Privacy & zero data retention

What we do not keep

• Scan results — open ports, service and version banners, TLS posture, and CVE indicators are streamed to you only and never stored.
• Raw IP addresses — your connecting IP is used transiently as the scan target and rate-limit key, and is never written to durable storage in raw form.
• User-Agents — the tool or browser you used is not recorded.
• Scan history — we do not build a record of who scanned what, or when.
• Request bodies or scan payloads.

What we keep briefly

• Hashed rate-limit and abuse counters. To enforce fair use and refuse abuse, we keep counters keyed by a one-way hash of your IP address — sha256(ip + server secret). The secret (pepper) means the hash cannot be reversed to your IP or joined against any other dataset. These counters carry a short time-to-live and expire automatically; a periodic sweep also deletes any that are past expiry.
• The policy version in effect. We store the pinned text of the Acceptable Use Policy and its hash, so we can show which version was presented at a given time. This records what the policy said — never that a particular person or IP agreed to it.
• Transient job data. When a scan actually starts, a short-lived job record (including the target IP for the duration of that scan) exists in memory/Redis for at most about 120 seconds and then expires automatically. It is never persisted to disk. For a paid Full or Deep scan, the result stream it produces is held in Redis only long enough to deliver it — deleted the instant the report is first opened (single-read), and otherwise purged by an automatic 24-hour time-to-live if never opened — and never written to our database.
• Paid token record. For a paid tier we store a one-way hash of the token only, its tier, scans remaining, the subscription period, and the delivery email you bought it with — never any scan results or target IPs.

Paid scans — the retention carve-out

Free scans store nothing — that is unchanged. Full and Deep run asynchronously and must hold your result long enough to deliver it, so a paid result is stored briefly in Redis, delivered single-read (deleted the instant the report is first opened) and otherwise purged by an automatic 24-hour time-to-live if never opened. It is never written to our MySQL database, and we keep no scan history. Full returns your result at a single-read /r/{token} link that you fetch — nothing is emailed (you can cron it yourself); a Deep scan additionally emails that link to the address you bought it with — only your own IP’s results, never a third party’s. You can request deletion at any time. No scan results or target IP addresses are ever stored in a database, on any tier. See Terms for fees and Pricing for the tiers.

Consent and zero retention, reconciled

qsa.sh has no form and no checkbox — matching its one-command design. Instead, the pre-scan countdown is the consent gate: you consent by not disconnecting before it reaches zero. Pressing Ctrl-C during the countdown is a decline, and because the scan job is created only at the instant the countdown reaches zero, a decline means nothing was ever scanned.

To stay zero-retention yet defensible, we log the minimum. When a scan starts, the transient job record carries the policy version and a consent timestamp for its ≤120-second lifetime only, so the scanner knows which policy version was shown. Durably, we keep only the pinned policy text and its hash, plus an ephemeral hashed rate-limit increment — proving what the policy said and that the gate was presented. We never record that a specific IP address agreed, nor your raw IP, User-Agent, or results.

Access logs and our infrastructure

Requests reach us through Cloudflare and our Apache origin, whose standard access logs may transiently contain connection metadata such as your IP address, timestamp, requested path, and User-Agent, in the ordinary course of operating and securing the service. These are operational logs, are retained only for a short period, and are not used to build scan history or profiles. Cloudflare processes traffic as our infrastructure provider under its own terms.

Cookies and tracking

The scan flow sets no cookies. This site uses no analytics, no advertising, no third-party fonts or scripts, and no cross-site trackers — every asset is self-hosted. There is nothing to consent to and nothing following you between pages.

Opt out of scanning

If you own an IP address or range, you can permanently exclude it from ever being scanned by qsa.sh. Opt-outs are honoured before any packet is sent. See How to opt out, or send an opt-out request through our contact form.

Contact

Use our contact form for privacy questions, requests to exclude an address from scanning, or security disclosures about qsa.sh itself — choose the matching subject. We do not operate an inbound email server, so the form is the only way to reach us. qsa.sh is operated by Tuxxin.

When you submit the contact form, we attach an automated worldip.io reputation lookup of the IP address you are connecting from to the resulting support ticket. This helps us triage abuse and impersonation and is used only to handle your message; it is not published or used for any other purpose.