What we store — and what we do not

Kangarua is built to know as little about you as possible. This is the complete list of what we keep, why, and for how long — in plain language, with no small print.

The free scanner: we store no scans

When you scan a domain, we look live at what is published in DNS. The result is not stored: there is no database of scanned domains, and we publish no list either.

Two caveats, for completeness. A scan result stays in a temporary server cache for up to fifteen minutes, so a shared link loads quickly without triggering a fresh scan every time — after that it is gone. And we count anonymously how many scans happen and how the outcomes are distributed, without the domain name: that count cannot tell you who scanned what.

We use your IP address only to slow down abuse (a limit on the number of requests per minute). We build no profile from it and keep no log of it.

Legal basis: legitimate interest — keeping a free, public service running and safe.

The send test: seven days, never the content

If you send us a test message, we keep the subject, the sender address, the IP address of the sending server and our assessment. The subject and sender are only there so you recognise your own test; the rest *is* the result.

We do not keep the content of your message: it is assessed and discarded immediately. Our own test suite contains a check that fails the moment the content would end up in the database after all.

Everything from a send test is deleted automatically after seven days.

Legal basis: carrying out your request — you start the test and send the message.

DMARC reports: thirteen months

If you enrol your domain for report reception, receivers such as Google and Microsoft send us reports about mail impersonating your domain. Those reports contain no message content and no addresses of your customers: they are counts per sending server — that server's IP address, the name of the reporting organisation, the sender domain, and whether the checks passed.

We keep those counts, and the raw report file as the receiver sent it, for 400 days (roughly thirteen months). That way you can look back over a full year, with a month to spare. After that everything is deleted automatically.

Legal basis: carrying out your request — you enrol your domain and publish the record that sends the reports to us.

Your email address: only if you leave it yourself

When enrolling for report reception you may leave an email address. We use it to send you the report link again if you lose it; notifications on a new report are in the works. The field may stay empty, the address is never passed on and never used for advertising, and it is kept for as long as your enrolment runs.

Legal basis: carrying out your request.

We never ask for a key to your DNS

We have no access to your DNS and do not ask for any. If you want a record set, that happens with one confirmation at your own DNS provider — the change happens there, in your account, and we get no access at all in the process.

Cookies and local storage: no tracking, so no banner

There are no tracking cookies, no advertising and no third-party measurement scripts — which is why you see no cookie banner here. The site does remember two things in your own browser's local storage: your previous score per domain (so you can see what a fix achieved) and your choice of technical view. That data never leaves your browser and you clear it yourself through your browser settings.

Where this runs

The site and the storage run on Cloudflare (Workers, D1 and R2). Cloudflare acts as a processor, within the safeguards of its data processing agreement with standard contractual clauses for transfers outside the EU.

Your rights

You may request access to what we keep about you, have it corrected or have it deleted. Email help@kangarua.net — a human reads it, and you get an answer within the statutory period of one month at the latest.

Data controller: Versea, company number BE0666567667, Kelbergenstraat 91, 3290 Diest, Belgium. If you are not satisfied with our answer, you can turn to the Belgian Data Protection Authority.

Last updated: 1 September 2026.