Policy
User-entered domains are processed only to run requested diagnostics. When temporary private report storage is enabled, the default retention is one hour, after which the report key expires automatically. Private reports are noindex and excluded from sitemaps.
- default temporary report retention: 1 hour unless the deployed configuration and this policy are updated together
- no public recent-scan feed
- no unnecessary permanent scan history
- minimal diagnostic failure logging without storing full scan histories
What is processed
When you run a tool, HostWithShery processes the domain, URL, public IP or technical text you deliberately submit and the public DNS/HTTP/TLS/mail responses needed to return the requested diagnostic. Do not submit passwords, private keys, authentication tokens or confidential message bodies. The email-header analyzer is intended for technical headers, not message content.
Temporary scan reports
When production temporary storage is enabled, a combined scan may receive a random, unguessable report identifier. The default retention is one hour and the stored key expires automatically. Scan URLs are marked noindex/noarchive, excluded from XML sitemaps and never exposed through a public recent-scans feed. If temporary storage is disabled, the API returns the result inline without creating a report URL.
Operational logs and abuse prevention
The application keeps only the operational data necessary to rate-limit abuse, diagnose scanner failures and protect public infrastructure. Failure logging is intentionally sanitized rather than storing complete scan histories. Production rate limiting can use a short-lived distributed counter so repeated scanning cannot bypass limits by switching server instances.
Advertising and third parties
Advertising support is disabled unless explicitly configured. If advertising is enabled, the deployment must use the required consent and privacy controls for the jurisdictions it serves, and this policy must be updated with the actual advertising/consent providers before ads are activated. Ads are not placed inside warnings, copy controls or between a diagnosis and its fix.
Deletion and privacy requests
Temporary reports expire automatically according to the configured retention policy. Requests relating to a still-live report, correction or privacy concern should include the report/page URL but never credentials. Production contact details must be verified before launch.