Privacy Policy
Last updated: 19 September 2026 — Plain language, no legal jargon.
Data Controller (Art. 13 GDPR)
The data controller for this service is the Cyberscan Project. For any privacy-related request — including access, rectification, erasure, or objection — contact us at: privacy@cyberscan.app.
Password Checker & Generator
All analysis and generation runs entirely in your browser using JavaScript. Your passwords are never transmitted to any server. You can disconnect from the internet and both tools work identically. Legal basis: the processing does not occur — no personal data is transferred.
Hash Generator & QR Reader
All hashes are computed in your browser without uploads; the Hash Generator does not send your text, files or hashes to a server. Camera QR decoding also runs in your browser, without uploading the camera feed. When you upload a QR image, the image is sent to the Cyberscan Worker, which forwards it to the decoding provider, api.qrserver.com. In either QR mode, an extracted web URL is then sent through the Worker to VirusTotal for the reputation check described below. QR content that is not a web URL does not receive a reputation check.
Email Breach Check
The request is sent directly from your browser to the public XposedOrNot API. XposedOrNot receives the email address you enter and your connection IP. Cyberscan servers do not receive or log this request. The email and result may be held temporarily in the current page's memory to avoid duplicate lookups; the app does not persist them outside the page session. Legal basis: legitimate interest in providing the requested service (Art. 6(1)(f) GDPR).
IP Lookup
The request is sent directly from your browser to IPWhois and, if the primary service is unavailable, to IPAPI. These providers receive your connection IP and, when you look up another address, the IP entered in the form. Cyberscan servers do not receive or log these requests. The displayed result remains in page memory while the page is open. Legal basis: legitimate interest in providing the requested service (Art. 6(1)(f) GDPR).
URL Scanner
The URL you submit is forwarded to the VirusTotal API (Google LLC) for threat analysis. Cyberscan proxies the request without logging the URL or linking it to your identity. Legal basis: legitimate interest in providing the requested service (Art. 6(1)(f) GDPR).
Phishing Explainer
Core analysis of pasted messages or links runs in your browser. When you start an optional indicator check, the domain, registrable domain and SHA-256 hash of the canonical URL are sent to the Cyberscan Worker, which queries remote sources. Full URLs are sent only if you select the separate consent option to check redirect chains; these URLs may contain paths, parameters or personal data.
What we do not collect
- No cookies of any kind (see our Cookie Policy)
- No analytics scripts or user tracking
- No IP address logging by Cyberscan
- No user accounts or registration data
- No advertising or third-party marketing scripts
- No profiling or automated decision-making
Infrastructure & Hosting
Cyberscan is served via Cloudflare Pages (Cloudflare, Inc., a US-based company). Cloudflare may retain standard server logs (IP addresses, request timestamps) as part of normal CDN operations. This processing is governed by Cloudflare's own privacy policy. Data transfer outside the EU/EEA is covered by Standard Contractual Clauses.
Your Rights (GDPR Art. 15–22)
As a data subject in the EU/EEA you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data. Cyberscan does not retain Email Breach or IP Lookup requests on its servers; requests sent directly to third-party providers are governed by their privacy policies. Contact us at privacy@cyberscan.app for Cyberscan-related requests. You may also contact the relevant provider or lodge a complaint with your national supervisory authority (in Italy: Garante per la protezione dei dati personali).
Changes to this Policy
We will update this page whenever the data processing practices change — for example, when analytics or monetisation features are introduced. The "Last updated" date at the top will reflect any revision.