Privacy Policy

This policy explains what information Xrayd processes, which tools operate locally in your browser, and what reaches the server.

Tools that operate locally

The following tools process data entirely in your browser. No file or code content is transmitted to Xrayd servers:

• Photo Forensics — Images are read using browser APIs. Your image is not uploaded to any server.
• Secret Scanner — Code is scanned using JavaScript running in your browser. Source code is never transmitted.
• File Forensics — Files are read using browser APIs. File content is not transmitted.

Tools that make server-side requests

The following tools require the server to make HTTP requests on your behalf:

• Website Detective — Xrayd fetches the requested URL from the server to avoid browser CORS restrictions. The URL you enter is sent to our server. The HTML response is analysed and discarded; it is not stored.
• URL Investigator — Xrayd follows redirects and collects headers server-side. The URL you enter is sent to our server. Response data is not stored.

Analytics

Xrayd uses Google Analytics 4 to collect anonymised usage data, including page views and tool interactions. Analytics events do not contain file contents, source code, GPS coordinates, full URLs with sensitive parameters, or personally identifiable information. Analytics can be blocked using standard browser extensions or privacy tools.

Cookies

Google Analytics sets analytics cookies. No other cookies are used. Tool usage does not require cookies or an account.

Data retention

Xrayd does not store uploaded files, scanned source code, or analyzed URLs. Tool results exist only in your browser session. No persistent tool history is maintained.

Third parties

• Google Analytics — Usage analytics

Contact

For privacy questions, contact us at the email address listed on the Xrayd website.