Privacy Policy
Effective October 23, 2026
ecdsa.com is built so that the keys, tokens and documents you paste into its tools stay in your browser. This policy covers everything else: what reaches our servers, what is stored and for how long, who processes it for us, and how you can see or delete it. It describes what the site’s code does.
In short
- The tools run in your browser. Keys, tokens, certificates and documents you paste into them are processed on your device and are not sent to us.
- 27 tools send public data — a domain, a URL, an address, a public key — and only when you press the button that does it. They are listed below with what they send and where it goes.
- We store an email address only when you give it to us: for the newsletter, certificate alerts, the waitlist or an account.
- There is no advertising, no tracking and no sale of data. The only cookies are the ones that keep you signed in.
- Visits are counted with Vercel Web Analytics, which uses no cookies and receives page addresses without their query string or fragment.
- You can export or delete your data yourself, or write to privacy@ecdsa.com.
Who is responsible
ecdsa.com is operated by KeepFlow L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. (“we”, “us”). We decide why and how the data described here is processed, and we are responsible for it.
For anything about your data or this policy, write to privacy@ecdsa.com.
What stays in your browser
Every tool runs on your device unless its page says otherwise. What you type or paste into a tool is processed by code in your browser and is not sent to ecdsa.com or to anyone else. The exceptions are the tools in the next section, and they send only what is described there.
- Share links keep a tool’s state in the part of the address after
#s=. Browsers do not send that part to any server, and the share function leaves out private fields such as private keys. - The site search (⌘K) downloads its index and searches it in your browser: what you type into the search box is not sent.
- The box on the home page that recognises pasted input does so in your browser and opens the matching tool with the input in the share part of the address.
- The site can be installed and used offline: your browser keeps copies of its pages and scripts. They contain nothing you typed.
A few features remember things in your browser’s local storage. It stays on your device and is never sent to us; clearing the site’s data in your browser deletes it.
| Name | What it holds |
|---|---|
ecdsa.my-domains.v1 | Your My domains list and the last result of each check. |
ecdsa.course.v1 | Which lessons of the course you finished, and the name for the certificate if you enter one. |
ecdsa.passkey-sandbox.v1 | The passkey sandbox’s test credentials (public data only), when you ask it to remember them. |
ecdsa:language-banner:dismissed | That you closed the suggestion to read a page in another language; it is shown only when the site is available in more than one language. |
ecdsa:theme | Your choice of a light or dark theme, once the theme switcher is offered. |
Tools that send data when you ask
27 tools need data that a browser cannot reach on its own. Each sends it only when you press its button, and only what is listed here. The list is generated from the tools’ own declarations, and each tool’s page repeats its statement next to the button.
When a tool contacts another service directly from your browser, that service sees your IP address and browser details as it sees any visit, under its own privacy policy. When a tool goes through our server, the other service sees our server instead of you.
- Sends:
- a Bitcoin address
- To:
- ecdsa.com (our server)
This tool queries the public mempool.space API — the address you enter is sent to our server and on to mempool.space. No keys or signatures of yours are involved.
- Sends:
- a URL
- To:
- ecdsa.com (our server)
This check runs on our server: only an address — an https URL or a domain name — is sent to ecdsa.com, which fetches it for you (a browser cannot fetch someone else's JWKS anyway — CORS forbids it). Anything else you type stays in your browser, and nothing is stored.
- Sends:
- a public key or its fingerprint
- To:
- ecdsa.com (our server)
The checks run in your browser. Only when you press “Check on the server” are the badkeys hash of each public key and RSA moduli sent to ecdsa.com — never a private key.
- Sends:
- a domain name
- To:
- cloudflare-dns.com
- dns.google
Generating and checking pasted records happens in your browser. “Check DNS” sends the domain name — and its parent names, as the CAA lookup climbs — to the DNS-over-HTTPS resolver you choose (Cloudflare or Google). Nothing else is sent, and our servers receive nothing.
- Sends:
- a domain name
- To:
- cloudflare-dns.com
- dns.google
Certificates are read and records computed in your browser. “Look up in DNS” sends the record name (for example _25._tcp.mail.example.com) to the DNS-over-HTTPS resolver you choose (Cloudflare or Google); certificates and pasted records are never sent anywhere.
- Sends:
- a domain name
- To:
- cloudflare-dns.com
- dns.google
Signatures are verified in your browser. Inspecting a name sends DNS questions for it, its parent zones and their keys to the DNS-over-HTTPS resolver you choose (Cloudflare or Google), and nothing else; our servers receive nothing.
- Sends:
- what its statement names
- To:
- pq.cloudflareresearch.com
- www.cloudflare.com
Pressing “Check my browser” makes two requests from your browser to Cloudflare (pq.cloudflareresearch.com and www.cloudflare.com/cdn-cgi/trace), without cookies; Cloudflare sees the request as it sees any visit. Nothing from this page is sent, and your IP address from the answer is never shown or put in a link.
- Sends:
- what its statement names
- To:
- ecdsa.com (our server)
“Show my fingerprint” asks ecdsa.com’s own server for the JA4 that Vercel’s edge computed for this connection; nothing is sent with the request, and the fingerprint is not stored or logged. Pasted fingerprints and ClientHellos are read in your browser.
- Sends:
- a domain name
- To:
- ecdsa.com (our server)
The list is read in your browser. Pressing Check sends each domain name to ecdsa.com’s public API (/api/v1/health), which connects to that domain on port 443 and keeps the result in its cache for an hour; nothing else is sent.
- Sends:
- a domain name
- To:
- cloudflare-dns.com
Your message never leaves this browser. Only the key names the signatures point to (selector._domainkey.domain) are sent to Cloudflare’s DNS-over-HTTPS resolver, and only when you press the button that looks them up.
- Sends:
- a domain name
- To:
- cloudflare-dns.com
Your message never leaves this browser. Only the key names the seals and signatures point to (selector._domainkey.domain) are sent to Cloudflare’s DNS-over-HTTPS resolver, and only when you press the button that looks them up.
- Sends:
- a domain name
- To:
- cloudflare-dns.com
Keys are generated in this browser; the private key is never sent and never put into a share link. Only the record name (selector._domainkey.domain) is sent to Cloudflare’s DNS-over-HTTPS resolver, and only when you press “Check DNS”.
- Sends:
- an Ethereum address
- To:
51 public services
- 1rpc.io
- api.avax.network
- arb1.arbitrum.io
- arbitrum-one-rpc.publicnode.com
- avalanche-c-chain-rpc.publicnode.com
- base-rpc.publicnode.com
- base-sepolia-rpc.publicnode.com
- berachain-rpc.publicnode.com
- blast-rpc.publicnode.com
- bsc-dataseed.bnbchain.org
- bsc-rpc.publicnode.com
- celo-rpc.publicnode.com
- cloudflare-eth.com
- eth.drpc.org
- ethereum-hoodi-rpc.publicnode.com
- ethereum-rpc.publicnode.com
- ethereum-sepolia-rpc.publicnode.com
- forno.celo.org
- gnosis-rpc.publicnode.com
- linea-rpc.publicnode.com
- mainnet.base.org
- mainnet.era.zksync.io
- mainnet.optimism.io
- mainnet.unichain.org
- mantle-rpc.publicnode.com
- nova.arbitrum.io
- optimism-rpc.publicnode.com
- polygon-amoy-bor-rpc.publicnode.com
- polygon-bor-rpc.publicnode.com
- polygon.drpc.org
- rpc-gel.inkonchain.com
- rpc.berachain.com
- rpc.blast.io
- rpc.gnosischain.com
- rpc.hoodi.ethpandaops.io
- rpc.hyperliquid.xyz
- rpc.linea.build
- rpc.mantle.xyz
- rpc.monad.xyz
- rpc.scroll.io
- rpc.soneium.org
- rpc.soniclabs.com
- rpc.zora.energy
- scroll-rpc.publicnode.com
- sepolia-rollup.arbitrum.io
- sepolia.base.org
- sepolia.drpc.org
- sepolia.optimism.io
- sonic-rpc.publicnode.com
- unichain-rpc.publicnode.com
- worldchain-mainnet.g.alchemy.com
The typed data stays in this browser. Only when you press “Check on chain” are the spender and operator addresses sent to a public RPC node of the domain’s chain (listed next to the button), to ask whether they are contracts.
- Sends:
- an Ethereum address
- a signature
- a message hash
- To:
51 public services
- 1rpc.io
- api.avax.network
- arb1.arbitrum.io
- arbitrum-one-rpc.publicnode.com
- avalanche-c-chain-rpc.publicnode.com
- base-rpc.publicnode.com
- base-sepolia-rpc.publicnode.com
- berachain-rpc.publicnode.com
- blast-rpc.publicnode.com
- bsc-dataseed.bnbchain.org
- bsc-rpc.publicnode.com
- celo-rpc.publicnode.com
- cloudflare-eth.com
- eth.drpc.org
- ethereum-hoodi-rpc.publicnode.com
- ethereum-rpc.publicnode.com
- ethereum-sepolia-rpc.publicnode.com
- forno.celo.org
- gnosis-rpc.publicnode.com
- linea-rpc.publicnode.com
- mainnet.base.org
- mainnet.era.zksync.io
- mainnet.optimism.io
- mainnet.unichain.org
- mantle-rpc.publicnode.com
- nova.arbitrum.io
- optimism-rpc.publicnode.com
- polygon-amoy-bor-rpc.publicnode.com
- polygon-bor-rpc.publicnode.com
- polygon.drpc.org
- rpc-gel.inkonchain.com
- rpc.berachain.com
- rpc.blast.io
- rpc.gnosischain.com
- rpc.hoodi.ethpandaops.io
- rpc.hyperliquid.xyz
- rpc.linea.build
- rpc.mantle.xyz
- rpc.monad.xyz
- rpc.scroll.io
- rpc.soneium.org
- rpc.soniclabs.com
- rpc.zora.energy
- scroll-rpc.publicnode.com
- sepolia-rollup.arbitrum.io
- sepolia.base.org
- sepolia.drpc.org
- sepolia.optimism.io
- sonic-rpc.publicnode.com
- unichain-rpc.publicnode.com
- worldchain-mainnet.g.alchemy.com
Messages and signatures are checked in this browser. Only when you press “Check on chain” are the wallet address, the 32-byte digest and the signature sent to a public RPC node of the chain you pick (named next to the button). Seed phrases and private keys are refused, never processed.
- Sends:
- an Ethereum address
- a signature
- a message hash
- To:
51 public services
- 1rpc.io
- api.avax.network
- arb1.arbitrum.io
- arbitrum-one-rpc.publicnode.com
- avalanche-c-chain-rpc.publicnode.com
- base-rpc.publicnode.com
- base-sepolia-rpc.publicnode.com
- berachain-rpc.publicnode.com
- blast-rpc.publicnode.com
- bsc-dataseed.bnbchain.org
- bsc-rpc.publicnode.com
- celo-rpc.publicnode.com
- cloudflare-eth.com
- eth.drpc.org
- ethereum-hoodi-rpc.publicnode.com
- ethereum-rpc.publicnode.com
- ethereum-sepolia-rpc.publicnode.com
- forno.celo.org
- gnosis-rpc.publicnode.com
- linea-rpc.publicnode.com
- mainnet.base.org
- mainnet.era.zksync.io
- mainnet.optimism.io
- mainnet.unichain.org
- mantle-rpc.publicnode.com
- nova.arbitrum.io
- optimism-rpc.publicnode.com
- polygon-amoy-bor-rpc.publicnode.com
- polygon-bor-rpc.publicnode.com
- polygon.drpc.org
- rpc-gel.inkonchain.com
- rpc.berachain.com
- rpc.blast.io
- rpc.gnosischain.com
- rpc.hoodi.ethpandaops.io
- rpc.hyperliquid.xyz
- rpc.linea.build
- rpc.mantle.xyz
- rpc.monad.xyz
- rpc.scroll.io
- rpc.soneium.org
- rpc.soniclabs.com
- rpc.zora.energy
- scroll-rpc.publicnode.com
- sepolia-rollup.arbitrum.io
- sepolia.base.org
- sepolia.drpc.org
- sepolia.optimism.io
- sonic-rpc.publicnode.com
- unichain-rpc.publicnode.com
- worldchain-mainnet.g.alchemy.com
The message and the signature are checked in this browser. Only when you press “Check on chain” are the address, the EIP-191 digest and the signature sent to a public RPC node of the message’s chain (named next to the button).
- Sends:
- an Ethereum address
- the fields of a transaction
- To:
51 public services
- 1rpc.io
- api.avax.network
- arb1.arbitrum.io
- arbitrum-one-rpc.publicnode.com
- avalanche-c-chain-rpc.publicnode.com
- base-rpc.publicnode.com
- base-sepolia-rpc.publicnode.com
- berachain-rpc.publicnode.com
- blast-rpc.publicnode.com
- bsc-dataseed.bnbchain.org
- bsc-rpc.publicnode.com
- celo-rpc.publicnode.com
- cloudflare-eth.com
- eth.drpc.org
- ethereum-hoodi-rpc.publicnode.com
- ethereum-rpc.publicnode.com
- ethereum-sepolia-rpc.publicnode.com
- forno.celo.org
- gnosis-rpc.publicnode.com
- linea-rpc.publicnode.com
- mainnet.base.org
- mainnet.era.zksync.io
- mainnet.optimism.io
- mainnet.unichain.org
- mantle-rpc.publicnode.com
- nova.arbitrum.io
- optimism-rpc.publicnode.com
- polygon-amoy-bor-rpc.publicnode.com
- polygon-bor-rpc.publicnode.com
- polygon.drpc.org
- rpc-gel.inkonchain.com
- rpc.berachain.com
- rpc.blast.io
- rpc.gnosischain.com
- rpc.hoodi.ethpandaops.io
- rpc.hyperliquid.xyz
- rpc.linea.build
- rpc.mantle.xyz
- rpc.monad.xyz
- rpc.scroll.io
- rpc.soneium.org
- rpc.soniclabs.com
- rpc.zora.energy
- scroll-rpc.publicnode.com
- sepolia-rollup.arbitrum.io
- sepolia.base.org
- sepolia.drpc.org
- sepolia.optimism.io
- sonic-rpc.publicnode.com
- unichain-rpc.publicnode.com
- worldchain-mainnet.g.alchemy.com
Hashes, decoding and risk checks run in this browser. Only when you press “Check on chain” are the Safe’s address and every field of the transaction, calldata included, sent to a public RPC node of the chain you pick (named next to the button).
- Sends:
- a transaction hash
- an Ethereum address
- To:
51 public services
- 1rpc.io
- api.avax.network
- arb1.arbitrum.io
- arbitrum-one-rpc.publicnode.com
- avalanche-c-chain-rpc.publicnode.com
- base-rpc.publicnode.com
- base-sepolia-rpc.publicnode.com
- berachain-rpc.publicnode.com
- blast-rpc.publicnode.com
- bsc-dataseed.bnbchain.org
- bsc-rpc.publicnode.com
- celo-rpc.publicnode.com
- cloudflare-eth.com
- eth.drpc.org
- ethereum-hoodi-rpc.publicnode.com
- ethereum-rpc.publicnode.com
- ethereum-sepolia-rpc.publicnode.com
- forno.celo.org
- gnosis-rpc.publicnode.com
- linea-rpc.publicnode.com
- mainnet.base.org
- mainnet.era.zksync.io
- mainnet.optimism.io
- mainnet.unichain.org
- mantle-rpc.publicnode.com
- nova.arbitrum.io
- optimism-rpc.publicnode.com
- polygon-amoy-bor-rpc.publicnode.com
- polygon-bor-rpc.publicnode.com
- polygon.drpc.org
- rpc-gel.inkonchain.com
- rpc.berachain.com
- rpc.blast.io
- rpc.gnosischain.com
- rpc.hoodi.ethpandaops.io
- rpc.hyperliquid.xyz
- rpc.linea.build
- rpc.mantle.xyz
- rpc.monad.xyz
- rpc.scroll.io
- rpc.soneium.org
- rpc.soniclabs.com
- rpc.zora.energy
- scroll-rpc.publicnode.com
- sepolia-rollup.arbitrum.io
- sepolia.base.org
- sepolia.drpc.org
- sepolia.optimism.io
- sonic-rpc.publicnode.com
- unichain-rpc.publicnode.com
- worldchain-mainnet.g.alchemy.com
Decoding runs in your browser. Only when you press a lookup button does the page send a transaction hash or the recipient’s address to a public RPC node of the network you choose (or to your own RPC URL) — never the transaction you pasted.
- Sends:
- an Ethereum address
- To:
51 public services
- 1rpc.io
- api.avax.network
- arb1.arbitrum.io
- arbitrum-one-rpc.publicnode.com
- avalanche-c-chain-rpc.publicnode.com
- base-rpc.publicnode.com
- base-sepolia-rpc.publicnode.com
- berachain-rpc.publicnode.com
- blast-rpc.publicnode.com
- bsc-dataseed.bnbchain.org
- bsc-rpc.publicnode.com
- celo-rpc.publicnode.com
- cloudflare-eth.com
- eth.drpc.org
- ethereum-hoodi-rpc.publicnode.com
- ethereum-rpc.publicnode.com
- ethereum-sepolia-rpc.publicnode.com
- forno.celo.org
- gnosis-rpc.publicnode.com
- linea-rpc.publicnode.com
- mainnet.base.org
- mainnet.era.zksync.io
- mainnet.optimism.io
- mainnet.unichain.org
- mantle-rpc.publicnode.com
- nova.arbitrum.io
- optimism-rpc.publicnode.com
- polygon-amoy-bor-rpc.publicnode.com
- polygon-bor-rpc.publicnode.com
- polygon.drpc.org
- rpc-gel.inkonchain.com
- rpc.berachain.com
- rpc.blast.io
- rpc.gnosischain.com
- rpc.hoodi.ethpandaops.io
- rpc.hyperliquid.xyz
- rpc.linea.build
- rpc.mantle.xyz
- rpc.monad.xyz
- rpc.scroll.io
- rpc.soneium.org
- rpc.soniclabs.com
- rpc.zora.energy
- scroll-rpc.publicnode.com
- sepolia-rollup.arbitrum.io
- sepolia.base.org
- sepolia.drpc.org
- sepolia.optimism.io
- sonic-rpc.publicnode.com
- unichain-rpc.publicnode.com
- worldchain-mainnet.g.alchemy.com
Decoding runs in your browser. Only when you press a lookup button does the page send account addresses (the signers, the sender or a delegate) to a public RPC node of the network you choose, or to your own RPC URL.
- Sends:
- an Ethereum address
- a transaction hash
- To:
23 public services
- 1rpc.io
- base-sepolia-rpc.publicnode.com
- base-sepolia.blockscout.com
- cloudflare-eth.com
- eth-hoodi.blockscout.com
- eth-sepolia.blockscout.com
- eth.blockscout.com
- eth.drpc.org
- ethereum-hoodi-rpc.publicnode.com
- ethereum-rpc.publicnode.com
- ethereum-sepolia-rpc.publicnode.com
- gnosis-rpc.publicnode.com
- gnosis.blockscout.com
- mainnet.optimism.io
- optimism-rpc.publicnode.com
- optimism.blockscout.com
- rpc.gnosischain.com
- rpc.hoodi.ethpandaops.io
- rpc.scroll.io
- scroll-rpc.publicnode.com
- scroll.blockscout.com
- sepolia.base.org
- sepolia.drpc.org
Pasted transactions are checked in your browser. A scan, started only by its button, sends the address to a Blockscout explorer and then each transaction hash to a public RPC node of the chosen network.
- Sends:
- a URL
- To:
4 public services
- accounts.google.com
- appleid.apple.com
- login.microsoftonline.com
- www.googleapis.com
Validation runs in your browser. Only when you press “Load from the issuer” does your browser request the provider's public discovery document and JWKS, directly from the issuer you entered; the token, codes and secrets never leave this page.
- Sends:
- a URL
- To:
- chatgpt.com
- http-message-signatures-example.research.cloudflare.com
Checks run in your browser. Only when you press “Load in the browser” does your browser request the bot's public key directory, directly from the origin named in Signature-Agent; the request you pasted never leaves this page.
- Sends:
- a signature
- the digest of a file
- a public key or its fingerprint
- To:
- ecdsa.com (our server)
Verified in your browser: the bundle and your file stay here. Only if you press “Check with sigstore-js” are the bundle and the file’s digest — never the file — sent to ecdsa.com for a second, independent check.
- Sends:
- an npm package name and version
- To:
- registry.npmjs.org
Verified in your browser. When you press Check, only the package name and version you typed are sent to registry.npmjs.org — and only if they look like a package name, never like a key or a secret. The examples replay recorded answers without any request.
- Sends:
- a domain name
- a URL
- To:
- ecdsa.com (our server)
- cloudflare-dns.com
The BIMI record is looked up from your browser through Cloudflare’s DNS-over-HTTPS resolver, which receives the domain name. The certificate and logo URLs named in the record go to our server, which downloads those public files for you — browsers cannot. Pasted files are decoded in your browser and sent nowhere.
- Sends:
- the whole email message, with your consent
- To:
- ecdsa.com (our server)
Unlike every other tool on this site, this one sends data to our server: when you agree and press the button, the whole message goes to ecdsa.com for analysis. It is checked in memory and never logged, stored or cached. Without your consent nothing is sent — the DKIM debugger checks signatures in your browser.
- Sends:
- a URL
- To:
- ecdsa.com (our server)
Ordering and checking the chain happens in your browser. Only when you ask it to fetch a missing intermediate does the AIA URL taken from the certificate go to our server, which downloads that public certificate for you. Your bundle is never sent, and nothing is stored.
- Sends:
- what its statement names
- To:
- ecdsa.com (our server)
Only an AAGUID, a UAF AAID or words of a model name are sent to our server; anything that looks like a key or a secret is refused in your browser and never sent. The server answers from the metadata BLOB it downloads from the FIDO Alliance and verifies; nothing about your query is stored.
The Email Authentication Analyzer is the one tool that sends private content: the whole message you paste. It sends nothing until you tick its consent box and press the button. The message is analysed in memory on our server and is never logged, stored or cached; the DNS lookups the analysis needs go to Cloudflare’s DNS over HTTPS. To keep a message on your device, the DKIM debugger checks its signatures in your browser.
Checks on our server and the public API
Some checks run on our server because a browser cannot make them: opening a TLS connection to a domain, downloading a file from a server that does not allow it, reading the fingerprint of your own connection. For each, our server receives what you entered together with the request itself.
- Domain reports (Domain Signature Health), README badges, the Bulk Domain Checker and the API’s health operation connect to the domain you name and keep the report in a shared cache for 60 minutes: anyone who asks about the same domain in that time gets the same report. A report describes a public host, not you.
- The JWKS & OIDC Checker, the certificate chain builder and the BIMI decoder have our server download the public URL you give, or one named in your certificate or DNS record. Downloaded certificates, revocation lists and BIMI files are cached by URL, without any link to you.
- The Nonce Reuse Checker sends the Bitcoin address to our server, which asks mempool.space for its transactions, so mempool.space sees our server and not you.
- Weak-key lookups, the second Sigstore check and AAGUID lookups are answered in memory from data our server already holds, and the TLS fingerprint from your own connection; nothing about these requests is stored.
- Request bodies are never stored and never written to logs. Our code logs errors and operational events only, with email addresses masked (a***@e***.com) and API keys cut to their public id.
- To enforce rate limits, the server counts requests per IP address (per /64 network for IPv6 on some forms) in the memory of the instance that answers, for the window of the limit — one minute or one hour. These counters are not written to the database.
- The public API and its MCP server refuse private keys before processing anything and never log request bodies. Usage is counted per day and per operation for each API key, or as “anonymous” for calls without a key. The usage table has no column for an IP address, and the database refuses to store one in it.
- Like every visit, these requests pass through Vercel, which hosts the site; see who processes data for us.
Newsletter, certificate alerts and the waitlist
These forms keep the email address you enter, with double opt-in: until you open the link in the confirmation email, the address receives nothing but confirmation emails. Our emails are sent through Resend.
Newsletter. Your address, the language of the page, where the form was (for example, the end of an article), when you signed up and confirmed, and when the last issue was sent to you. Every issue carries a one-click unsubscribe link; unsubscribing deletes the record.
Certificate expiry alerts. Your address, the domain, the language of the page and when you subscribed and confirmed, plus what the alerts need: the expiry date of the certificate and which alert was sent last. Once a day our server checks the certificate of the domain and emails you when it is 30, 14, 7, 3, and 1 days from expiry. Every alert carries an unsubscribe link that deletes the record.
Waitlist of paid plans. Your address, the plan, the number of domains, your answer to “What do you need?”, the language of the page, where the form was, when you joined and confirmed, and — if you were signed in with the same address — a link to your account. We use it to tell you when the plan opens and to decide what to build. A request nobody confirms is deleted 7 days after the last confirmation email; the link in our emails takes you off the waitlist and deletes the request.
A newsletter or alert sign-up that is never confirmed receives nothing but its confirmation email; the link works for 7 days, and the sign-up is deleted after that.
Against abuse, each form accepts at most 10 requests an hour from one network and for one address, counted in server memory, and the waitlist sends at most one email per address and plan every 10 minutes.
Accounts, API keys and monitoring
Accounts are not open yet. This section describes how they work once they are; until then none of this data is collected.
Signing in
An account is optional. You sign in with a link we email you — it works once, for 15 minutes, and we store only a SHA-256 hash of it — or, where it is offered, with GitHub. Signing in with GitHub asks GitHub for your verified email address only (the user:email scope). We keep your GitHub user id to recognise you; we do not store GitHub’s access token or your avatar.
What an account stores
- Your email address, an optional name of up to 80 characters, and the language of our emails.
- For each session: a random token (the cookie carries it with a signature), the network you signed in from — your IP address cut to its /24 for IPv4 or its /48 for IPv6 — and your browser’s user agent, up to 512 characters. A session lasts 30 days and is extended at most once a day while you use it; expired sessions are deleted.
- Counters of sign-in requests per network and per address, stored as a keyed hash (HMAC) instead of the address and deleted when their window ends.
API keys
An API key is shown once, when you create it. We store its public id, its name, mode and scopes, when it was created, last used, set to expire or revoked, its last 4 characters, and an HMAC-SHA-256 hash of its secret — never the key itself. Revoked keys stay in your list until you delete the account. Daily usage counters are kept per key and operation; they are not deleted with the account, but once the key is gone they point to no one.
Monitoring
Monitors keep the domains and key-set (JWKS or OIDC) URLs you add, their settings, what the latest checks found, and a check history of 30 days. Domains are checked every 6 hours and key sets every 2 hours, by connecting to those public hosts. A certificate is announced 30, 14, 7, and 1 days before it expires.
Alerts and a weekly digest go to the address of your account; the digest carries a one-click unsubscribe link. If you connect Slack, the incoming-webhook URL is encrypted with AES-256-GCM under a key the database does not hold, and it is never shown again: only its last 4 characters are. If you add webhook endpoints, we keep their URL, description and events, and a record of each delivery (the event, its content, the status, the attempts and the last error) until you delete the endpoint or the account. Deliveries are signed and tried up to 7 times.
When the new-certificate check is switched on, the domains of your monitors are sent to SSLMate’s Cert Spotter API. Its answers are public Certificate Transparency data: they are cached without any link to you and deleted once no check has used them for 30 days.
Export and deletion
The account page shows your data and downloads all of it as a JSON file; secrets such as session tokens and key hashes are left out. Deleting the account needs a sign-in within the last 60 minutes. It deletes at once your profile, sessions, sign-in methods, plan, API keys, monitors with their history, notification settings, webhook endpoints with their deliveries, and the waitlist requests linked to the account. Newsletter and alert subscriptions are separate: their emails carry their own unsubscribe links.
Statistics
We count visits with Vercel Web Analytics and measure how fast pages load with Vercel Speed Insights. Neither sets cookies.
- Before anything is sent, the page address is cut to its path: no query string (such as a search term) and no fragment (such as the state of a shared tool) leaves your browser this way.
- Besides page views, the site reports only the events listed below, each with values from a fixed set or the name of the tool on the page. They never contain what you typed.
Events
- Omnibox open
- Search open
- Share
- Tool verdict
- Subscribe
- Badge copy
- With each page view or event, Web Analytics records the time, the page, the referring page, your browser, operating system and device type, and your approximate location derived from the IP address, down to the city; it tells visits apart with a hash of the request that it discards after 24 hours. Speed Insights records the page, its loading times, the network speed, your browser, operating system and device type, and your country. Neither service identifies you (Web Analytics, Speed Insights).
- Blocking these scripts in your browser does not affect any feature of the site.
Who processes data for us
These providers process data on our behalf, only for the purposes named here.
| Provider | What they do | Where |
|---|---|---|
| Vercel | Hosting, server functions, scheduled jobs, the cache, Web Analytics and Speed Insights. Vercel receives every request, including your IP address and browser headers, and keeps request logs for a limited time. | Server functions in Washington, D.C., USA (region iad1); pages are delivered from Vercel’s global network. |
| Neon | The database: subscriptions, the waitlist and, once they open, accounts, API keys and monitors. | AWS region us-east-1 (Northern Virginia, USA). |
| Resend | Sending our emails: confirmations, alerts, sign-in links and digests. | Region us-east-1 (USA). |
| GitHub | Signing in with GitHub, only if you choose it. | USA. |
| Slack | Monitoring alerts, only if you connect a Slack incoming webhook. | Where your Slack workspace is hosted. |
| SSLMate Cert Spotter | Certificate Transparency searches for the domains of monitors, when that check is switched on. | SSLMate’s servers. |
| Cloudflare | DNS over HTTPS for the domain names in a message you send to the Email Authentication Analyzer. | Cloudflare’s global network. |
Services that tools contact directly from your browser (public DNS resolvers, blockchain nodes, identity providers) and the public sources our server downloads from at your request (mempool.space, the FIDO Alliance metadata service, the hosts you ask us to check) are not our processors. They act under their own terms, and those reached from your browser see it as they see any visit.
Data outside your country
We are based in the United Arab Emirates, and the providers above process data in the United States and elsewhere. If you use the site from the European Union, the United Kingdom or another country with rules on data transfers, your data is therefore transferred to countries whose laws may protect it less than yours. The providers’ data-processing terms describe the safeguards they apply to such transfers; write to privacy@ecdsa.com for the references.
How long we keep data
| Data | Kept |
|---|---|
| Newsletter subscription | Until you unsubscribe. An unconfirmed sign-up 7 days after the last confirmation email. |
| Certificate alert subscription | Until you unsubscribe. An unconfirmed sign-up 7 days after the last confirmation email. |
| Waitlist request | Until you leave the waitlist or delete the linked account. An unconfirmed request 7 days after the last confirmation email. |
| Account profile and sign-in methods | Until you delete the account. |
| Sessions | 30 days after their last extension, then deleted. |
| Sign-in links | Until used, at most 15 minutes, then deleted. |
| API keys, revoked ones included | Until you delete the account. |
| API usage counters (no IP address) | Kept as statistics; once a key is deleted, its counters point to no one. |
| Monitors, notification settings, webhook endpoints and deliveries | Until you delete them or the account. |
| Monitor check history | 30 days. |
| Rate-limit counters | A minute to an hour, in server memory. Sign-in counters in the database until their window ends. |
| Reports about public hosts and downloaded public files | Cached without any link to you, and refreshed after an hour, after a day, or when the source publishes a new version. |
| Request and error logs | For the limited time Vercel keeps them. |
Deleted data can remain in the database provider’s point-in-time restore history until that history has rolled over.
Legal bases
Where the GDPR or a similar law applies, we rely on these legal bases:
- Providing what you ask for (Art. 6(1)(b) GDPR): the checks you start, your account, API keys and monitors, and the emails they send.
- Your consent (Art. 6(1)(a)): the newsletter, certificate alerts and the waitlist, which you confirm by email, and the email analysis, for which you tick the box.
- Our legitimate interests (Art. 6(1)(f)): protecting the site and other people’s servers with rate limits and logs, and the cookieless statistics that show which pages are useful.
Your rights
Depending on where you live, data-protection law gives you the rights below. This is how to use them:
- Access and portability. The account page downloads your account data as JSON. For subscriptions and the waitlist, ask us.
- Correction. Change your name and the language of our emails on the account page; for anything else, ask us. The address of an account cannot be changed: delete the account and sign in with the new address.
- Deletion. Delete the account on the account page. The link in every newsletter, alert and waitlist email deletes that subscription. For anything else, ask us.
- Objection and restriction. You can object to processing based on our legitimate interests, such as the statistics, and ask us to restrict processing while a question about it is open.
- Withdrawing consent. Unsubscribe or leave the waitlist at any time; this does not affect what was done before.
- Complaint. You can complain to the data-protection authority of the country where you live or work, or where you think the problem arose.
Write to privacy@ecdsa.com from the address the request is about, or tell us how we can confirm that it is yours. We answer within one month. If a request is complex, we may need up to two more months and will tell you why within the first month.
Children
ecdsa.com is a site for developers and security engineers and is not meant for children. Do not use its forms or create an account if you are under 16. If you think a child has given us their email address, write to privacy@ecdsa.com and we will delete it.
How data is protected
The site is served over HTTPS only. Secrets are stored in a form that is useless if copied: sign-in links as SHA-256 hashes, API keys as HMAC-SHA-256 hashes under a key kept outside the database, the session cookie with a signature, the Slack webhook URL encrypted. The account tables refuse to store GitHub tokens or passwords at all.
Changes to this policy
When we change this policy, we publish the new text here and update the date at the top. If a change affects data you have already given us, we say so on this page before it applies.
Contact
Email: privacy@ecdsa.com. Post: KeepFlow L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
Read it together with the Terms of Use.
This text is written in English. If a translation is offered, the English text prevails where the two differ.