Privacy Policy
Last updated: September 1, 2026. This policy explains what confirmURL.com collects, why, and your choices.
1. Who we are
confirmURL.com (“we”, “us”) operates https://confirmurl.com. Contact: support@confirmurl.com.
2. Information we collect
2.1 Information you provide
- URLs you submit for checking (required to run the service). Every checked URL is logged together with your IP address, your approximate country, the time, the tool used (website, QR, message scanner, API, etc.) and the result, for site administration and security. This check log is kept for 30 days, then deleted automatically, and only the site owner can see it; it is never shown publicly, shared or sold.
- Messages you send to our contact email
2.2 Information collected automatically
- IP address, browser type, approximate time of request
- Basic server logs for security, abuse prevention, and reliability
- Session identifiers for short-lived live browser sessions (auto-expire)
- Statcounter analytics on every page (see Analytics below), and optional advertising cookies if you consent (see Cookie Policy)
2.3 Content inside checked pages
When you confirm a URL, our servers may fetch the page and render it in an isolated browser to produce a screenshot and technical report. We do not ask you to enter passwords into third-party sites inside the sandbox, and you should not do so. Screenshots and session data are temporary and discarded when the session ends (typically within minutes).
3. How we use information
- To provide URL confirmation, scans, and safety reports
- To secure the service (rate limits, block private network targets, abuse handling)
- To improve reliability and user experience
- To show ads (if enabled) via partners such as Google
- To respond to legal requests when required by law
4. Legal bases (EEA/UK where applicable)
- Contract / service delivery — processing URLs you submit
- Legitimate interests — security, fraud/abuse prevention, basic logs
- Consent — non-essential cookies/ads where required
- Legal obligation — when we must retain or disclose information
5. Sharing
We do not sell your personal information. We may share limited data with:
- Infrastructure providers (hosting, DNS, CDN) under contract
- Advertising partners such as Google AdSense (if ads are shown) — see Google’s policies
- Authorities when legally required
Google may use cookies and receive approximate device/ad request data as described in Google’s advertising policies.
6. Cookies
See our Cookie Policy. You can accept or decline non-essential cookies via our banner where shown.
6a. Analytics
We use Statcounter (statcounter.com) for internal traffic statistics only. On every page, Statcounter processes page views, the referring page, approximate location, browser and device information, and your IP address, and it may set cookies. We use this data only to understand how the site is used; it is not sold and not used for advertising. We also keep our own first-party visit log for site administration and security: for each page view we record the time, your IP address, your approximate country (looked up locally from the IP address, without sending it to anyone), the page visited, the referring site's domain, your device, browser and operating system type, and whether the request looks like an automated bot. This log is kept for 30 days and then deleted automatically, is visible only to the site owner, and is not shared or sold. We also keep aggregated daily statistics (page views, top pages, referring sites, countries, device/browser/OS types and a count of unique visitors, computed with a one-way hash of IP address and browser that uses a random value replaced every day) for 90 days. IP geolocation by DB-IP (CC BY 4.0). See Statcounter's privacy policy: https://statcounter.com/about/legal/.
6b. QR scanner, message scanner, API keys and scam reports
- QR scanner: images and camera frames are decoded in your browser and are not uploaded. Only the decoded link is sent if you run a check.
- Email & SMS scanner: pasted text is processed in memory to extract links and the message text itself is not stored or logged. The extracted links are looked up (including with VirusTotal and Google Safe Browsing) and are recorded in the check log described above (with IP address and country, 30 days, owner only).
- API keys: we store a hash of the key, its creation date, usage count, an optional label and the optional email address you give. The email is only used to contact you about your key. Keys can be revoked.
- Scam reports: we store the reported link, your optional note and the date for moderation. If approved, the link, its verdict and the date are published on the public feed; your note is never published. We do not store your IP address with the report (IP addresses are used briefly in memory for rate limiting).
- Fake login check: when we load a checked page we look at its forms, branding, favicon, scripts, domain age and HTTPS to spot fake sign-in pages. This runs on our server; nothing you type is involved, and the result is stored with the report and in the check log.
- Browser extension: the ConfirmURL extension only sends a URL to confirmurl.com when you ask it to (toolbar button, right-click menu, or link badges if you turn them on). Those checks are logged like any other check (URL, IP address, country, result; 30 days, owner only). It does not read page content, browsing history, or form data, and has no analytics.
- Usage statistics: we keep daily counts of checks and verdicts and a count of flagged domains, without personal data.
7. Retention
- Live sessions and screenshots: short-lived (minutes), then deleted
- Visit log (IP address, approximate country, page, referrer, device/browser/OS): 30 days, then deleted automatically; aggregated visit statistics: 90 days
- Check log (checked URLs with IP address, approximate country, tool used and result): 30 days, then deleted automatically; visible only to the site owner
- Security logs: typically up to 90 days unless needed longer for abuse investigation
- Email correspondence: as long as needed to resolve your request
8. Security
We use isolation, timeouts, and blocks against private/internal network targets (SSRF protections). No method of transmission over the Internet is 100% secure.
9. Children
The service is directed to a general audience and is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child provided data, contact us to delete it.
10. Your rights
Depending on your location, you may request access, correction, deletion, or restriction of personal data, or withdraw consent. Email support@confirmurl.com. You may also lodge a complaint with a supervisory authority.
11. International transfers
Our servers and vendors may process data in the United States or other countries. Where required, we use appropriate safeguards.
12. Changes
We may update this policy. The “Last updated” date will change when we do. Continued use means you accept the updated policy.