Privacy Policy

What we collect

Public lookups (DNS, email, SSL, network, and security tools used without logging in) aren't tied to your identity. We don't require an account, and the target you looked up isn't linked back to you.

If you create an account: your email address, an optional display name, and — if you sign up with a password rather than Google — a bcrypt hash of it (never the password itself). If you use Google Sign-In, we store Google's stable account identifier for your account, not your Google password.

Domain Monitors and Super Scanner history tied to your account: the targets you've scanned, their scores, and findings, so you can track a domain's health over time and revisit past reports.

API keys are stored as a SHA-256 hash, plus a short prefix so you can identify which key is which — the full key is shown to you once, at creation, and can't be retrieved again afterward.

IP address: read from the request (respecting Cloudflare/ X-Forwarded-For headers) for the "Your Information" widget, for the optional usage paywall (off by default) if it's enabled, and recorded against security-relevant account actions (login, password change, API key changes) in your account's activity log so you can spot anything you don't recognize.

Email Deliverability Test: if you send a test email to the address it generates, we record the sending IP, the From domain, and the SPF/DKIM/DMARC result for that one message, to compute your score.

Cookies and analytics

Your login session is kept in your browser's local storage, not a cookie. If Google Analytics is enabled on this deployment, it sets its own standard analytics cookies and collects aggregate usage statistics (pages visited, approximate location from IP, browser/device type) — we don't connect that data to your NetworkTools account.

Third-party services we use

• Google Sign-In — only if you choose to sign in or link that way.
• PayPal — only for donations, or payment if the optional usage paywall is enabled.
• ipinfo.io — IP geolocation for the "Your Information" widget.
• Have I Been Pwned — the password breach checker queries it via k-anonymity (a partial hash prefix); your actual password never leaves your browser.
• Email delivery (SMTP) — for account verification codes and contact form messages.

How long we keep it

Account data, monitors, and scan history are kept until you delete them yourself, or delete your account entirely. Public (logged-out) lookups aren't retained against any identity, so there's nothing tied to you to delete for those.

Your data, your control

From Account Settings, at any time, you can:

• Export your data — a JSON download of your profile, monitors, teams, API keys, and account activity log.
• Delete your account — permanently removes your profile, personal monitors, API keys, and activity log. If you own a team, the team is deleted along with it (its monitors and every other member's membership too) since there's no way to hand off ownership first; teams you've merely joined are left alone for their other members, minus your own membership.

Security

Passwords are hashed with bcrypt; API keys are stored as a SHA-256 hash. Every diagnostic tool validates its target against SSRF protections (blocking internal, private, loopback, link-local, and cloud-metadata addresses) before making any outbound request. See Terms of Service for the acceptable-use rules that go along with that.

Children's privacy

NetworkTools isn't directed at children, and we don't knowingly collect data from anyone under 13.

Changes to this policy

If what we collect or how we use it changes, we'll update the "last updated" date above.

Contact

Questions, or want your data removed and don't have access to your account? Contact us.