Privacy

curlscope has no accounts and does not ask for personal information. When you scan a URL, our server fetches it and sends you the result. Nothing is saved: the result lives only in your open page. For about 15 minutes the server remembers in memory which addresses the scan reached, only so the network trace can be limited to them. Authorization, Cookie and Proxy-Authorization header values are replaced in the result. Do not scan addresses that contain secrets.

Your IP address is used for rate limiting, kept in memory for about a minute, and never written to disk.

Analytics

If you accept, we use Google Analytics 4 to count visits. Google sets a first-party cookie (_ga and _ga_*, up to two years) and receives your IP address and browser details as part of any web request. Until you accept, nothing is sent to Google and no cookie is set.

We replace the page address and title with the page type (for example /scan/[target]) before sending, so the URL you scan is never shared with Google. Advertising features and Google signals are switched off. The legal basis is your consent, and you can change it at any time with “Analytics settings” in the footer. Declining or withdrawing deletes the cookies.