Privacy: what this site does and does not collect

The short version

KirkDiamond.com has no user accounts, no advertising, no third-party analytics and no behavioural tracking. The browser-only tools process what you paste on your own device. The server-side diagnostic tools necessarily receive the domain, URL or IP address you ask them to check, use it to perform that check, return the result, and do not keep the target or the result.

The site keeps anonymous aggregate counters: how many times a page or tool was used on a given day, and whether it was used from a browser, from curl or as JSON. Those counters contain no IP addresses, no user identifiers, no lookup targets, no query strings, no referrers and no user-agent strings. I count tool usage, not users.

Who runs the site

KirkDiamond.com is built and operated by me, Kirk Diamond, personally. There is no company behind it and no one else has access to the server. If you have a question about anything on this page, email [email protected].

Browser-only tools

These tools run entirely in your browser. Nothing you type or paste into them is sent to this server or anywhere else:

You can confirm this yourself: open your browser's network panel while using one of them and you will see no requests after the page loads. The HTTP status code tester is the one page in that section that does talk to the server, because its job is to fetch a status code from it; it sends only the code and delay you pick.

Server-side tools

The DNS lookup, SSL/TLS certificate checker, HTTP header and redirect checker, email deliverability checker, Domain Health checker and ASN and IP lookup have to run on a server, because they open real network connections to the thing you are checking. For these:

The target you enter is used only to perform the check you asked for.
Neither the target nor the result is written to disk, logged, or kept after the response has been sent.
There is no lookup history, for you or for me. If you close the tab, it is gone.
Result pages are marked noindex so a specific lookup never becomes a search result.

The request header checker and what is my IP tools show you your own request. They echo it back to you and keep nothing.

The request bin

The webhook tester is the one tool whose purpose is to record requests. Anything sent to a bin URL (method, path, headers, body up to 64 KB and the sender's IP address) is held in the server's memory so it can be shown in that bin's viewer. Bins expire after 15 minutes idle or 90 minutes at most, hold at most 50 requests, and are never written to disk. Anyone who knows a bin's URL can view it, so do not point production traffic at one.

The live route on the homepage

The terminal on the homepage runs a traceroute from the server back towards your address and shows the hops. Your IP address is the target of that trace. The result is cached in memory for ten minutes so a reload does not run it again, then dropped. If your route cannot be traced (for example, you are on the same network as the server), it traces to 1.1.1.1 instead and says so.

IP addresses and request metadata

Your IP address is necessarily processed while handling any HTTP request; that is how the response gets back to you. On this site it is also used, in memory only, for three things: rate limiting the server-side tools, the traceroute above, and showing it to you when you use the IP or header tools. Rate-limit state expires within ten minutes and is lost on restart. IP addresses are not written to access logs and are not part of the usage counters.

The application does not keep an access log at all. The only things it logs are start-up and shutdown messages and server errors, and an error line names the route pattern (such as GET /tools/dns), never the path values, query string, address or headers of the request that hit it. The reverse proxy in front of the application is configured not to keep access logs either.

Usage counters

To know which pages and tools are worth the effort, the site keeps a small set of daily counters. Each counter is a day, a metric, a fixed key, an interface and, for tool runs, an outcome category, plus a number. A day's worth looks like this:

2026-09-18  page_view  page.tool.tls  browser              148
2026-09-18  tool_run   tool.tls       browser  success      83
2026-09-18  tool_run   tool.tls       curl     success      41
2026-09-18  tool_run   tool.tls       json     remote_error  3

That is the entire schema. The keys come from a fixed list in the code, never from the URL you requested, so /tools/tls?host=example.com increments tool.tls and nothing about example.com is recorded. The interface is worked out from the request and then discarded; only the word browser, curl, json or text is kept. Outcomes are one of six fixed categories such as success, validation_error or remote_timeout, never an error message that might name a target.

The counters cannot tell one visitor from another, cannot be combined into a session or a journey, and contain nothing that could identify you. They are stored in a single file on the server and are the only thing about site usage that persists. The test suite includes checks that send unique IP addresses, user agents, referrers and lookup targets through the site and then assert that none of them appear in the counter store.

Cookies and browser storage

The site sets no cookies. It uses no analytics or advertising cookies, no tracking pixels, and no persistent identifier of any kind in your browser. There is no consent banner because there is nothing to consent to.

One small exception, which you control: if you use the Mastodon option in the share panel, the instance name you type is remembered in your browser's localStorage under the key kd.masto so you do not have to type it again. It never leaves your browser and you can clear it like any other site data.

Third parties your browser or the server may contact

Performing a network check means talking to other systems. That is the point of the tool, and it is worth being clear about who receives what.

The systems you ask about. The TLS checker opens a TLS connection to the host you name. The HTTP checker fetches the URL you give it and follows its redirects. The mail checker connects to the domain's MX hosts and asks for STARTTLS. Those servers see a connection from this site's server, not from you.
DNS resolvers. DNS queries go to the public resolver you choose (Cloudflare, Google, Quad9 or one you enter) or to Cloudflare's 1.1.1.1 by default. The resolver sees the name being looked up and this server's address.
Team Cymru and the regional internet registries. The ASN lookup uses Team Cymru's DNS-based IP-to-ASN service and the registry RDAP service (via rdap.org) to describe an address. They see the address being looked up.
Google Fonts. The typefaces are loaded by your browser from fonts.googleapis.com and fonts.gstatic.com. Google therefore sees your IP address and the ordinary request headers for those font files, as with any site that uses Google Fonts. Google's own privacy policy applies to that request.
Share links. The share panel offers links to Hacker News, Reddit, Lobsters, Bluesky, Mastodon, X and LinkedIn, and a Buy Me a Coffee link. Nothing is contacted until you click one; when you do, you are on that site and its terms apply.

Nothing on this site is loaded from an advertising network, a tag manager or an analytics provider.

What is kept, and for how long

Data	Retention
Lookup targets and results	Not retained. Used for the request, then gone.
Visitor IP addresses	Not logged. Held in memory for rate limiting for up to ten minutes; in the traceroute cache for ten minutes.
Request bin contents	In memory only, 15 minutes idle or 90 minutes maximum.
Access logs	None kept.
Aggregate daily counters	Kept long term. They contain no personal data.
Email you send me	Kept in my mailbox for as long as the conversation is useful.

External links

Guides and tool pages link to specifications, vendor documentation and other sites. Those sites have their own privacy practices, and this page does not cover them.

Changes

If the site starts doing something this page does not describe, for example saved checks or accounts, this page will change first and the date at the top will move. Until then, everything above is the whole story.

Contact

Questions, corrections or concerns: [email protected]. Security reports have their own page at /security.

Privacy: I don't want your data.