This policy explains what personal data Domain Armor at getmirror.online ("we", "us") processes and why. We collect as little as possible: the Service works without an account.
1. Scanning without an account
When you check a domain, the domain name is sent to our server, which queries public DNS resolvers (Cloudflare and Google DNS-over-HTTPS), the Certificate Transparency service Cert Spotter (SSLMate), and makes ordinary GET requests to that domain's homepage over HTTPS and HTTP. Only if you choose "Check agent access" on a result does it also request up to three public files from that site (robots.txt, llms.txt and /.well-known/security.txt); that result is cached on our server for up to 24 hours. Scan results are not stored in a user profile when you are signed out, but badge results are cached on our server for 24 hours and responses from the public grade API are cached for 10 minutes.
To understand how the Service is used, we record anonymous usage events: the action (for example a visit, a scan view, a share, an export, a badge view or a badge-snippet copy), the public domain involved, its grade, your interface language, the page you landed on, the website that referred you (host name only) and, if the link you followed included one, its campaign label (the utm_source parameter), a broad channel category derived from those (for example direct, search, social, AI assistant, other website or campaign), and whether the visit was marked as an internal test (internal=1). Each "Check agent access" request is counted the same way, with its outcome. These events do not include your IP address, email, account identifier, any cookie or device identifier, full referring or query URLs, or your browser's user-agent string, and cannot be linked to you.
When a grade badge is requested, we keep the domain's latest grade and check time for up to 24 hours so we don't rescan it on every view. This is public information about the domain, not about you.
When the public grade API (/api/grade) is called, we count the call as an anonymous event with the domain, its grade, the label "api" and whether the request was marked as an internal test (internal=1). To apply a per-client request limit, a one-way hash of the caller's IP address is held briefly in server memory and is never written to storage.
If you use "My domains", the list of up to 10 public domain names is stored in your browser; if you are signed in, it is also stored with your account so it is available on your other devices. You can remove domains at any time.
As with any website, our hosting provider processes technical data such as your IP address, browser type and request time to deliver pages, prevent abuse and diagnose errors.
2. Data stored in your browser
Your scan history (domain, date, score and per-check results) is stored in your browser's local storage so you can compare scans over time. It never leaves your device unless you sign in. You can delete it at any time from the history panel.
We set one cookie, "lang", to remember your chosen language. If you sign in, your browser also stores a session token to keep you signed in. We do not use advertising or tracking cookies.
3. Optional account
If you sign in with an email link or Google, we store your email address and basic account identifiers provided by the sign-in method (for Google: name and profile image may be included). We use them only to sign you in and keep your data linked to your account.
While signed in, your scan history snapshots and generated AI fix plans are stored in our database so they are available across devices. Each account can only read its own data.
4. AI fix plans
When you request an AI fix plan, the selected scan snapshots (public domain data, scores and findings) and your interface language are sent through the Lovable AI Gateway to an AI model provider to generate the plan. No account details are included in that request.
5. Service providers
We rely on: Lovable (application hosting, database, authentication and AI gateway) and its infrastructure providers, including Cloudflare; Google (optional sign-in, and Google Fonts, which receives your IP address when fonts load); Cloudflare and Google public DNS resolvers and SSLMate Cert Spotter (receive the domain being scanned, not your identity); and AI model providers reached through the Lovable AI Gateway (receive scan data for AI fix plans).
We do not sell personal data and do not share it for advertising.
6. Legal bases
Where data protection laws such as the GDPR apply, we process data to provide the Service you request (performance of a contract), for security and abuse prevention (legitimate interests), and, for the optional account, because you choose to create one.
7. Retention and deletion
Browser history stays on your device until you clear it. Account data is kept until you delete it or ask us to delete your account. Clearing history while signed in also removes it from your account. Technical server logs are kept for a limited period for security and debugging.
To delete your account and all associated data, email privacy@getmirror.online from the address you signed in with.
8. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, object to or restrict processing, and complain to a data protection authority. Contact privacy@getmirror.online to exercise these rights.
9. Security
Data is transmitted over HTTPS. Account data is protected by access rules that restrict each account to its own records. No system is perfectly secure; please contact us if you find a problem.
10. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal data.
11. Changes
We may update this policy. The "Last updated" date shows the current version.
12. Contact
Privacy questions or requests: privacy@getmirror.online.