Privacy Policy.

This policy explains how DigiePal Networks LLC (“UtiBox”, “we”) collects, uses and protects information when you use utibox.io and our tools. We are the controller of the personal information described here. You can reach us through the contact form or at support@utibox.io.

Our text, developer, password, image, PDF and static QR tools run entirely in your browser. What you type or drop into them, including Wi-Fi passwords in a QR code, contact cards and files, stays on your device. It isn’t sent to our servers, to advertisers or to analytics providers: Microsoft Clarity’s recordings blank out the tool area. Only website, DNS and certificate checks, port scans and the internet speed test (when you choose UtiBox’s own server) use our server, because they have to. The speed test’s upload sends only random test data, which the test server counts and throws away, and your results are worked out in your browser and kept only there. Speed tests on M-Lab’s servers are different: see How we use information.

Your watchlist, recently used tools and a few display preferences are saved in your browser’s local storage. So are your recent DNS propagation checks (for the propagation chart) and your recent port scans (to compare a new scan with your last one) and your recent DNS lookups and your recent SSL certificate checks and your recent WHOIS lookups and your recent reverse DNS lookups and your recent IP address lookups and your recent MX record lookups. See the Cookie Policy for the full list and how to clear it.

• Provide the service: run checks.
• Keep it safe: rate limits, abuse and fraud detection, and refusing checks that point at private networks.
• Communicate: replies to your messages and the “it’s back” alerts you ask for. The Outage Digest only if you subscribe and confirm; every digest has a one-click unsubscribe link. Email updates about a DNS change or a port (open only to our staff for now) go only to the address that asked for them, and every one has a link to stop them.
• Advertising: show ads served by Google, as described under Advertising. We don’t give Google or anyone else your email address or check history.
• Improve UtiBox: Google Analytics shows us which pages and tools are used and how people find them, Ahrefs Web Analytics counts visits without cookies, Microsoft Clarity shows where people click and scroll and where pages confuse them (see Cookies), and our own aggregate counts show things like how many checks ran today. We use these to fix and improve the site, not to follow individual people.
• Show how many people are checking a site: when you open a status page we store a code made from your IP address and the date. It changes every day, so visits can’t be linked across days, and it’s deleted after 48 hours. Only the total count is ever shown. Bots aren’t counted.
• Blog: to show which posts are popular, we count a view when a post has been open for five seconds, using the same daily-changing code as above, deleted after 48 hours; only totals are kept. Videos in posts don’t load anything from YouTube or Vimeo until you press play; then that service receives your request like any visit to it.
• “Is it down for me?”: on a status page, your browser sends one small request to the site you’re checking, as if you visited it, and times the answer. That site sees the request. The result stays in your browser; we don’t receive it.
• DNS propagation checker, “From your browser”: unless you name a single resolver to ask, your browser asks Cloudflare (cloudflare-dns.com) and Google Public DNS (dns.google) directly for the record you’re checking, over DNS-over-HTTPS. Those services receive your IP address and the domain name, as with any DNS lookup, and handle them under their own policies (Cloudflare, Google Public DNS). Their answers stay in your browser: we don’t receive or store them, and they’re never part of a PDF report.
• Internet speed test on M-Lab’s servers: unless you choose UtiBox’s own server, the speed test runs between your browser and a server of Measurement Lab (M-Lab), a non-profit research network. When you press Start, your browser asks M-Lab’s locator for a server (the nearest, or the city you picked) and then runs M-Lab’s test with it. M-Lab publishes every test on its servers as open data, including your IP address and the results, and you can’t opt out of that on M-Lab’s servers; the line beside the Start button says so before you press it. M-Lab handles this under its own privacy policy. Nothing is sent to M-Lab until you press Start, and we don’t send M-Lab anything about you. To test without publishing anything, choose UtiBox’s own server (“Test privately instead”); that choice is remembered in your browser.
• Port scanner: the address box is filled in with your IP address, which our server sees anyway when you visit; it’s stored only if you scan it. The connections come from our server, so the host you scan sees our server’s address, not yours.
• DNS Lookup and SSL Certificate Checker: For a DNS lookup, our server asks a root server, the servers of the top-level domain, the domain’s own name servers, its resolver and Cloudflare’s public resolver (1.1.1.1, to check DNSSEC) about the name you enter. For an SSL check, our server connects to the host you enter, the way a browser would, on each of its addresses. They receive the name or host you checked, from our server; nothing about you. Your recent lookups and checks stay in your browser.
• WHOIS Lookup: for a WHOIS lookup, our server asks IANA’s RDAP directory, the domain’s registry and its registrar, the registries of other common endings (to see whether the same name is taken there), the top-level domain’s servers, the domain’s own name servers and Cloudflare’s public resolver (1.1.1.1, to check DNSSEC) about the domain you enter, and looks up where its website and name servers are in the DB-IP location files it holds. They receive the domain you looked up, from our server; nothing about you. The small map of where the website is hosted is drawn by Google Maps, which receives the approximate place shown. Your recent lookups stay in your browser.
• Reverse DNS Lookup: for a reverse DNS lookup, our server asks a root server, the reverse-DNS servers run by IANA and the regional internet registries, the name servers of the zone that holds the address’s name, its resolver (for the names’ own addresses and the reverse names of the 16 neighbouring addresses) and Cloudflare’s public resolver (1.1.1.1, to check DNSSEC) about the address you enter, and looks it up in the DB-IP location files it holds. For an IPv4 address it also asks six spam blocklists (SpamCop, UCEPROTECT, PSBL, Mailspike, DroneBL and S5H) whether it’s listed, which tells each list the address. They receive the address you looked up, from our server; nothing about you. The map is drawn by Google Maps, which receives the approximate place shown. “Use my IP” fills in the address our server sees when you visit; it’s stored only if you look it up. Your recent lookups stay in your browser.
• IP Address Lookup: for an IP address lookup, our server asks IANA’s RDAP directory and the regional internet registry that holds the address or AS number you enter, RIPE NCC’s RIPEstat service for how it is routed (the announcement, RPKI and the paths RIPE’s route collectors see), Team Cymru’s DNS service for the names of the networks involved and its resolver for the address’s reverse name, and looks the address up in the DB-IP location files it holds. It also connects to the address itself on port 443 (three short connections to time the round trip, then one TLS handshake to read its certificate), checks the Tor Project’s list of exit relays, which we download, and, for an IPv4 address, asks six spam blocklists (SpamCop, UCEPROTECT, PSBL, Mailspike, DroneBL and S5H) whether it’s listed, which tells each list the address. They receive the address or AS number you looked up, from our server; nothing about you. The map is drawn by Google Maps, which receives the approximate places shown (our server, the place DB-IP gives and the address the registry has for the holder). Your recent lookups stay in your browser.
• SPF & DMARC Checker: for an SPF and DMARC check, our server asks its resolver for the domain’s TXT records (SPF), the SPF records of every service it includes, its MX, DMARC, DKIM (the common selectors and any you type), MTA-STS, TLS-RPT and BIMI records, and the DNSSEC answers; when a DMARC report address belongs to another domain it asks that domain whether it accepts the reports. When the domain publishes an MTA-STS policy, our server fetches it over HTTPS from the domain’s own web server. It never sends email: the forged-message test is worked out from the records. They receive the domain, from our server; nothing about you. Your recent checks stay in your browser.
• MX Record Lookup: for an MX record lookup, our server asks its resolver for the domain’s mail servers (MX), their addresses and reverse names, the domain’s SPF, DMARC, MTA-STS and TLS-RPT records and the servers’ DANE (TLSA) records, and asks one of the domain’s own name servers for its MX records to compare. It connects to up to six of the mail servers on port 25 to read their greeting, ask for encryption (STARTTLS) and read their certificate, then says goodbye: it never names a sender or a recipient and never sends a message. When the domain publishes an MTA-STS policy, our server fetches it over HTTPS from the domain’s own web server. It looks the servers’ addresses up in the DB-IP location files it holds and, for IPv4 addresses, asks six spam blocklists (SpamCop, UCEPROTECT, PSBL, Mailspike, DroneBL and S5H) whether they’re listed, which tells each list the address. They receive the domain or the server addresses, from our server; nothing about you. Your recent lookups stay in your browser.
• What Is My IP: the page shows the address our server sees, and our server looks it up in the DB-IP location files it holds (an approximate city and the network it belongs to), in DNS (its reverse name) and in the Tor Project’s list of exit relays, which we download; none of that is stored. Our server also asks six spam blocklists (SpamCop, UCEPROTECT, PSBL, Mailspike, DroneBL and S5H) whether your IPv4 address is listed, which tells each list the address, as any mail server checking you would. In your browser, the page asks ipify (api4.ipify.org and api6.ipify.org) for your other address and Google’s public STUN server (stun.l.google.com) which address WebRTC exposes; both receive your IP address, as any connection does. The map is drawn by Google Maps, which receives the approximate place shown. If you press “Show my exact location”, your browser asks your permission first; the position it gives stays in your browser, apart from Google receiving it to draw the map, and we never receive or store it. Latency, clock and time-zone checks and your recent addresses also stay in your browser. A PDF report stores your IP address, its approximate place and the check results, and anyone you give the report’s reference to can open its verify page and see them (see How long we keep it).
• Saved results: when someone runs the same check of a public site, domain or address shortly after another (from 15 seconds for response times up to six hours for WHOIS and IP address lookups), our server may answer with that earlier result instead of checking again, and the page says when it was measured. A saved result holds only what the check found about the target, never who asked. What Is My IP’s facts about your own address are saved for you alone, for up to five minutes (an hour for the blocklist check), and never shown to anyone else. To stop abuse, our server counts how much new checking each visitor and each network does (by keyed IP hash; networks by a keyed hash, never the address) and may ask you to wait a few minutes when that is unusually high.
• Google reCAPTCHA: on tools that run on our server, Google reCAPTCHA v3 checks in the background that requests come from a person rather than a script. Google receives your IP address and information about your browser and device, and may use its own cookies, under the Google Privacy Policy and Terms of Service. We receive only a score, and use it only to set how many new checks your connection can run.
• Meet legal duties: tax records, and responding to lawful requests.

Where data-protection law requires a legal basis (for example in the EEA and UK), we rely on: performing our contract with you; our legitimate interests in running a secure, reliable service and understanding how it’s used; your consent, for the Outage Digest and for advertising and analytics cookies; and legal obligations.

We set one cookie, ubsid, which keeps your session and its security token. It’s strictly necessary, so it doesn’t need consent. If you use the light/dark switch, a second cookie, ub_theme, remembers your choice; it holds only “light” or “dark”. Your watchlist, recently used tools and preferences are kept in your browser’s local storage, which never leaves your device.

Ads are served by Google, which uses its own cookies and similar technologies to show and measure ads (see Advertising). Where the law requires consent, for example in the EEA, the UK and Switzerland, those cookies are used only after you agree. The Cookie Policy lists everything.

We use Google Analytics to understand how UtiBox is used. When a page loads, Google receives the page address, the page or search that sent you, your browser, device type, screen size and language, and your IP address, which Google uses only to work out a rough location (country and city) and doesn’t store. Google Analytics sets its own cookies (_ga) to tell visits apart with a random number; it never receives your email address or what you type into our tools. In the EEA, the UK and Switzerland, Google Analytics stores nothing on your device until you agree in Google’s consent message; until then it receives only signals without cookies or identifiers. Google processes this data for us under its data processing terms; see how Google uses information from sites that use its services. You can opt out with the Google Analytics opt-out browser add-on.

We also use Ahrefs Web Analytics to count visits. It sets no cookies and stores nothing on your device. When a page loads, Ahrefs receives the page address and title, the page that sent you, your browser, device type, language and screen size, and, when you click a link or send a form, where it leads (never what you type). Ahrefs uses your IP address to work out your country and city, and to count each visitor once a day it combines the address and your browser details with a random value that it deletes every 24 hours, so visits can’t be linked across days. It never stores your IP address. Because it stores nothing on your device, we use it for every visitor, including in the EEA, the UK and Switzerland. Ahrefs processes this data as described in the Ahrefs Privacy Policy. To opt out, block scripts from analytics.ahrefs.com in your browser or with a content blocker.

We also use Microsoft Clarity, which records how pages are used: clicks, taps, scrolling, mouse movement and the parts of a page you see, so we can watch anonymised replays of visits and see heatmaps of where people click. Clarity blanks out what you type into forms and the whole tool area, so it never records your tool input or results. Microsoft also receives your browser and device type, screen size, approximate location and the page addresses. Clarity sets its own cookies (_clck, _clsk), and Microsoft may set its own (such as MUID) on its own domains. We don’t use Clarity for visitors in the EEA, the UK or Switzerland. Microsoft processes this data for us as described in the Microsoft Privacy Statement.

Our typeface (Geist) is served from our own server, so loading a page doesn’t contact Google Fonts.

UtiBox is free because it shows ads. They’re served by Google AdSense, always labelled “Advertisement”, and never shown in the admin area.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to UtiBox and/or other sites on the internet.
• You can opt out of personalised advertising in Google’s Ads Settings. You can also opt out of other vendors’ use of cookies for personalised advertising at aboutads.info (or youronlinechoices.eu in Europe).
• UtiBox is funded by ads, so advertising is always on, and our cookie notice says so on your first visit. In the EEA, the UK and Switzerland, Google’s consent message asks for your consent before ad cookies are used, and you can change your answer at any time with Ads & cookies at the bottom of every page. If you don’t agree, Google still shows ads that aren’t personalised.

When your browser loads an ad, Google receives the information any website request carries, such as your IP address, browser type and the page you’re on. We don’t give Google your email address or your check history. Google explains how it uses this information in How Google uses information from sites or apps that use its services.

We don’t sell your personal information. We share it only with:

• Service providers who process it for us under contract: hosting and email delivery.
• Google: Google AdSense receives your browser’s requests for ads, and Google Analytics receives the information about your visit described under Cookies, as described above. Google Public DNS receives the lookups your browser makes for the DNS propagation checker’s “From your browser” rows, as described under How we use information. On WHOIS Lookup, Google Maps draws the small map of where a website is hosted (it receives the approximate place shown). On What Is My IP, Google Maps draws the map (it receives the place shown, and your exact position only if you ask for it) and Google’s STUN server receives your browser’s WebRTC check, as described under How we use information.
• ipify: on What Is My IP, your browser asks ipify for your other address (IPv4 or IPv6), so ipify receives your IP address, as described under How we use information.
• Spam blocklists (SpamCop, UCEPROTECT, PSBL, Mailspike, DroneBL and S5H): when you open What Is My IP, our server asks each of them whether your IPv4 address is listed, which tells them the address.
• Measurement Lab (M-Lab): when you run the speed test on one of its servers, your browser connects to M-Lab directly; M-Lab receives your IP address and publishes the test with it, as described under How we use information.
• Cloudflare: its public DNS resolver receives the lookups your browser makes for the DNS propagation checker’s “From your browser” rows, as described under How we use information.
• Ahrefs: Ahrefs Web Analytics receives the visit details described under Cookies, without cookies and without storing your IP address.
• Microsoft: Microsoft Clarity receives the usage recordings described under Cookies (not in the EEA, the UK or Switzerland).
• Globalping (run by jsDelivr) and check-host.net, the free probe networks we use for regional checks on status pages. When a status page is opened, we send them the website’s address (the domain and page path, never a query string), and their probes in other countries request that site. When you pick a location under “Checked from” on the home page, the address you check is sent to Globalping the same way, so one of its probes there can run the test. When you test a port from other countries in the port scanner, we send Globalping the IP address of the host you scanned and the port, and one of its probes on each continent tries to connect to it. Apart from an address you ask us to test, which may be your own, we don’t send anything about you: no IP address or cookies.
• Authorities, when the law requires it or to protect people from harm. We push back on requests that aren’t properly made.
• A buyer or successor, if UtiBox is sold or merged. This policy would continue to protect your data.

Depending on where you live, you may have the right to access, correct, download, delete or restrict the use of your personal information, to object to some uses, and to withdraw consent. To use any of these rights:

• Ask us through the contact form (choose “Privacy & data requests”). We may need to confirm the request comes from the email address concerned.
• Turn off personalised ads in Google’s My Ad Center (in the EEA, the UK and Switzerland you can also change your answer with Ads & cookies at the bottom of any page).
• Opt out of Ahrefs Web Analytics by blocking scripts from analytics.ahrefs.com in your browser or with a content blocker.
• Opt out of Microsoft Clarity by blocking cookies and scripts from clarity.ms in your browser or with a content blocker.
• Opt out of Google Analytics with the Google Analytics opt-out browser add-on, or by blocking its cookies in your browser.
• Stop the Outage Digest with the unsubscribe link in any digest email.
• Clear what’s on your device by clearing this site’s data in your browser settings.

We’ll answer within 30 days and won’t treat you differently for using your rights. You can also complain to your local data-protection authority.

We use HTTPS, store passwords only as Argon2id hashes, keep session tokens only as one-way hashes, and record IP addresses as keyed hashes rather than in readable form (an address you ask us to scan is kept as you entered it, because it’s what you checked). Staff sign-in to our back office needs a one-time code, and staff access is limited to what each role needs. Our checkers refuse to connect to private and reserved networks. No system is perfectly secure; if a breach affects you, we’ll tell you and the relevant authorities as the law requires.

Our providers may process data in countries other than yours, including the United States. Where the law requires, we use safeguards such as the European Commission’s standard contractual clauses.

Our service isn’t directed at children under 16. If you believe a child has given us personal information, contact us and we’ll delete it.

We’ll post any changes here and update the effective date. For material changes we’ll show a notice on the site in advance.

DigiePal Networks LLC
5830 E 2nd St, Ste 7000 #26169, Casper, Wyoming 82609, US
Email: support@utibox.io

The quickest way to reach us is the contact form.