Privacy policy
This site collects as little as possible. Most tools run entirely in your browser. This page explains the few cases where data leaves your device, where it goes and how long it's kept.
Last updated: 27 October 2026
Who runs this site
This is the personal website of Sana Ullah Khan. For any privacy question or request, email sanaullahkhan.hse@gmail.com.
Website health and security checker
When you scan a website, the address you enter is sent to the checker's server, which runs on Cloudflare Workers. To run the checks, the server visits that address and passes it (or just its domain name) to Google PageSpeed Insights, Mozilla HTTP Observatory and Qualys SSL Labs, which have their own privacy policies.
The report, including the scanned address, is stored so you can share it and is deleted automatically after 7 days. Results for the same address may be reused for a few hours so the free API limits aren't exceeded.
To stop abuse, the page uses Cloudflare Turnstile to check that you're human, and limits how many scans one visitor can run. For the limit, the server stores a one-way hash of your IP address (never the address itself) with a counter that's deleted after a day at most. No account, name or email is needed.
The checks are passive and read only what's publicly visible. Only scan websites you own or have permission to test.
The other tools
The other tools on /tools/ run entirely in your browser: what you type or the files you choose are not uploaded. The one exception is the leaked password checker, which sends only the first 5 characters of your password's SHA-1 hash to Have I Been Pwned, never the password.
Contact form
Messages you send with the contact form are delivered to my inbox by Web3Forms. I use them only to reply and delete them when they're no longer needed.
Hosting, fonts and storage
The site is hosted on GitHub Pages, and fonts are loaded from Google Fonts. Like any web server, they receive your IP address and browser details when you load a page. The site has no analytics, ads or tracking cookies. Your light or dark theme choice is saved in your browser's local storage and never sent anywhere.
Your choices
You can ask me to delete a shared report before it expires, or ask any question about your data, by emailing sanaullahkhan.hse@gmail.com.