Privacy & service information
We build public learning tools to be useful without asking visitors to create accounts. This explains what each tool does, the limits of our privacy commitments and how to reach us.
Free tools & third-party providers
Password Strength Lab: the sample password and generated password are processed in your browser by our local script. The lab does not send them to Savana Security. Do not enter real credentials, because browser extensions and your device may still access form values.
Online Presence Self-Check: name, alias or domain queries are prepared in your browser. They are not submitted to our server by this self-check. Clicking a search link shares the query with Google or Bing under their policies.
IP & Browser Visibility: the site receives your current IP and edge-network metadata to display to you. The result is not deliberately saved in our diagnostic database. Normal Cloudflare infrastructure logging may still occur.
Domain & DNS Footprint: the hostname goes to Cloudflare's public DNS resolver. We do not deliberately store the hostname in our diagnostic database.
SSL Certificate Checker: the hostname goes to a third-party certificate-information provider to check a public certificate; the website does not deliberately save that hostname in its diagnostic database.
Minecraft Server Checker: your submitted server hostname and edition go to mcstatus.io. The website does not deliberately store your queried server hostname in our diagnostic database.
Some checks use request limits and short-lived hashed connection identifiers to protect shared API capacity. Network logs controlled by Cloudflare or external providers may exist even when we do not deliberately store submitted hostnames.
Verified-domain report beta and planned paid reports
Different from the anonymous DNS footprint checker: when you explicitly request a verification challenge, this workflow records the domain, a random report reference, SHA-256 hashes of its DNS proof and access token, creation/expiry and verification timestamps, verification attempts, and the minimal processing state in a private Cloudflare D1 database. The plaintext private access token is returned once to your browser; it is not stored in plaintext by our application. We send the requested public domain name and TXT record label to Cloudflare's public DNS resolver to verify control and collect DNS answers. We do not contact the domain's website, accounts, mail server or private network.
Verification proof expires after 24 hours. Our application opportunistically removes unpaid beta entries older than 30 days when new challenges are created; this is not a guaranteed scheduled erasure date. Hashes and report references are not cryptographic guarantees of anonymity. Normal CDN and provider logs are separate. Keep private access tokens out of public screenshots and support messages.
Proposed paid reports are not yet for sale. Once enabled, Stripe would handle card payments externally; we would store Stripe payment and event references, signed-webhook fulfillment status, and a bounded public-DNS report snapshot. We do not need or store customer card numbers. A planned paid report would be retrievable with the private reference and token for up to 90 days from the confirmed payment. This is an access window, not an automatic deletion guarantee; report/order records may remain stored for support, security and lawful financial recordkeeping until an appropriate deletion process is implemented. Refunds revoke report access.
To request access, correction, or deletion of a report reference, email savanasecurity@gmail.com. Do not include the private token in ordinary email. We will verify the request and explain any applicable recordkeeping limitations.
Anonymous site analytics
Our own site stores daily aggregate counts per page so we can tell which free tools people find useful. We do not intentionally store a visitor IP, fingerprint, page query string, password or email in those aggregate rows. A browser-session flag helps limit repeat counts on a single page. Counts are not unique visitors or definitive traffic figures.
Metrics rows older than approximately 90 days are scheduled for cleanup. Infrastructure security logging and retention are separate from these aggregate counters.
Inquiries, payments & sponsorship
When you submit a service, uptime-pilot or sponsorship form, we store the contact details and explanation you voluntarily provide in our private business intake database to review your inquiry and reply. Forms do not automatically enroll you in a paid service or guarantee an email reply. We can delete inquiry records on request after verifying the request, subject to legal or operational recordkeeping obligations.
Paid consultations use external Stripe checkout and Stripe's policies. Optional support contributions open Cash App and are handled by Cash App. Please do not submit payment credentials directly through our site forms.
Any future paid placements or compensated affiliate links will be clearly disclosed. Sponsors do not receive our visitor contact lists or diagnostic input data.
Terms and limitations
Free checks are educational point-in-time observations. External status checks do not prove a site's security or a server's complete performance. An unsuccessful lookup is not conclusive evidence of an outage. Access and check capacity may be restricted to protect reliability. All submitted target checks require appropriate permission.
Savana Security is an independent for-profit business, not a charity or tax-exempt nonprofit. Optional contributions do not create a service contract, guarantee a feature or qualify as tax-deductible charitable donations.
Questions about privacy, payments, or removal of your submitted inquiry? Email savanasecurity@gmail.com.