it

When you submit a URL, xlogs requests that public address and the code it serves, plus a short published list of paths a browser would not ask for (such as /.env), using only GET and HEAD, runs its deterministic checks, and returns the results to your browser. The scan and its findings are generated on request and are not saved on our servers afterward, unless you choose one of the features listed under "What we keep, and for how long".

Some checks ask public services about the address you submitted, never about you: the certificate transparency search at Cert Spotter (SSLMate) and the domain registry lookup at rdap.org receive the domain name, and when the site serves an npm lockfile, the OSV advisory database receives the package names and versions in it. The performance report sends the address to Google PageSpeed Insights and the Chrome UX Report.

Share links (only if you create one)

If you click "Share result", and only then, xlogs re-runs the scan and stores that single result so it can be viewed at an unguessable link you can send to a client or teammate. The link expires automatically after 30 days. You are given a private delete link at the same time that revokes it immediately. The stored result contains the same evidence a scan always shows (table and column names, an approximate row count) and never the contents of your data. If you never create a share link, nothing about your scan is stored.

What we keep, and for how long

• Share links, only when you create one: the result as the page shows it (the address, the findings with table and column names and approximate row counts, and the coverage receipt). Deleted after 30 days, or at once with the delete link you are given.
• Watch, only when you sign up: your email address, the sites you add, and the last 50 checks of each site (each check's finding titles, grades and locations, such as table names, and the technologies seen; never a value from your data). Removing a site deletes it and its history. A sign-in link we make for you keeps your email address for 72 hours, or until it is used. To delete your email address, write to us.
• Verified badge, only when you claim one: the domain, when it was verified, which checks ran, and when it was last re-checked. Kept while the badge is published; its page says when it has expired or been taken down. To delete the record, write to us. We also count, with no domain attached, how many people reach each step of claiming a badge.
• Repository badges: a public repository's badge result for six hours, so the image is not recomputed on every view. The showcase: repositories whose owners chose to be listed by putting the xlogs badge in the README; an entry drops out when the badge is removed.
• Rate limiting: a counter keyed by IP address, for one hour. Scan coordination: the address of a site being scanned, for about three minutes, so two scans of one site do not run at once.
• Our own self-scan: the result of scanning xlogs.com, published on the self-scan page. Anonymous counts: see "What we count" below.
• In your browser only: the checks you tick off, the findings you mark as reviewed, and the speed test runs you choose to save for a before-and-after comparison (each run's scores, metrics and audit states, no screenshots) are kept in your browser's local storage and sent nowhere.
• The command line tool's policy file stays on your machine or CI runner and is never sent to us. A report you choose to export from the tool (JSON or SARIF) carries the file's name, its SHA-256 hash and each outcome with the requirement's reason.

Your code and data

xlogs reads only what your app already serves publicly. To test a database table it requests one row, as an anonymous visitor could: the values arrive with that response and are discarded at once, and xlogs keeps only the table and column names and an approximate row count as evidence. Those are kept after your report only where you chose to keep a result: in a share link, or in your Watch history. Every request is a GET or a HEAD; xlogs never submits a form or logs in, and its page crawl skips links that look like actions, such as log out or delete.

What we count

We keep a small anonymous tally so we can publish the defect index, which reports how often each check found a problem in the scans it completed on. A scan is counted when it finishes with a report for a site that answered. For each counted scan we add one to counters for the month: which builder platform the app appears to use; for each check, whether it found something, found nothing, did not apply or could not finish; for a check that could not finish, a coarse reason such as timed out or blocked; which technologies the scan observed, by name and by how sure the detection was; which rule for the security badge the scan reached; and a coarse bucket for how long the scan took. We also keep a running total of counted scans. That is the whole list.

Scans of our own test targets, a deliberately vulnerable app we scan after every release and xlogs.com itself, are counted the same way in a separate internal tally, so we can watch our own tests, and are left out of everything we publish. Our server decides that from the address that was scanned. Until October 19, 2026 those scans were counted with everyone else's, and the totals from before that date still include them.

Repository scans are counted the same way: the month, which package ecosystem the code belongs to (npm, Python, Go and so on), which check ran, whether it found something, and the scan's overall verdict. We do not store the repository name, its owner, or its URL in those counters, and we will never publish a list of repositories that failed.

We do not store the URL, the hostname, an IP address, a timestamp finer than the month, any finding detail, or any data from your app. There is no identifier of any kind in these counters, so there is nothing in them that could be traced back to you or your app, and nothing to delete on request because nothing about you was kept.

We publish counts only, and we will never publish a list of scanned or affected sites.

Server logs

Our hosting provider keeps standard request logs (such as IP address, timestamp, and the request made) for security, abuse prevention, and reliability, as is typical for any website. These are used operationally and are not combined into a profile of you.

Cookies and analytics

xlogs does not use tracking cookies or third-party advertising analytics. If we ever add basic, privacy-respecting usage measurement, we will update this page first and keep essential-only defaults.

Sharing

We do not sell, rent, or trade your information. We share data only where required by law, to operate core hosting, and with the lookups named under "What we do with it", which receive the address or domain you submitted.

Changes and contact

If this policy changes, we will update the date above. Questions about your privacy can be sent to hello@xlogs.com.