Check a domain

Privacy policy

We collect as little as the tools need to work, keep it only as long as it’s useful, and never sell it. Here is exactly what that means.

Last updated

The short version

  • If you sign up for alerts or early access, we keep your email address and what you signed up for, after you confirm it.
  • If you use Expiry Watch, we keep the domains you watch and their check results. Check history is deleted after 90 days.
  • Chart Link draws charts in your browser. The data you paste is not sent to us.
  • We don’t use tracking cookies, run ads or sell data. Our analytics are cookieless.
  • Unsubscribe or ask, and we delete your data within 30 days.

Who is responsible for your data

Boring Utils (boringutils.com) is operated by Lucas Puhl Gasperin, based in Brazil, who is the controller of the personal data described here (the “controlador” under Brazil’s LGPD). Contact for anything in this policy: hello@boringutils.com.

What we collect, why, and for how long

Email address
Collected when you sign up for Expiry Watch alerts or a plan’s early-access list, to confirm the address (double opt-in) and send what you asked for. Kept until you unsubscribe or ask us to delete it, then deleted within 30 days.
Confirmation and unsubscribe records
When and how you confirmed, to prove you asked for our email and to make unsubscribing one click. Kept as long as the email address.
Early-access choices
Which planned plan you left your email on, to tell you when it opens. Kept as long as the email address.
Watched domains
The domains you add to Expiry Watch monitoring, to check them daily and alert you. Kept until you remove them or unsubscribe, then deleted within 30 days.
Check results and history
What each check of a domain found, by you or by monitoring, to show results, spot changes and decide when to alert. Kept for 90 days.
Server logs
Created on any visit or request, to deliver the site, keep it working and stop abuse. Kept for a short period set by our hosting provider.

Check results describe the domain, not you: certificate dates, issuer and chain, whether the certificate matches the hostname, the domain’s registration expiry, and failed checks. Server logs include your IP address, browser user agent, the address requested and the time; they are processed by Cloudflare, which hosts the site.

We also keep anonymous daily counters, such as how many checks ran or how many people signed up on a given day. They contain no personal data.

What we don’t collect

  • Chart data. Chart Link’s builder runs entirely in your browser. The CSV or JSON you paste and the charts you export never leave your device.
  • Tracking cookies. We set no cookies. Our analytics use Cloudflare Web Analytics, which is cookieless and, in Cloudflare’s words, “does not collect or use your visitors’ personal data”. Cloudflare may set strictly necessary cookies to protect the site, for example after a security challenge.
  • Your theme choice (light, dark or system) is saved in your browser’s local storage, on your device only. We never receive it.
  • Payment details. Nothing is paid today, and we don’t ask for card or bank details anywhere.

How Expiry Watch checks a domain

To check a certificate, our checker opens a TLS connection to the domain on port 443, reads the certificate it presents, and closes the connection. It doesn’t fetch pages, follow redirects or connect to private networks. To check a domain’s registration expiry, we look up its public registration data over RDAP. The site you check may see our checker’s IP address in its logs.

  • Your consent for alert and early-access emails (LGPD article 7, I; GDPR article 6(1)(a)). You give it by confirming your address, and you can withdraw it at any time by unsubscribing.
  • Providing the service you asked for, such as monitoring the domains you added (LGPD article 7, V; GDPR article 6(1)(b)).
  • Legitimate interests in keeping the site secure and working, and in understanding how it’s used through anonymous counts (LGPD article 7, IX; GDPR article 6(1)(f)).

Who processes data for us

We use a few providers to run the service. Each processes data only to provide its service to us, under its own data processing terms.

Cloudflare
Hosts the website and API, stores data in its D1 database, and provides cookieless analytics. It handles all the data above, and server logs.
Resend
Sends our email: confirmations, alerts and early-access notices. It handles email addresses and the content of the emails we send you.
Hostinger
Runs the server that performs certificate checks. It handles the domains being checked and their results.

These providers may process data outside Brazil and outside the European Economic Area, including in the United States. We don’t sell personal data or share it with advertisers. We disclose it to anyone else only if the law requires us to.

Your rights

Under Brazil’s LGPD (article 18) and, if you are in the European Economic Area or the United Kingdom, the GDPR, you can ask us to:

  • confirm whether we hold data about you, and give you a copy;
  • correct data that is wrong or incomplete;
  • delete your data, or anonymize it;
  • send your data to you or another provider in a portable format;
  • tell you who we share it with;
  • stop processing it, or object to processing based on legitimate interests;
  • withdraw consent, which you can also do by unsubscribing.

To use any of these rights, email hello@boringutils.com from the address the request is about (or tell us the domain, for monitoring data). We may ask you to confirm the request from that address. We reply within 15 days.

You can also complain to a data protection authority: in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD); in the EEA or the UK, the authority where you live or work. We’d appreciate the chance to fix the problem first.

Unsubscribing and deletion

Every email we send has a one-click unsubscribe link. When you unsubscribe, or ask us to delete your data, we delete your email address, your early-access choices, your watched domains and their check history within 30 days. Deleted data can stay in our database provider’s point-in-time recovery history for a limited period, after which it is gone. Anonymous counters are not affected, because they contain nothing about you.

Security

The site and its API are served over HTTPS. Confirmation tokens are stored as hashes, access to production systems is limited to the people and services that run them, and secrets are never stored in our code. No system is perfectly secure; if we ever learn of a breach that affects your data, we will tell you and the authorities as the law requires.

Children

Boring Utils is made for adults using it for work or their own projects. It isn’t directed at children, and we don’t knowingly collect their data.

Changes to this policy

When this policy changes in substance, we update the date at the top. If a change affects how we use your email address or your watched domains, we tell confirmed subscribers by email before it takes effect. See also our terms and acceptable use policy.