Privacy Policy
Last updated: June 2026
A note from the developer
I'm a solo developer and I built LunarTrust with one goal: give anyone a fast, honest way to check whether a URL is safe, without handing over their data in the process. This page explains exactly what happens when you scan a URL, including the parts I'm not fully in control of. I'd rather be transparent about the limits than pretend this tool is more private than it actually is.
What I do not collect
- No user accounts or registration
- No cookies or tracking
- No analytics or advertising
- No persistent storage of scanned URLs
- No IP address logging
How a scan works — step by step
When you submit a URL, it is sent from your browser to a serverless function running on Cloudflare's infrastructure. The URL is held in memory only for the duration of the scan and is never written to a database or disk. Below is exactly what happens for each of the five checks, and what data (if any) leaves that function.
URL Analysis (heuristics)
100% local — no data sent anywhere
This check runs entirely inside the Cloudflare Worker. It analyses the URL structure using pattern-matching logic, looking for phishing patterns, suspicious domain names, dangerous file extensions, brand impersonation, and more. No external service is contacted. Your URL does not leave the function for this check.
Google Safe Browsing API
Full URL is sent to Google
The full URL you scanned is submitted to Google's Safe Browsing API, which checks it against Google's threat database of known malware and phishing sites. This means Google receives the URL. I have no control over what Google does with it on their end, their Privacy Policy applies. I included this check because it is one of the most effective publicly available threat databases. But you should know the trade-off: if you are scanning a URL that you consider sensitive, Google will see it. The other four checks, including the fully local heuristics analysis, still run regardless.
Wayback Machine (archive.org)
Domain name only — no path or query string
The Internet Archive is queried to check whether the domain has a
recorded history. I send only the bare hostname (e.g. example.com), not the full URL with its path or query parameters.
Domain Age (RDAP)
Domain name only — public registry data
RDAP (the modern successor to WHOIS) is queried to find out when the domain was registered. This is publicly available data held by domain registries. Only the domain name is sent.
SSL Certificate
Cloudflare's server sends a request to the target host
An HTTPS request is made to the scanned domain to verify that a valid SSL connection can be established. The target server will see a connection from Cloudflare's IP address, not yours. No credentials or private data are exchanged in this step.
Hosting
LunarTrust runs on Cloudflare Pages. The scan logic executes as a Cloudflare Worker, not on a server I own or operate. As with any cloud provider, Cloudflare's infrastructure handles incoming requests and may retain technical metadata (IP address, request headers) as part of normal operation. I do not have access to those logs.
Your rights (GDPR / DSGVO)
Because I collect no personal data, there is nothing to access, correct, or delete on my side. For data processed by third-party services (Google, Internet Archive, Cloudflare), please refer to their respective privacy policies linked above. If you have questions about this page, feel free to reach out:
Changes
This policy may be updated as the project evolves. Changes are reflected by the date at the top of this page. I will not quietly weaken the privacy guarantees described here. Any reduction will be clearly noted.