Privacy

InfraLens has no account, no billing, and no ad tracking. This page explains exactly what data moves where — in plain terms, matching what the source code actually does.

What gets sent when you run an analysis

The URL you type is sent to InfraLens's own server, which performs the checks itself — not your browser.

Checks (DNS lookups, HTTP requests, TLS handshakes) have to run server-side: your browser can't make most of these requests directly due to CORS, and running them client-side would expose your own IP address to every site you analyze. So the URL is sent to InfraLens's server via a single request, the server performs the checks against the target, and the report is returned to your browser. No account, cookie, or identifier is attached to that request beyond what's needed for rate limiting (below).

Rate limiting and your IP

Yes, your IP address is used — only to enforce a per-IP request limit.

Each analysis request is checked against a per-IP limit (5 requests per minute, 30 per hour) enforced by Upstash, an external Redis-compatible store — not an in-memory counter on the server itself. Each entry expires on its own (within the minute or hour window it belongs to); nothing is kept longer than that, and there is no analysis history tied to your IP.

Current limitation, stated plainly: the IP is used as-is as the rate-limit key, not yet hashed. A hashed/minimized key is planned (tracked as a later phase of this project) — this page will be updated when that lands.

Third-party services contacted

Two: a public IP-info lookup about the site you're analyzing, and the rate-limiting store described above.

The Hosting & IP check queries ipapi.cowith the resolved IP address of the site being analyzed, to report its hosting provider and network (ASN). That result is cached server-side for 15 minutes to avoid repeat lookups. Your own IP address is never sent to ipapi.co. DNS lookups performed during checks use your server's configured DNS resolvers, the same way any server-side request would.

Your IP address is sent to Upstash, as the rate-limit key described above — this is the only other third-party service, and the only one that ever receives anything about you rather than the site being analyzed.

What's stored locally

Your last 10 analyses, in your browser only — nothing on InfraLens's servers.

InfraLens keeps no server-side record of any analysis once the report is returned to your browser. Instead, up to 10 recent reports are cached in your browser's localStorage so you can revisit them — this never leaves your device and no other page or site can read it.

Delete a single entry from the "Recent analyses" list on the homepage, or use "Clear all" to remove all of it at once. Clearing your browser's site data for InfraLens does the same thing. Malformed or outdated local data is discarded automatically rather than shown broken.

What the analyzed site can see

Its own server logs, exactly as for any other visitor.

Running an analysis makes real DNS, HTTP, and TLS connections to the target from InfraLens's server. The site being analyzed will see these requests in its own logs — the request IP will be InfraLens's server, not yours, but the requests themselves (paths fetched, headers sent) are real and will appear like any other visit. Only run analyses on sites you're authorized to inspect.

No tracking, by design

No analytics scripts, no ad trackers, no cookies used for identification, no account system, no persistent server-side storage of your analyses. Server logs are limited to operational fields (event name, duration, error category) — never a full URL, raw headers, or your IP.