Privacy policy

This policy describes what actually happens when you open linksniffer.de and when you check an address. The German version is authoritative.

1. Controller

Florian Silbereis
10898 Dennington Rd, Fort Myers, FL 33913, United States of America
Email: kontakt@linksniffer.de

2. In short

• No cookies, no tracking, no analytics tools, no advertising networks.
• The website itself needs no user account and no sign-up. Only if you use the interface (API, MCP, monitoring) do you provide an e-mail address (section 5).
• The address you check is not stored permanently – unless you explicitly have it monitored (section 5).
• Only what is technically necessary for the check is passed on (section 4).

3. Server log files

When you open the site, the web server automatically records: IP address, date and time, the requested address, the HTTP status code, the amount of data transferred, the referring page and the browser identification.

Purpose and legal basis: operation, stability and security of the service – legitimate interest under Art. 6(1)(f) GDPR.
Retention: 14 days, after which the logs are deleted automatically.

The server is operated by 1blu AG, acting as a processor under Art. 28 GDPR.

4. Checking an address

When you have an address checked, it is transmitted to our server and processed in two steps:

1. Security check via DNS. The hostname is resolved through Cloudflare’s public DNS service to rule out that the request targets a private or internal network. Only the hostname is transmitted to Cloudflare, not your IP address. Cloudflare is based in the USA; the transfer relies on Art. 6(1)(f) GDPR (abuse prevention) and on the provider’s standard contractual clauses.
2. Fetching the target page. Our server then fetches the address itself and shows you the response. The operator of the checked page sees the IP address of our server, not yours.

Legal basis: Art. 6(1)(b) or (f) GDPR – the processing is the service you requested.
Retention: the checked address is processed in memory for the duration of the request only and is stored neither in a database nor in the server logs. It is transmitted as the request body and therefore does not appear in the log files.

5. API keys, monitoring and MCP (optional)

If you use the interface described at /en/developers, you create an API key. When you do so and while you use it, we process:

• Your e-mail address and, optionally, a label – to assign the key to a person, to inform you about material changes to the service (such as the end of the beta) and to limit abuse (at most three keys per address). We also store which version of the terms of use you accepted and when the key was created.
• We do not store the key itself, only a cryptographic hash (SHA-256). That is also why we cannot recover a lost key. The same applies to the address of your change feed.
• Usage counters: the number of checks per day and channel (API, MCP, monitoring) and the time of last use. We do not store which addresses you check via API or MCP.
• Monitored addresses: if you have an address monitored, we store it together with the results of the last 100 checks (status code, final destination, redirects, detected JavaScript redirects) and up to 200 change events. Section 4 applies to each of these checks.
• Webhook (optional): if you register a webhook address, we send change events there. The recipient is the operator of that address, whom you choose yourself.
• Product news (optional): only if you tick the corresponding box do we send you news about LinkSniffer by e-mail (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by e-mail or via the API (PATCH /v1/me).
• Confirming your address (double opt-in): after signing up you receive a mail with a confirmation link; only that click unlocks the full allowance. If you gave consent to product news, we additionally store the time and IP address of the confirmation – the legally required proof that the consent came from you. Without that consent we do not store the IP address.
• Security check during sign-up: your browser solves a small computational puzzle so that keys cannot be created automatically in bulk. This runs entirely on our server and in your browser – no third-party service, no cookie, no transfer to anyone else.
• Operator notification: the operator is notified of every sign-up and confirmation by e-mail or message. It contains the data listed here, nothing else.

Legal basis: Art. 6(1)(b) GDPR – providing the service you requested; for limiting abuse Art. 6(1)(f) GDPR.
Retention: until you delete the key – yourself via DELETE /v1/me or by informal e-mail. This deletes the key, monitored addresses, check history and events completely.

Limits without a key: to limit use without a key, we count checks per IP address – in memory only, for at most one hour and without writing it to disk. The only thing kept permanently is a daily total of all anonymous checks, with no personal reference.

6. No cookies, no audience measurement

LinkSniffer sets no cookies and uses no analytics, tracking or advertising services. No fonts, scripts or images are loaded from third-party servers.

One exception, for completeness: if you set the appearance below to „Light“ or „Dark“, that choice is stored in your browser’s local storage (key linksniffer-theme) so it survives your next visit. The value never leaves your device and contains nothing but „light“ or „dark“. As this is a function you explicitly asked for, no consent is required (section 25(2)(2) TDDDG). Switching back to „System“ deletes the entry.

That is why there is no consent banner – nothing is stored or read that would require consent.

7. Your rights

You have the following rights towards the controller:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An informal email to kontakt@linksniffer.de is enough.

8. Right to lodge a complaint

Irrespective of the above, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

9. Changes

If the way the service works changes, this policy will be adapted. The version published here applies.