Privacy

What we keep.

We built this because a business we ran was impersonated, so collecting more about you than we need would be a strange way to go about it. This page says what happens to everything you touch here. Last updated 16 October 2026: a written plan is also kept as a web page, beside its two PDFs; and help by hand, for when you can't prove a domain yourself yet. On 14 October: a free check's result is deleted by hand when anyone holding its link asks, and we may write once to the business to say so; a written plan's link works for 14 days, then the plan is on your dashboard; a free dashboard goes only to an address at the domain; from that day, reports by mail about domains we don't serve are counted, not stored; and the small puzzle before the contact form or a proof code sends. On 13 October: notices about look-alikes that you ask us to file for you, and a plainer line on what our visitor line keeps: no one's address in the count, the security records that do keep one, and how robots are named; and what your browser keeps while you're getting a written plan. On 12 October, the free dashboard: it opens only once the domain is proved, the same proof as the written plan, and it shows your plan; the button in a link; This Wasn't Me; the 30 days a dashboard nobody opened is kept; and the Watch's morning email about mail sent in your name. On 11 October: the record of work we make for members, the log of each time a plan or record link is opened, and the Google mailbox the daily reports arrive in.

The short version

• We never see your email. Not the messages, not the addresses they went to. The reports we read say which servers sent mail using your name and how many. Some also name the domain a message was delivered to, which we don't copy into our records.
• Your check isn't tied to your IP address. The address is held in memory for a day so one person can't run thousands of checks, and it isn't saved with your check. Addresses are kept only where this page says: our web server's 30-day request records, our security log, a dashboard's sign-in history, and the log of each time a plan or record link is opened.
• Nothing follows you off this site. No Google Analytics, no Facebook pixel, no session recorder, no advertising cookie, and nobody else watching you while you are here. We count visits ourselves, with ClickCrooks, our own counter, on our own server, so we know how many people came and roughly where from. We don't build a profile of you, and what we learn here stays here.
• We never sell or share anything. There's no list to be added to and no partner to sell to.
• The report reader never uploads anything. It opens your files inside your own browser and they don't leave your machine.

When you run a free check

We store the domain you typed, the time, and the public records we read about it. That's what lets us show you the result, send you back to it on a link, and tell you what changed if you check again.

The result link works for 7 days and then stops. It has no business name in it, so it can be forwarded to whoever manages your email without announcing anything.

Anyone holding the link can ask us to delete the result. We delete it by hand, usually within two working days: the link stops working, for us too, and the check itself is erased. One exception: if the domain was proved from that check, or a plan, a report, a public page or a watch was built from it, the check stays with that, because anyone can check any domain and ask; the link still ends. After deleting we may write once to an address the business publishes on its own website, to say it was done.

For a check, your IP address is used only to apply a rate limit. It's held in the running program's memory for at most 24 hours and isn't saved with the check. We don't keep a log of who checked what.

If you give us your email

You only type it in if you want the result sent to you, want us to answer a question, or want us to do the work. We use it for that and nothing else. We don't add you to a mailing list, and we won't write to you about something you didn't ask about. Ask and we delete it.

Our messages carry a small image that tells us the message was opened, which is how almost all email works and how we know our mail is arriving at all rather than landing in a spam folder somewhere. It is not reliable and we don't treat it as though it is: some mail programs load that image before anybody has looked at anything, and others block it entirely. We record whether it loaded, whether the message was delivered, and whether it bounced. We never learn what you did next, and we don't rewrite the links in our emails to watch where you go, because we spend the rest of this site telling people to check where a link really points. If you would rather not load it, turning off images in your mail program stops it, and nothing else about the message changes.

The free tools

The report reader runs entirely inside your browser. Your report files are opened on your own machine, they're never sent to us, and we never see what's in them. You can disconnect from the internet and it still works.

When you claim a plan

To prove a domain is yours there are two ways, and you pick. A code we email to an address at that domain: we store the address, the time it was confirmed, and a one-way hash of the code, which is erased the moment it is used. The email with the code says which city and network asked for it (the network is the first three parts of the internet address), so whoever reads it can tell if it wasn't them. Or a DNS record: we store the domain, the token in that record, and the time it was confirmed, and you can delete the record as soon as the plan is built. Either way we record which method was used. So that nobody can guess a code, we also count, for each domain and day, how many codes were sent and how many wrong ones were typed from each network: the first three parts of an internet address (the first three groups for a long IPv6 one), never the whole address, deleted after a week. The plan itself is kept on our server as a web page and two PDFs (an earlier plan may have only its PDF), behind a link only you have, which works for 14 days; after that it's on your free dashboard, behind your sign-in. The same proof opens your free dashboard, so we keep which proof each dashboard came from. A person here can also set up your plan and dashboard by hand, when you ask through the contact form (for instance with no address at the domain, or no way to add a DNS record yet) or when we're in touch: they check with you first, and their approval is the proof. We keep that request (your email and web address), whether it was approved or turned down and when, and a short note of how we checked, and delete them a year after the request was made. If you press Not Sure, Ask Us on an alarm, the same list holds that question: your email, the web address, and the alarm's own words as your dashboard showed them, nothing you typed; a person writes back to you by email. Approving or turning one down is also a line in our security log, kept a year like every line there.

Each time the link is opened we log when, the internet address it came from, and the browser's description of itself, so if a link ever reaches somebody it wasn't meant for, we can see whether it was opened and from where. We take a link back when there's reason to think that happened, or when you ask, and a link taken back stops opening at once.

If you send words for your public page, we keep them, and the address at your domain you give us for the answer, until a person here has read them. Our desk is also sent a note with the words, that address (its first letter and its domain only) and the internet address they came from, which is kept with the desk's other notes for 400 days. Then we email that address: the page is live, or why it isn't (we keep that reason). Until they're approved, nobody but our desk sees them. If someone else who proved the same domain sends different words, we write to the earlier address, and to the live page's address if there is one.

If you hire us

For the managed work you give us access to one thing, your DNS settings, and only after a written agreement that says exactly what we'll change. We ask for nothing else: no mailbox access, no passwords, nothing installed. If you take Watch, the daily reports come to a mailbox we hold, and we keep the summaries so the weekly note can say what changed. From 14 October, a report that arrives by mail about a domain that isn't on a dashboard, a member's or ours (or a name under one of those) isn't read into our records: anyone can point their reports at our address, so we count them, and our desk sees the domain's name only when the report came from a mail provider we can vouch for. The email it came in stays in that mailbox with the rest. Some providers' reports name the domain each message was delivered to, never the address. We don't copy that into our records, but the original report emails stay in that mailbox, because they're the proof each report is real. We also keep the alerts our nightly check raises about look-alikes of your name, and a copy of each email we send you about them or about mail sent in your name. To name the server behind a message, we look up its internet address in public records (who holds it, and in which country) and keep the answer beside the reports, looking it up again after 30 days.

If you ask for a record of work, we make a PDF of what our checks and the providers' reports showed for your domains over a period, and keep it with a frozen copy of the data it was made from: your business name, your domains, their settings where the period started and ended and each change our checks saw, the look-alikes we watched, monthly counts from the daily reports, and what we sent you. We also keep a fingerprint of that data and of the PDF itself. The PDF comes to you on a link like a plan's, logged the same way each time it's opened. We keep the record so a copy can be checked against ours, until you ask us to delete it. Its reference and the two fingerprints also go into our sealed daily evidence. That entry holds no names, domains or addresses, and it's kept for good so the day the record was made can be shown.

If you have a dashboard

Your dashboard shows counts, cities and kinds of visitor. It never shows anyone's internet address. To keep it yours, it has a sign-in, and the sign-in uses a passkey instead of a password. For it we keep:

• your email address, and which sites your sign-in opens;
• for each passkey: its public half (the private half never leaves your phone, computer or security key, and we never see it), a short name we give it from what your browser says about itself, such as "iPhone, Safari", that description itself, when it was made and when it was last used;
• every sign-in: when, how (a passkey, a sign-in link, or a report link), your browser's description of itself, and the internet address it came from. You can see your own history on your account page, shown by city;
• the one-time links we email you to set up or add a passkey. We keep only a one-way hash of each, so the stored copy cannot open anything. An invitation works for 24 hours and a sign-in link for one hour, once, and nothing is used until you press the button on the page it opens;
• for each domain on your dashboard, when you pressed the button in the link we sent for it. That's how we know the mailbox was yours for that domain, and not only for some other one.

A free dashboard is only for somebody who has shown the domain is theirs, the same way the written plan asks: a code we email to an address at the domain, typed back on our page, or a DNS record; or, when you can do neither yet, a person here approving it by hand after checking with you. For it we also keep which proof it came from, so your dashboard can show your plan. If you proved it with the DNS record, you tell us where your dashboard should go, and we send that address one link; the email says somebody asked, and carries a This Wasn't Me link. Press it and we delete what was asked for in your name, and send that address no more sign-up emails (sign-in links, and anything you ask for yourself, still arrive). To keep that promise we keep the address on our do-not-send list, and take it off if you ask. A dashboard whose link is never pressed is deleted after 30 days, with the address, unless we hold something else for it.

If you ask us to file a notice about a look-alike of your name, we keep the notices as you saw them and as we sent them, the sentence you agreed to, the address that asked and when, which of the domain's other dashboard holders we told, where we sent them, and what the company answered. Your dashboard shows where each one stands. A notice goes out from our address and names your business and your domain, never your email address.

We email you every time a passkey is added or removed, and every time something on your dashboard is marked as expected, so a change you did not make is seen. Before we send a sign-in link, a proof code or a message from the contact form, your browser solves a small puzzle that slows down anyone trying to send thousands; it runs on your device and nothing about it goes anywhere but this site.

If you put our line on your site

A dashboard can show who visits your site only if your site tells us, with one line of ours in its pages (the same line clickcrooks.com uses). It sets no cookie and reads nothing anyone types. On each visit it records the page, where the visitor came from, and how long they stayed; the visitor's internet address becomes a city, a region, a point on the map rounded to about a kilometre, and the name of their network, at our door. The count never keeps the address, and it's never sent to anyone; the line's own requests are in clickcrooks.com's security records, kept the same way as ours below: 30 days, or a year in a browser's report that it couldn't reach us. Robots that run the line are named by their network or by what they call themselves, never by address. A random visit number lives in the browser tab's session storage so the pages of one visit hang together, and the browser throws it away when the tab closes. Your dashboard shows counts, cities and kinds of visitor, kept for 30 days.

If you ask to see your report

"See my report" is the front door on this site and on clickcrooks.com. You type an email address, and if that address has anything with us, we send one link that opens it to look at. You need no account to ask. For it we keep:

• the link itself, as a one-way hash only, so the stored copy cannot open anything. It works once, for one hour. Asking again stops any older link of yours working. The row is deleted after seven days;
• a record for your email address, made when you open the link, not when you ask. It holds your address, how you would like to hear from us, and the public half of any passkey you make. Until you open a link there is nothing;
• that sign-in, in the same history as any other: when, that it was a report link, your browser's description of itself, and the internet address it came from. You see your own by city.

The answer on screen is the same whether or not that address has anything with us, so the page never says who we hold a report for. The link lets you look and nothing else. If your address already has a dashboard, opening a report link emails you to say so, and tells our desk, because a link like that only needs somebody to be able to read your email.

If you then make a passkey at the door, we record that it was made there. It signs you in and looks after your own sign-in; it can never mark an alarm, turn your alerts down, or sign your other devices out, for the same reason.

Cookies

The public site sets no cookies at all for anyone who doesn't sign in, and if that ever changes this page will say so. It will never be an advertising cookie. If you sign in, one cookie keeps you signed in, for up to 12 hours (one hour after signing in by an emailed sign-in link or a report link), and a second lasts two minutes while a sign-in is happening; both are only ever sent back to this site. One cookie exists on the staff side, to keep whoever is signed in signed in. If you visit this site and never sign in, your device keeps two things: a random visit number, kept in the tab itself so one visit counts as one, which your browser throws away when the tab closes; and, while you're getting a written plan, the domain, the address you typed and the plan's reference, so a closed tab doesn't lose your place. Those are cleared once the plan is built, or after an hour. If your browser sends the Global Privacy Control signal, you are not counted at all.

Our security log

Separately, our web server keeps a record of each request to this site (the address it came from, the page, the time and what the browser said about itself) for 30 days, for security. The domain you check and the codes in private links are cut out of it before it is written, so it never records who checked what. Cookies and passwords are never written to it.

We also keep a security log. It records what attacks or probes the site, with the internet address it came from, and what changes about the names we watch:

• a form sent with a field no person can see filled in, too fast for a person, from outside our own page, or without its small puzzle solved, and anything that writes to an address that exists only to catch scrapers;
• reports from visitors' browsers when our security rules blocked something on one of our pages, or when one of our pages was shown from an address that isn't ours;
• sign-ins to a dashboard that were refused, and every change to who can sign in or to what an alarm says (a passkey added or removed, a mark made or taken back);
• reports from browsers (Chrome and Edge) that couldn't reach the real site, because they were shown a certificate that isn't ours or sent to a server that isn't ours. Such a report says which page, what went wrong, which server the browser reached and the address it came from.
• the public records of the domain names we keep watch on (our own, our members', and any we have reason to watch closely, such as one imitating ours): their DNS, the certificates issued for them, and the registry's and the registrar's records, which can name whoever holds a name or the privacy service standing in for them. If somebody signs up a dashboard for a name we watch closely, the log notes the account's number, never its email address.

The log is locked down: only we can read it (a member's dashboard shows what changed about their own names, and nothing else), it is kept for one year and then deleted. We use it to find and stop anyone who attacks this site, gets between you and it, or imitates a name we watch. We don't sell it or share it, except the address of an attacker when we report them to the company hosting them, or what the law requires us to hand over.

Where it all lives

On two servers we rent in Germany from Hetzner. Everything in transit is encrypted. The database is copied every night, and the copy is also sent to the second server so it does not live only on the machine it came from. Copies are kept for 30 days and then deleted.

Who else touches it

• Hetzner hosts the server.
• Resend delivers any email we send you, so they handle your address to do it.
• Google hosts our mailbox. Messages you send us arrive there, and so do the daily reports for the domains we watch.
• Registrars and hosting companies receive a notice about a look-alike only when you ask us to file it, and only the notice you saw.
• Stripe handles payment if you buy something. Card details go to Stripe and never reach us.
• Nobody else. There's no data broker, no advertising network and no analytics company on this list, because we don't use any. If we ever advertise, that's us buying an advert. It is never anybody buying you.

How long we keep things

• Result links: 7 days, then they stop working.
• Checks and their results: kept, so a later check can tell you what changed. Ask and we delete yours.
• Written plans and records of work, with the log of each time their link was opened: kept, so a copy can be checked and a link that went astray can be traced. Ask and we delete yours.
• The fingerprints of a record of work, in our sealed daily evidence: kept for good. They hold no names, domains or addresses.
• Messages you send us: kept while we're talking, and afterwards for our own records.
• Notices you asked us to file, with what you agreed to and what came back: kept, so either of us can show what was sent in your business's name, and why. Ask and we delete yours once none is still open.
• Your sign-in (your email, any sites it opens, your passkeys' public halves): while you have a dashboard, or a report we still hold for you. Ask and we delete it.
• A free dashboard whose emailed link is never pressed: 30 days, then it's deleted, with the address unless we hold something else for it.
• An address that pressed This Wasn't Me, or asked not to hear from us: on our do-not-send list until you ask us to take it off.
• Report-door links: a one-way hash only, deleted after 7 days. Each works once, for one hour.
• Your sign-in history: one year.
• Our web server's request records: 30 days.
• Our security log: one year.
• The public records of a name we watch closely: while we watch it, and one year after we stop.
• Backups: 30 days.

What you can ask for

A copy of everything we hold about you, a correction, or deletion. Write to hello@copycatcheck.com and a person will do it, usually the same day. You don't need to give a reason and we won't ask you to justify it.

If you're in the UK or the EU those are your rights under the GDPR, and we honor them for everyone wherever you are. If you're in California, the same applies under the CCPA: we don't sell personal information and never have.

One standard, for everybody

We don’t sort people by where they live. The server is in Germany, and we apply the GDPR to everyone who uses this, whether you are in Berlin or Austin or anywhere else. The strongest rule is the easiest one to keep and the fairest one to be held to. If the law where you live gives you more than that, you get that too. We built this to help people keep their businesses from being copied, and being careless with your information would make nonsense of the whole thing.

If you are a business in the UK or the EU, you are the controller of your own mail data and we are processing it for you. Ask and we’ll sign a data processing agreement. Our processors are the four named above, and we’ll tell you before that list ever changes.

Children

This is a tool for businesses. It isn't for anyone under 16, and we don't knowingly hold anything about anyone under 16.

If this page changes

We'll change the date at the top and say what changed. If a change means we would hold something new about you, we'll ask first.

Who we are

CopycatCheck is a product of ATXworks.dev, operated by C. Achberger, Austin, Texas. Post reaches us at 13341 W. US Hwy 290, Building 2, Austin, TX 78737. Email reaches us faster: hello@copycatcheck.com.

Check My Business Terms