Privacy policy

Last updated 2026-10-13.

AXRAY is operated from https://axray.online. The legal entity behind it is not yet published here; ask at hello@axray.online and you will get it in writing before you are asked to pay for anything.

What do we store?

• Scans: the URL you asked for, the resulting report and a timestamp. A report is reachable only through its own unguessable link. If you were signed in when you ran it, only your account can open it.
• Accounts: your email address and a scrypt hash of your password. We never see the password itself.
• Waitlist: if you asked to be told when a paid plan opens, your email address and which plan. Used for that message and nothing else.
• Domain claims: the domain, which account claimed it, how control was proved (a DNS TXT record or a file at a well-known path) and when. Kept so that a public listing can be traced back to a person who asked for it.
• Billing: a Stripe customer id. Card details are handled entirely by Stripe and never touch our servers.
• Rate limits: a counter keyed by a hash of your IP address, kept for a few days. The address itself is not stored.
• Refused requests: if somebody points the scanner at a private address, a non-web port or a scheme we do not fetch, we record what was asked for and the IP address that asked. This is the one case where a raw address is kept, and it is kept because an attempt to reach inside our network is the one thing worth being able to trace.

What is public, and what is not?

Scanning a site does not publish anything about it. The public AX Index contains only hosts whose owners claimed the domain, proved they control it, and asked for it to be listed. A listing shows the host, its best AX score, its grade and a link to that report.

Removal is immediate and unconditional. One click on the report or on your dashboard removes a listing from /index, from /api/v1/index and from the badge endpoint at once — nothing is cached and nothing is queued. If you no longer have access to the account that listed it, verify the domain from your own account, or email hello@axray.online and we will remove it. We do not ask why.

Some hostnames are never listed at all, whoever asks: bare IP addresses, names with no public suffix, names under .local, .internal, .test and their relatives, anything that resolves to a private address, and hostnames that look like staging or preview environments (staging., dev., preview., branch deploys on the usual hosting platforms).

How long do we keep it?

• Reports: until you delete them or ask us to. Deleting your account deletes them.
• Rate-limit counters: a few days, then removed automatically.
• Refused-request records: twelve months, then removed.
• Domain claims: until you release the domain.

What do we not do?

We show advertising from Google AdSense on some pages. Google sets cookies and reads your IP address to select and measure those ads; that data goes to Google, not to us, and we never see who you are from it. You can review and change what Google uses at My Ad Center and read how it is handled in Google's partner-sites policy.

Advertising is the only third party on this site. No analytics, no session recording, no tracking pixels beyond the ad units, and nothing about you or the sites you scan is sold to anyone. Ads never appear on your dashboard or on a report you are signed in to read. Other than Google's ad servers, the only outbound requests this service makes are to the sites you ask it to scan and to Stripe.

How do I delete my data?

Email hello@axray.online and we will delete your account, scans and history within seven days.