RLS Radar

Privacy

Updated Plain-language summary of what the code does. Not legal advice.
Short version

No accounts, no cookies, no ads. Scan inputs and results are not stored. We keep anonymous counters, and your email only if you subscribe to the newsletter.

When you run a scan

  • We fetch the URL you enter and its same-origin scripts, plus a few small read-only requests (see the methodology). The results are sent back to your browser only. We do not store the URL, the findings, any keys found, or any data from the scanned site.
  • We keep anonymous counters in our metrics database (Upstash Redis): the number of scans per day and the worst severity of each scan. To count unique scanners we add a keyed hash (HMAC) of your IP address combined with the date to a HyperLogLog counter. To count how many different apps were checked, we add a keyed hash of the scanned hostname to another HyperLogLog. Raw IP addresses and raw URLs are never written to the database. Daily counters expire after 400 days.
  • To stop abuse, we count scan requests per network for 10 minutes and for 24 hours, using a keyed hash of your IP address as the counter name. These counters expire on their own.

Newsletter

  • If you subscribe, your email address is stored with our email provider, Resend, in our newsletter list. We send Resend only the email address: no name, IP address or other details.
  • Emails are not being sent yet. When they are, each one will include an unsubscribe link. You can unsubscribe or ask us to delete your address at any time by emailing rlsradar@mail.grokbot.com.
  • Signups are rate-limited per network with a short-lived keyed hash of your IP address (10 minutes).

Site analytics

We use Vercel Web Analytics. Vercel says it uses no cookies and identifies visitors with a hash of the request that resets every day, and that it records page views anonymously. We see aggregate numbers such as page views, referrers and countries.

Hosting

The site runs on Vercel. Like any web host, Vercel processes your IP address and request details to deliver the site and protect it from attacks, under its own privacy policy. Our code does not write request logs with your IP address or scanned URLs.

Admin page

The password-protected admin page shows only the aggregate counters above. Failed sign-in attempts are counted per keyed hash of the IP address for 15 minutes to block password guessing.

Cookies

RLS Radar sets no cookies and uses no local storage for tracking.

Contact

Questions or deletion requests: rlsradar@mail.grokbot.com. RLS Radar is run by August (@xxblv8 on X).