Privacy & zero data retention

What we do not keep

• Scan results — open ports, service and version banners, TLS posture, and CVE indicators are streamed to you only and never stored.
• Raw IP addresses — your connecting IP is used transiently as the scan target and rate-limit key, and is never written to durable storage in raw form.
• User-Agents — the tool or browser you used is not recorded.
• Scan history — we do not build a record of who scanned what, or when.
• Request bodies or scan payloads.

What we keep briefly

• Hashed rate-limit and abuse counters. To enforce fair use and refuse abuse, we keep counters keyed by a one-way hash of your IP address — sha256(ip + server secret). The secret (pepper) means the hash cannot be reversed to your IP or joined against any other dataset. These counters carry a short time-to-live and expire automatically; a periodic sweep also deletes any that are past expiry.
• The policy version in effect. We store the pinned text of the Acceptable Use Policy and its hash, so we can show which version was presented at a given time. This records what the policy said — never that a particular person or IP agreed to it.
• Transient job data. When a scan actually starts, a short-lived job record (including the target IP for the duration of that scan) exists in memory/Redis for at most about 120 seconds and then expires automatically. It is never persisted to disk. For a paid Full or Deep scan, the result stream it produces is held in Redis only long enough to deliver it — deleted the instant the report is first opened (single-read), and otherwise purged by an automatic 24-hour time-to-live if never opened — and never written to our database.
• Paid token record. For a paid tier we store a one-way hash of the token only, its tier, scans remaining, the subscription period, and the delivery email you bought it with — never any scan results or target IPs.

Paid scans — the retention carve-out

Free scans store nothing — that is unchanged. Full and Deep run asynchronously and must hold your result long enough to deliver it, so a paid result is stored briefly in Redis, delivered single-read (deleted the instant the report is first opened) and otherwise purged by an automatic 24-hour time-to-live if never opened. It is never written to our MySQL database, and we keep no scan history. Full returns your result at a single-read /r/{token} link that you fetch — nothing is emailed (you can cron it yourself); a Deep scan additionally emails that link to the address you bought it with — only your own IP’s results, never a third party’s. You can request deletion at any time. No scan results or target IP addresses are ever stored in a database, on any tier. See Terms for fees and Pricing for the tiers.

Consent and zero retention, reconciled

qsa.sh has no form and no checkbox — matching its one-command design. Instead, the pre-scan countdown is the consent gate: you consent by not disconnecting before it reaches zero. Pressing Ctrl-C during the countdown is a decline, and because the scan job is created only at the instant the countdown reaches zero, a decline means nothing was ever scanned.

To stay zero-retention yet defensible, we log the minimum. When a scan starts, the transient job record carries the policy version and a consent timestamp for its ≤120-second lifetime only, so the scanner knows which policy version was shown. Durably, we keep only the pinned policy text and its hash, plus an ephemeral hashed rate-limit increment — proving what the policy said and that the gate was presented. We never record that a specific IP address agreed, nor your raw IP, User-Agent, or results.

Access logs and our infrastructure

Requests reach us through Cloudflare and our Apache origin, whose standard access logs may transiently contain connection metadata such as your IP address, timestamp, requested path, and User-Agent, in the ordinary course of operating and securing the service. These are operational logs, are retained only for a short period, and are not used to build scan history or profiles. Cloudflare processes traffic as our infrastructure provider under its own terms.

Cookies and tracking

The scan flow sets no cookies. Running curl qsa.sh, or loading this site as a visitor, stores nothing on your device. The only cookie we ever set is a session cookie (PHPSESSID), and only on the pages that genuinely need one — signing in, your account, the admin area, and the contact form, where it carries the anti-forgery token. It is not used for tracking and is never set on the marketing, pricing, legal or news pages.

We do measure traffic, and we do it without cookies. Four things run on this site:

• Umami, on our own analytics.tuxxin.com — cookieless, no cross-site identifiers, aggregate page counts only.
• Google Analytics 4 — only if you accept it. It is off by default and nothing is downloaded from Google unless you choose “Accept” on the banner. If you do, it runs cookieless: we load it with Google Consent Mode set to deny analytics storage, so it writes no _ga cookies and uses no browser storage at all, and advertising, remarketing and cross-device signals are switched off. Because it stores no identifier, it cannot recognise you on a later visit or link your visits together.
• Cloudflare Web Analytics, added at our CDN edge — cookieless by design.
• The Tuxxin Suite badge, a small navigation dock loaded from tuxxin.com, and our product video, served from media.tuxxin.com. Both are our own infrastructure, not an ad or tracking network.

Cookieless is not the same as nothing leaving your browser, and we would rather say so than imply otherwise. That is exactly why Google Analytics is opt-in here: when the tag runs, Google receives the request — including your IP address, which it uses to derive an approximate location and then discards — acting as a data processor for us. Rather than ask you to take that on trust, we simply do not load it unless you say yes.

Your choice, and how to change it. On your first visit we ask once whether to load Google Analytics. Declining is a single click and is exactly as easy as accepting, and if you ignore the banner or never answer, that counts as a no and nothing loads. We store your answer in your browser’s local storage — not in a cookie, and it is never sent to our server. You can change your mind at any time:

Change your analytics choice

Clearing this site’s browser storage also clears the choice, and we will ask again.

If you accepted analytics and then buy a Full or Deep scan, the payment confirmation page reports the transaction reference, amount and currency to Google Analytics as a purchase event, so we can tell which pages lead to sales. If you declined, that event does not fire either. That reference is the payment processor's order id. Your name, email and card details are never sent to Google — and we never see your card details at all, because PayPal handles them.

There is no advertising on this site, no cross-site tracking, and no profile built about you.

Opt out of scanning

If you own an IP address or range, you can permanently exclude it from ever being scanned by qsa.sh. Opt-outs are honoured before any packet is sent. See How to opt out, or send an opt-out request through our contact form.

Contact

Use our contact form for privacy questions, requests to exclude an address from scanning, or security disclosures about qsa.sh itself — choose the matching subject. We do not operate an inbound email server, so the form is the only way to reach us. qsa.sh is operated by Tuxxin.

When you submit the contact form, we attach an automated worldip.io reputation lookup of the IP address you are connecting from to the resulting support ticket. This helps us triage abuse and impersonation and is used only to handle your message; it is not published or used for any other purpose.