What we do with your data

Last updated: August 22, 2026

This is the privacy notice for rawhttp.com and rawphish.com, written in plain language on purpose.

We do not sell data, we run no advertising trackers, and we keep no record of the links you check.

1. When you check a link

The address you give us is used to run the check and sent back to you in the results. It is not saved to a database. There is no history, no saved report, and no way for us to look up later what you checked.

Two things are still worth knowing:

• Server logs. Like every web server, ours records the address your request came from, the time, your browser's user agent, and the path requested. When a check runs from a link or a bookmark instead of the box on the home page, the address being checked is part of that path, so it lands in those logs. Those logs stay on the server that handled the request, rotate automatically as new ones are written, and are destroyed when that server is replaced. We do not copy them anywhere else, and we do not read through them looking for links people checked.
• Rate limiting. Your network address is held in the server's memory to count requests. It is never written to disk, and it is dropped when the counting window ends, at most an hour later, or when the server restarts, whichever comes first.

The screenshot is taken on our own infrastructure and handed to your browser as image data. It is not stored.

2. What the website you check can see

Our servers make the request, not your browser. The site you are checking sees our server's address and a randomly chosen browser user agent. It does not see your address, your location, or anything about you.

It does see that the address was opened, and when. If the link is unique to you (a tracking link in an email, an invitation, a password reset), then checking it tells whoever sent it that the link was opened, and a one-time link can be spent or invalidated by our opening it. Do not check links of that kind.

3. Analytics

We count page views and where visitors arrived from, using Fathom, which we run ourselves on our own infrastructure. No analytics company receives those counts. It sets no cookies and does not follow you between websites.

4. Accounts

Sign-in is handled by Auth0. If you sign in, we receive the email address, name, and profile picture your sign-in provider gives us, and your settings, meaning theme and any custom pivot services you add, are stored with Auth0 next to that profile. Auth0 also keeps its own record of the sign-in itself: your address, the time, and identifiers for your account and the provider you used.

While you are signed in, that profile and those settings also sit in a signed cookie in your browser, so pages can render without fetching them again. Signing out clears it. To have an account and its settings deleted, email contact@rawhttp.com.

5. What your browser stores

If you are not signed in, your settings stay in your browser's local storage, on your device only, and are never sent to us. The only cookie we set is the session cookie above, and only for signed-in use.

6. Who else is involved

We do not sell, rent, or trade personal information. Two outside companies handle data, because the service cannot run without them:

• Amazon Web Services: hosting, and the sandbox that renders screenshots. Their privacy notice.
• Auth0 (Okta): sign-in and settings storage, for accounts only. Their privacy policy.

Analytics is not on that list, because we host it ourselves. We may also hand over information where the law requires it.

7. Where this happens

Everything runs in the United States. Our servers are in Amazon's Northern Virginia region, screenshots are rendered there too, and Auth0 holds account data in its United States region. If you use the service from anywhere else, your information is processed in the United States. For visitors in the UK and EU, those transfers rely on the standard contractual clauses in our agreements with Amazon and Okta.

8. Why we are allowed to do this

If you are in the UK or EU, the law asks us to say what we rely on:

• Running the check you asked for, and giving you an account if you want one. We have to process the request to give you what you asked for.
• Rate limiting, server logs, and keeping the service standing. Our legitimate interest in protecting the service from abuse.
• Counting page views. Our legitimate interest in knowing how much the site is used, measured with a tool that does not profile anyone.

9. What you can ask us to do

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live, you may also be able to ask us to limit how we use it, object to our using it, get it in a portable form, or withdraw consent where we relied on it. Email contact@rawhttp.com and we will handle it.

If you do not have an account, what we hold about you is generally limited to the short-lived technical and security logs described in section 1.

If you are in the UK or EU and think we have handled your information badly, you can also complain to your data protection authority.

10. Children

The service is not aimed at children under 13, and we do not knowingly collect their personal information.

11. Who we are

RawHTTP operates rawhttp.com and rawphish.com. Reach us at contact@rawhttp.com.

12. Changes

We may update this page. The date at the top changes when we do.