Privacy

Last updated 2 November 2026

OriginError is an independent project run by Bijo Dev. There are no accounts, no advertising and no cookies. This page says what each tool sends, what it keeps and for how long. For questions, or to ask about data related to you, use the contact form.

Domain scan

• The hostname you enter is used to run the scan. Neither it nor the result is saved.
• Your IP address (or its network, for IPv6) is held in a rate-limit counter that expires automatically after 10 minutes.
• The certificate checker counts requests under a keyed hash of your IP, and deletes the count within about an hour.
• A running total of scans is kept: one number, with no hostname or IP attached.

Error lookup and writing

These pages are served as content. The tool itself doesn't save what you look up.

WAF rule lookup

Searching, parsing an uploaded security event and decrypting its payload all happen in your browser. Your file and private key are not sent to OriginError or anyone else. "Copy for Claude" only copies text to your clipboard, with values that look like credentials or personal data masked first.

Fingerprint checker

• Nothing is sent until you press the button. The page lists exactly which browser signals are sent.
• The fingerprint record is deleted after 90 days. It holds a SHA-256 hash of your signals, the rarity and consistency scores, your country and the Cloudflare data centre.
• Your IP address (or its network, for IPv6) is held in a rate-limit counter, separate from that record, that expires automatically after 10 minutes.

Migration readiness

• Your checklist is saved in your browser's local storage, on your device.
• If you create a share link, the vendor, deployment mode and ticked items are stored on our servers. A share link expires 90 days after it was last saved.
• Saving a link uses the same 10-minute rate-limit counter.

Contact form

Your name, email address and message are sent to me by email through Resend, and I keep them in my mailbox for as long as I need them to deal with your message. The form uses the same 10-minute rate-limit counter.

Outside services

• Cloudflare hosts the site and API, so it handles your IP address and request details on every visit. Its public DNS resolver also looks up the domains you scan.
• Netlify runs the certificate and nameserver checks. It receives the hostname and your IP address (or its network, for IPv6), which it uses only to count requests under a keyed hash.
• ARIN receives a scanned site's IP address, never your own, to name the network operator.
• Resend delivers contact form messages.
• The site you scan and its nameservers receive requests from our servers, not from your browser.

Each of these services handles data under its own privacy policy. No analytics or advertising trackers run on this site. Fonts and scripts are served from this site itself.

Changes

If this changes, this page and its date change with it.