Privacy
What we keep, and what we don't.
We built this because a business we ran was impersonated, so collecting more about you than we need would be a strange way to go about it. This page says what happens to everything you touch here. Last updated 23 September 2026.
The short version
- We never see your email. Not the messages, not who they went to. The reports we read say which servers sent mail using your name and how many. That is all they hold.
- We don't store your IP address. It's held in memory for a day so one person can't run thousands of checks, and it's never written to our database.
- Nothing follows you off this site. No Google Analytics, no Facebook pixel, no session recorder, no advertising cookie, and nobody else watching you while you are here. We count visits ourselves, in rough numbers, so we know how many people came and roughly where from. We don't build a profile of you, and what we learn here stays here.
- We never sell or share anything. There's no list to be added to and no partner to sell to.
- The report reader never uploads anything. It opens your files inside your own browser and they don't leave your machine.
When you run a free check
We store the domain you typed, the time, and the public records we read about it. That's what lets us show you the result, send you back to it on a link, and tell you what changed if you check again.
The result link works for 7 days and then stops. It has no business name in it, so it can be forwarded to whoever manages your email without announcing anything.
Your IP address is used only to apply a rate limit. It's held in the running program's memory for at most 24 hours and is never written to the database. We don't keep a log of who checked what.
If you give us your email
You only type it in if you want the result sent to you, want us to answer a question, or want us to do the work. We use it for that and nothing else. We don't add you to a mailing list, and we won't write to you about something you didn't ask about. Ask and we delete it.
Our messages carry a small image that tells us the message was opened, which is how almost all email works and how we know our mail is arriving at all rather than landing in a spam folder somewhere. It is not reliable and we don't treat it as though it is: some mail programs load that image before anybody has looked at anything, and others block it entirely. We record whether it loaded, whether the message was delivered, and whether it bounced. We never learn what you did next, and we don't rewrite the links in our emails to watch where you go, because we spend the rest of this site telling people to check where a link really points. If you would rather not load it, turning off images in your mail program stops it, and nothing else about the message changes.
The free tools
The report reader runs entirely inside your browser. Your report files are opened on your own machine, they're never sent to us, and we never see what's in them. You can disconnect from the internet and it still works.
When you claim a plan
To prove a domain is yours there are two ways, and you pick. A code we email to an address at that domain: we store the address, the time it was confirmed, and a one-way hash of the code, which is erased the moment it is used. Or a DNS record: we store the domain, the token in that record, and the time it was confirmed, and you can delete the record as soon as the plan is built. Either way we record which method was used. The plan itself is a PDF held on our server behind a link only you have.
If you hire us
For the managed work you give us access to one thing, your DNS settings, and only after a written agreement that says exactly what we'll change. We ask for nothing else: no mailbox access, no passwords, nothing installed. If you take Watch, the daily reports come to a mailbox we hold, and we keep the summaries so the weekly note can say what changed.
Cookies
Today the public site sets no cookies at all, and if that ever changes this page will say so. It will never be an advertising cookie. One cookie exists on the staff side, to keep whoever is signed in signed in. If you visit this site and never sign in, nothing is stored on your device beyond the ordinary browser cache.
Where it all lives
On one server we rent in Nuremberg, Germany, from Hetzner. Everything in transit is encrypted. The database is copied every night, the copies are kept for 7 days and then deleted.
Who else touches it
- Hetzner hosts the server.
- Resend delivers any email we send you, so they handle your address to do it.
- Stripe handles payment if you buy something. Card details go to Stripe and never reach us.
- Nobody else. There's no data broker, no advertising network and no analytics company on this list, because we don't use any. If we ever advertise, that's us buying an advert. It is never anybody buying you.
How long we keep things
- Result links: 30 days, then they stop working.
- Checks and their results: kept, so a later check can tell you what changed. Ask and we delete yours.
- Messages you send us: kept while we're talking, and afterwards for our own records.
- Backups: 30 days.
What you can ask for
A copy of everything we hold about you, a correction, or deletion. Write to hello@copycatcheck.com and a person will do it, usually the same day. You don't need to give a reason and we won't ask you to justify it.
If you're in the UK or the EU those are your rights under the GDPR, and we honor them for everyone wherever you are. If you're in California, the same applies under the CCPA: we don't sell personal information and never have.
One standard, for everybody
We don’t sort people by where they live. The server is in Germany, and we apply the GDPR to everyone who uses this, whether you are in Berlin or Austin or anywhere else. The strongest rule is the easiest one to keep and the fairest one to be held to. If the law where you live gives you more than that, you get that too. We built this to help people protect their businesses, and being careless with your information would make nonsense of the whole thing.
If you are a business in the UK or the EU, you are the controller of your own mail data and we are processing it for you. Ask and we’ll sign a data processing agreement. Our processors are the three named above, and we’ll tell you before that list ever changes.
Children
This is a tool for businesses. It isn't for anyone under 16, and we don't knowingly hold anything about anyone under 16.
If this page changes
We'll change the date at the top and say what changed. If a change means we would hold something new about you, we'll ask first.
Who we are
CopycatCheck is a product of ATXworks.dev, operated by C. Achberger, Austin, Texas. Post reaches us at 13341 W. US Hwy 290, Building 2, Austin, TX 78737. Email reaches us faster: hello@copycatcheck.com.