Privacy

Effective 13 October 2026.

Who we are

postquantum.report is an independent project. For anything about your data, write to [email protected].

What we collect

• Domains you scan, and what our scanner finds on their public HTTPS endpoints. Results pages are reachable by anyone with the link and are never indexed by search engines.
• Your email address and your answers, only if you ask for an answer pack, a full scan or to watch a domain. We use them to deliver what you asked for and, if you opt in later, the emails you chose.
• Anonymous visit statistics: the page, the referring site, campaign tags, your country and your device type (mobile, tablet or desktop). We count unique visitors with a code made from your IP address and browser that changes every day and can't be linked across days. We never store IP addresses or browser user agents.

We set no cookies except what the site strictly needs, use no browser storage for tracking, and load no third-party analytics or advertising scripts. If you arrived from an ad, we may tell that ad platform, server to server, that a scan or verification happened, using only the platform's click ID: never your email address.

Why

To deliver the service you asked for: scanning a domain, and building and emailing your answer pack, your full scan report or your change alerts.

How long we keep it

• Scans that no pack uses: 90 days. Scans a pack uses: as long as the pack exists.
• Your email address and packs: until you delete them, or 24 months without activity.
• Visit statistics and scan requests: 13 months. Ad click IDs: 90 days.
• Server logs: 30 days. Error reports: 90 days after the error was last seen.
• Backups of the database: 14 days.

Your choices

• Delete your data any time at /delete: we email you a link that removes your address, your packs and their buyer links.
• Stop emails with the link at the bottom of any email we send.
• Domain owners can opt their domain out of scanning; see /scanner.
• Every email we send says why you got it. We send no marketing.

Where it's stored

The application and its database run on Fly.io in the United States (Ashburn, Virginia). Cloudflare sits in front of the site and handles our incoming email; Resend sends our emails. Each processes data only to provide those services.

Changes

We'll date any change to this page.