Privacy

Short version: we store as little as we can, we do not sell anything, and we delete your data if you ask.

The scanner

• The domains you paste are sent to crt.sh (a public Certificate Transparency search run by Sectigo) to find certs. If crt.sh does not answer, we ask Cert Spotter (run by SSLMate) instead. Their own privacy terms apply to those requests.
• For up to 50 hostnames we find, our server opens one normal HTTPS connection on port 443 to read the cert it serves. We only connect to public IP addresses. We do not scan ports or try to log in.
• We keep the scan result (domains, hostnames, cert dates) for 7 days, so you can open the full report. Then it is deleted.
• We cache these answers per domain for 6 hours, to be kind to these free services. Then they are deleted.

When you give us your email

• We store your email, the domains you scanned, a short summary of the result (counts), whether you asked for expiry alerts, and the time.
• We use it to contact you about Certrota and, if you ticked the box, to send expiry alerts once we have built them. No newsletter unless you ask for it.
• The founder list form stores only your email and the time.
• We send email through Resend. When you leave your email, the founder gets a short note about it.
• Every email we send has an unsubscribe link. Once you use it, we do not email you again.

What we do not do

• No cookies, no ad trackers, no third-party analytics. Fonts are served from our own server.
• We count page views ourselves: per day, which page, and which site sent you (only the site name, like reddit.com). That is all. It can not be tied to you.
• We do not store your IP address. We hold it in memory for a few minutes to limit how many scans one network can run.
• We do not sell or share your data.

Where and who

Servers in the EU. Certrota is a Norwegian company. You have the rights in GDPR: to see, fix, or delete your data. Email hello@certrota.com and we will do it within 30 days, usually much faster.