Privacy Policy

Last updated 2026-11-13

This policy explains what personal data ARACHNE (the "Service") keeps, why, and your rights. We aim to keep as little as possible.

Who is responsible

The data controller is Luke Mckeever, an individual, based in Ireland. Contact for anything about your data: info@arachne-app.site.

What we store on our server

When you request an account and use the Service, we store in our database (Cloudflare D1):

• Account details: your email address, your name and your reason for requesting access (if you give them), and your password as a salted, one-way hash (we can't see your password).
• Account status: when you signed up, when your request was decided, whether you're approved, the version of the Terms you accepted and when, and any private note or custom limit an administrator added.
• Sign-in and session data: the time and IP address of your last sign-in, and for each signed-in session its start time, last activity, expiry, IP address and browser name (user agent). Session tokens are stored only as hashes.
• Usage counts: how many lookups you've made today and in total, used for fair-use limits. We don't store what you searched for or the results.
• Activity log: security events such as sign-ins, failed sign-ins, sign-ups, password changes and administrator actions, with time and IP address.
• Password reset requests: if you use "Forgot your password?", the time and IP address of the request, and, once an administrator creates one, a one-time reset link that expires after 24 hours.
• Rate-limit counters: short-lived counters keyed by IP address or email, to stop password guessing and abuse.

What stays in your browser

Your settings, your API keys, your scan history, saved scans and results are stored only in your own browser (local storage and IndexedDB). We can't see them. You can clear them from the Account page or your browser settings.

Lookups and third-party data sources

When you run a lookup, your browser sends the indicator (for example an IP address, domain, URL, email address, username or file hash), your choice of sources and, where needed, your API key for that source, to our server, which forwards the request to the data source. The sources see the indicator and the API key, and see the request coming from Cloudflare's network, not from your IP address. We don't keep the indicator, the key or the result. Each source handles the data under its own privacy policy. The sources currently switched on are:

• abuse.ch (URLhaus, MalwareBazaar, ThreatFox), operated with Spamhaus (https://abuse.ch/)
• AbuseIPDB (https://www.abuseipdb.com/)
• AlienVault OTX (LevelBlue) (https://otx.alienvault.com/)
• CIRCL hashlookup (https://hashlookup.circl.lu/)
• crt.sh certificate search (Sectigo) (https://crt.sh/)
• EmailRep (Sublime Security) (https://emailrep.io/)
• GitHub (https://github.com/)
• Google Public DNS or Cloudflare DNS (the DNS resolver chosen in Settings) (https://developers.google.com/speed/public-dns)
• Google Safe Browsing (https://safebrowsing.google.com/)
• Gravatar (Automattic) (https://gravatar.com/)
• GreyNoise (https://www.greynoise.io/)
• Hacker News (Y Combinator) (https://news.ycombinator.com/)
• Have I Been Pwned (https://haveibeenpwned.com/)
• Hunter.io (https://hunter.io/)
• Hybrid Analysis (CrowdStrike) (https://www.hybrid-analysis.com/)
• Internet Archive (Wayback Machine) (https://web.archive.org/)
• ip-api.com (https://ip-api.com/)
• IPinfo (https://ipinfo.io/)
• IPQualityScore (https://www.ipqualityscore.com/)
• Keybase (https://keybase.io/)
• LeakCheck (https://leakcheck.io/)
• mnemonic Passive DNS (https://www.mnemonic.io/)
• NIST National Vulnerability Database and the CISA Known Exploited Vulnerabilities catalogue (https://nvd.nist.gov/)
• OpenPhish (https://openphish.com/)
• Pulsedive (https://pulsedive.com/)
• RDAP registration data (rdap.org and the domain and IP registries) (https://rdap.org/)
• Reddit (https://www.reddit.com/)
• RIPE NCC RIPEstat (https://stat.ripe.net/)
• SANS Internet Storm Center (DShield) (https://isc.sans.edu/)
• SecurityTrails (Recorded Future) (https://securitytrails.com/)
• Shodan (https://www.shodan.io/)
• Shodan InternetDB (https://internetdb.shodan.io/)
• the public websites checked by Username Enumeration
• the target web server itself (HTTP Probe, an active module)
• The Tor Project (https://www.torproject.org/)
• urlscan.io (https://urlscan.io/)
• VirusTotal (Google) (https://www.virustotal.com/)

Active modules (such as HTTP Probe) contact the target directly, and the target can see that request.

Why we use your data (legal bases under the GDPR)

• To create and run your account, decide access requests and provide the Service: performance of our agreement with you (Article 6(1)(b)).
• To keep the Service secure, prevent abuse and enforce fair-use limits and our Terms (activity log, IP addresses, rate limits): our legitimate interests in protecting the Service, its users and the data sources (Article 6(1)(f)).
• To comply with legal obligations or respond to lawful requests: legal obligation (Article 6(1)(c)).

We don't use your data for advertising or marketing, we don't sell it, and we don't use tracking or analytics cookies. Access requests are decided by a person, not automatically.

Who else processes it

• Cloudflare, Inc. hosts the Service and its database and acts as our processor. Cloudflare also keeps short-lived technical logs (such as request time, path, IP address and errors) for a few days to run and secure its network. Cloudflare may process data outside the European Economic Area; it is certified under the EU-US Data Privacy Framework and uses the European Commission's Standard Contractual Clauses. See https://www.cloudflare.com/privacypolicy/.
• Data sources, as described above, receive only the indicators you look up.
• Authorities, if we're legally required to share data.

How long we keep it

• Approved accounts are kept until you or an administrator delete them.
• Pending access requests are deleted if still undecided after 90 days.
• Rejected and removed accounts are deleted 30 days after the decision.
• The activity log keeps entries for 180 days.
• Sessions are removed when they expire or when you sign out; rate-limit counters after a day; password reset requests after 30 days (reset links stop working after 24 hours).

When an account is deleted we remove it and its sessions, and replace the email address in the activity log with an anonymous ID.

Your rights

Under the GDPR you have the right to access your data, have it corrected, have it deleted, restrict or object to its processing, and receive it in a portable format. On your Account page you can download all data we hold about you and delete your account yourself at any time. For anything else email info@arachne-app.site; we'll reply within one month.

You also have the right to complain to a data protection authority. In Ireland this is the Data Protection Commission (https://www.dataprotection.ie/); you can also complain to the authority where you live or work.

Security

Passwords are hashed with PBKDF2, sign-in cookies are secure and HttpOnly, sign-in attempts are rate-limited, the admin area needs two-factor authentication, and all traffic is encrypted (HTTPS). No system is perfectly secure; if we become aware of a breach affecting your data we'll act as the law requires.

Children

The Service is not for anyone under 18, and we don't knowingly collect their data.

Changes

We'll post any changes here and update the date at the top. If a change is significant we'll tell you when you next sign in.