Privacy and cookies
Controller
Alex Herrera Manzanares, based in El Roble, Puntarenas, Costa Rica.
Email: alexhmanzanares@gmail.com
Data collected
Vercel
Vercel counts visits to each page. It also measures how fast the page loads. It records the page, the country, the browser, the operating system and the device type. It does not use cookies. It identifies each visit with a code calculated from the request and discards it after 24 hours.
Google Analytics
If you accept the measurement cookies, Google Analytics records the pages you visit, where the visit came from, the device and the browser. Google receives your IP address along with that data. Google signals and ad personalisation are turned off. The data is only used to count visits.
Scanner
The Scanner sends the domain you type to the server api.alexherrera.dev. The server stores the domain and the report for 30 days. Anyone with the report link can view it. The report does not include your IP address.
The form requires you to accept those 30 days before scanning.
The server counts the scans of each IP address with an HMAC hash of the address. The hash changes every hour, cannot be used to recover the IP and is deleted after 48 hours. The limit is 5 scans per hour.
Each scan goes through Cloudflare Turnstile, which detects bots. Turnstile processes the IP address, the TLS fingerprint, the User-Agent header and the site key. Cloudflare does not say how long it keeps that data.
The server runs on Vercel and stores the reports in a Neon database.
SchemaFlow
SchemaFlow stores your design and preferences in the browser local storage. SQL queries run in the browser. SchemaFlow does not send data to any server.
Phishing detector
The phishing detector checks, in your browser, the message, links, sender, headers and file that you type, paste or choose. It does not store or send that content. It does not open any link or run the file.
If you write an email, the message goes through Google, which provides the service. The person responsible uses your address and message only to reply. They delete them when you ask.
Retention periods
| Data | Where it is stored | Period |
|---|---|---|
| Measurement cookies (Google Analytics) | Your browser | Up to 2 years. The browser may shorten it. |
| Data for each visit in Google Analytics | Google servers | At most 14 months. |
| Aggregated Google Analytics reports | Google servers | No limit. They do not identify anyone. |
| Vercel statistics | Vercel | Code for each visit: 24 hours. Aggregated statistics: according to the account plan. |
| Scanner domain and report | Neon database | 30 days |
| Hash of the IP address in the Scanner | Neon database | 48 hours |
| SchemaFlow design and preferences, theme and security checklist | Your browser | No limit. Until you delete them. |
| Your cookie choice | Your browser | No limit. Until you delete it. |
| Your email and message | Google email service | Until you ask for them to be deleted. |
Providers
- Google LLC: Google Analytics, if you accept the measurement cookies, and email.
- Vercel Inc.: site hosting, visit statistics and the Scanner server.
- Cloudflare, Inc.: Turnstile, in the Scanner.
- Neon, part of Databricks: the Scanner database.
All of them process data in the United States and in other countries, under their own policies. The person responsible does not sell your data or pass it to anyone else.
Your rights
You can ask for access to your data, for it to be corrected or deleted, and withdraw your consent at any time. Write to the controller email.
The person responsible replies free of charge within five working days, as article 7 of Costa Rican Law 8968 sets out.
If you are not satisfied, you can file a complaint with the Data Protection Agency of Costa Rica (Prodhab).
The General Data Protection Regulation applies to visits from the European Union. It allows you to object to the processing, restrict it and complain to the supervisory authority of your country. The reply period is one month.
This site does not make automated decisions about you.
Your cookie choice
Your current choice: You have not decided yet.
Accepting the cookies means accepting this policy. The site stores your choice and does not ask again.
When you reject, the site deletes any measurement cookies it had stored. You can also delete them in the browser settings.
Scope of the results
The results of the Scanner, SchemaFlow and the phishing detector are indicative and may be incomplete or inaccurate. They do not replace a security audit or professional advice.
Use the Scanner only on domains that you own or that their owner has authorised.
The phishing detector uses brand names only to compare them with those in a message. It has no relationship with those brands.
Changes to this page
This page is updated when the processing of data changes. If the cookies or their purpose change, the site asks again.