Last updated:
Scope
This notice describes information handled when you visit My Secure Labs or use its diagnostic tools. No account is required. Optional history and favourites are stored on your device; scheduled monitors and their observations are stored on the server.
Information used to provide diagnostics
Requests include technical information such as your public IP address, browser request headers and the domain, IP address, port or record type you enter. This information is used to deliver the page, detect connection details, perform your requested tests and protect against abuse.
Approximate location and provider information come from IP lookup data; GPS permission is not requested. Tool results remain in the page session by default. You can opt in to retain up to 50 recent results locally, and explicitly save up to 50 favourites. Exports are saved wherever you choose.
External providers and target systems
Cloudflare delivers and protects traffic and provides Turnstile browser verification. Hostinger hosts the origin service. These providers can process connection and security information as part of operating their services.
IP detection uses ipify; location and provider lookups use IPWho.is. Registration lookups use RDAP services, DNS queries use resolvers, and blocklist checks query supported providers. The relevant address or domain is sent to those services. Active tests also contact the target system, which may log the request.
Map tiles are loaded from OpenStreetMap, and Inter font resources are loaded from Google Fonts. Requests to these providers expose normal connection information such as your IP address and request headers. Map tile requests can also indicate the area being viewed. Providers may process information in countries other than your own and apply their own privacy practices.
Cookies and browser storage
The application does not implement advertising profiles. It sets an essential, secure verification cookie after a successful security check. The cookie lasts 30 minutes and lets you use different tools without repeating verification; it is not used for advertising. An API restart can require a new check. Cloudflare security features and embedded services may use cookies or other browser signals to deliver their functions. Your browser settings control cookie and storage permissions; blocking required security resources may prevent a test from running.
Scheduled monitoring uses a separate essential Secure, HttpOnly, SameSite cookie lasting 30 days. It grants this browser access to its monitors; it is not an advertising identifier. Removing it loses access to those schedules. Disable and delete monitors before clearing the cookie. History and favourites can be deleted separately in Reports.
Retention and operational records
On-demand diagnostic results are not saved in a server report database. Opt-in local history and favourites remain until cleared, replaced by newer entries or removed through browser settings. Scheduled monitoring stores target domains, IP-version preferences, intervals, up to 96 observations and up to 30 in-app alerts per monitor. Delete a monitor to remove its records. Schedules and records expire after 30 days without monitoring-page access. A hashed browser-access identifier separates monitor ownership. The API also holds IP-based rate-limit records in memory.
The web server, hosting platform, security provider and external lookup services may retain request or security logs under their configured retention settings and policies. Those infrastructure records are separate from the results displayed in your browser. Downloaded files remain on your device until you remove them.
Your choices and privacy rights
You can disable local history, clear results and favourites in Reports, pause or delete monitors and alerts in Monitoring, and remove downloaded files. Closing the browser does not stop scheduled checks. Do not submit confidential targets or information.
Depending on the law that applies to you, you may have rights to access, correct or delete personal information, restrict or object to processing, or complain to a data-protection authority. The availability of a right depends on the information involved and applicable law. An IP address alone may not be enough to reliably identify records belonging to you.
Changes to this notice
This page will be updated when the service's processing practices change. The date above identifies this version. New features such as accounts or persistent report storage would require an updated explanation before their use.