Privacy
This page says what checkbam.com does with data. It is short because there is not much of it, and specific because a vague privacy policy is not worth reading.
The URL you check is sent to Google
This is the most important thing on this page. The page health check works by asking Google's PageSpeed Insights API to load and measure the URL you type in. So the URL is sent to Google, along with our API key, and Google loads that page from Google's own servers.
If the address you want to check is private — a staging site, a client's unlaunched page, a URL with a token in it — it will not stay private. Check something you are happy for Google to visit.
We send nothing else: not your IP address, not a browser fingerprint, not who asked.
What we store, and for how long
For each check we keep one row: the URL, the result, and the times the check started and finished. It is deleted after 24 hours, automatically, by a job that runs every hour. Nothing is kept after that and there is no backup of it.
The result has no address of its own. It is shown on the page you ran it from and nowhere else, which is also why reloading that page loses it.
If you sign in with Google, we also keep your account. That is covered in its own section below.
We do not store your IP address
Not in a database, not in a log file. To stop one person running thousands of checks we count recent requests against a salted SHA-256 hash of the address, held in the server's memory and never written to disk. The salt is secret, so the hash cannot be turned back into an address, and the whole count is forgotten when the server restarts.
The visit counting described below is given a shortened address — the last two blocks cut off — and never the whole one.
There is no access log
Neither the web server nor the application writes a request log with your address or the addresses you check. The application logs the path of a request — `/scans` — and never the query string or the body. That is a configuration choice we keep on purpose, with a test in the codebase that fails if it is undone.
Signing in with Google
Signing in is optional. If you don't sign in, nothing in this section applies to you.
When you click Sign in with Google, your browser leaves checkbam.com, you sign in on Google's own page, and Google sends you back. That is the only moment your browser talks to Google. The button is a plain link, so no Google script loads on our pages before you click it.
We ask Google for one thing: who you are. That means your Google account ID and a verified email address, through the `openid email` scopes. We get no name, no profile picture, no contacts and no ongoing access to your Google account. We do not request a refresh token and we do not store one. Google's token is read once on our server and then discarded. It never reaches your browser.
We store the account ID and the email address so we can recognise you when you come back. We keep them while your account exists. Write to <info@checkbam.com> and we delete both.
We process these two details because you asked for an account and we cannot give you one without them (Art. 6(1)(b) GDPR).
Google runs the sign-in page itself, under its own privacy policy. Google will know you signed in to checkbam, and lists it among the third-party connections in your Google account, where you can remove it. Google may process data in the US; Google LLC is certified under the EU-US Data Privacy Framework.
Cookies, only after you sign in
If you sign in, we set the cookies below. If you don't, we set none.
| Cookie | What it does | How long |
|---|---|---|
| checkbam_session | Keeps you signed in. Holds a random identifier and nothing else. Scripts on the page cannot read it. | Up to 30 days. Deleted when you sign out. |
| checkbam_oauth | Protects the redirect to Google and back while you sign in. | 10 minutes |
Both are strictly necessary for signing in, so they need no consent (§ 25(2) no. 2 TDDDG) and there is no banner asking for it.
How we count visits
We count page views with Matomo, which we run on our own server in Germany. Your browser never talks to it: our server records the visit, and nothing about you is passed to anyone else. There is no script on this page, no pixel and no cookie for counting. Unless you sign in, nothing is stored on your device or read from it, which is why you have not been asked to agree to anything.
Matomo is told which page you asked for, which site linked you to it, your browser and your language. It is not told your IP address: we cut the last two blocks off first, so it sees 203.0.0.0 rather than 203.0.113.7 — enough to tell which country, not enough to tell which connection. Requests are grouped into a single visit using a salted code that changes every midnight, so today's visit cannot be linked to yesterday's.
We also record that a check was run, and which of our checks it was. The URL you typed is not part of that — it is not sent to Matomo, stored there, or used to name anything in a report.
We keep these visit records for as long as the site runs, which is longer than the 24 hours above. There is nothing in them that identifies you, and nothing in them is the URL you checked: the address arrives already shortened, and the code grouping one day's requests is unrecoverable the next.
Your browser talks to nobody else, until you sign in
No tag manager, no advertising, no embedded video, no chat widget, and — as above — no tracking script of any kind. No tracking cookies either. If you don't sign in, the site sets no cookies at all. If you do, it sets only the two above. Either way there is no cookie banner to click.
Fonts are served from this domain rather than from Google Fonts. Images from our content system are fetched by our server and re-served from here. So loading a page on checkbam.com makes requests to checkbam.com and nothing else. The one exception is signing in, when your browser goes to Google and back.
Hosting
The site runs on a virtual server rented from Hetzner Online GmbH in Germany. Hetzner processes data on our behalf under a data processing agreement.
Your rights
Under the GDPR you can ask what we hold about you, ask for it to be corrected or deleted, and complain to a supervisory authority. Given the above, the honest answer to the first question is almost always “nothing, and anything we did have was deleted within a day”. If you signed in with Google, it is also your account ID and email address. Write to <info@checkbam.com> and we will answer.
Changes
If this page changes in a way that matters, the change will be visible in it. There is no version history to consult, so it is written to be worth reading now.