Found a bug?

Privacy Policy

Effective October 24, 2026

1. About this document

This Privacy Policy describes what the MainSpy site (mainspy.net) collects from its visitors, why it collects it, how long it keeps the data, and which external services receive it. The party responsible for this document is the MainSpy site administration. If you have questions about it, write to us through the contact form.

The site has no registration, no accounts, and no payments, and it never asks for your name, phone number, or postal address. There are no advertising networks on mainspy.net. The rules for using the site are set out separately in the Terms of Use.

2. What the site collects and why

Contact and bug report forms. When you send a message through the contact form or the report a bug form, the site stores the text of your message and your email address, if you choose to type one. The email address is optional. The site also records the address of the page you came from, your IP address, and your browser's user agent string. The message text and the email address let us reply; the page address and the user agent string show which tool broke in which browser. Your IP address filters out spam, because the form has a limit on messages per hour from one address. The message is stored in the site's database, and a copy is sent to the administration's mailbox through the Beget mail server. The administration's mailbox is hosted by Google (Gmail).

Server logs. The web server records your IP address, the time of the request, the requested address, the response code, and the user agent string. The application server records your IP address, the time, and the requested address. A separate application error log stores code failures. We use these logs to analyze crashes and to protect the site from brute-force attacks and automated requests.

Long-running check jobs. When a check takes longer than a second, the site creates a job that stores what you entered: a domain, a link, or an address. The result page can be opened again by its address, and the check does not run anew. In the screenshot tool, the page snapshot is stored as a separate image file, apart from the job.

Permanent QR code links. The tool stores the encoded content and the image settings only after you press the permanent link button. Until you press it, nothing is saved.

Check statistics. For the hosting check and the website scam check, the site stores the checked domain and the verdict. This data contains no information about the visitor.

Tool settings. Your theme, checkboxes, and entered settings are stored in your browser's localStorage. They stay on your device and are never sent to the server.

Tools that run in your browser. Files and text never leave your device in the metadata cleaner, the QR and barcode scanners, the converters, the generators, and the image and PDF editing tools. If you would rather not send your data anywhere, these tools are the way to use the site.

3. Visit statistics: Google Analytics

Visit statistics on mainspy.net are handled by Google Analytics 4, a Google service. It shows us how many people visit the site, which tools they open, which countries they come from, and which devices and browsers they use. According to Google, Google Analytics 4 does not record or store IP addresses; the country and city are determined by Google from the address at the moment of the request.

Advertising features in the site's code are switched off: ad data storage and ad personalization are set to “denied”, and the statistics are not used for advertising.

Visitors from the EEA, the United Kingdom, and Switzerland see a consent banner at the bottom of the page with two equal buttons, Accept and Decline. Until you press Accept, the Google Analytics script is not loaded at all and its cookies are not set. The basis for this is your consent as a visitor (GDPR, UK GDPR, and the Swiss data protection law). The country for the banner is determined from your IP address through the DB-IP Lite database on our server; for this purpose the address is not sent anywhere and is not stored.

Your choice is stored in your browser's localStorage for 12 months. You can change it at any time through the Cookie settings link in the footer of any page. If you decline after having consented, the Google Analytics cookies are deleted.

For visitors from other countries, Google Analytics loads immediately, without a banner. You can turn it off in your browser settings, with a blocking extension, or with the Google Analytics Opt-out add-on (tools.google.com/dlpage/gaoptout).

Your data is processed by Google, in part in the United States. Google LLC participates in the EU-US Data Privacy Framework. Google Analytics keeps data about visitors for 2 months, by a setting of the property.

4. Cookies

csrftoken. The site sets this cookie of its own on pages with forms. It protects form submissions from forgery and lives for one year.

mscookietest. The site sets this cookie of its own only on the cookie check page. It holds a test value and lives for 10 minutes.

reCAPTCHA. Google sets its reCAPTCHA cookies whenever a page shows the “I'm not a robot” checkbox. That happens when one check covers more than 25 addresses, on frequent requests, during link analysis, during a full-site crawl by the sitemap generator, and at the administration login. These are Google's cookies, not ours.

_ga and _ga_<ID>. These are Google Analytics cookies: they distinguish visitors and keep the session. They live for 2 years. For visitors from the EEA, the United Kingdom, and Switzerland they are set only after consent.

The site sets no other cookies of its own, and pages without forms set no cookies at all. You can turn cookies off in your browser settings, but without csrftoken the forms stop submitting.

5. Who receives your data

Google Analytics receives the visit statistics; see the section above for how it works and what it does not collect. Google reCAPTCHA receives data about your actions in the browser at the moment of the check and processes it under its own rules.

Server-side checks send what you entered to the services that have the answer:

  • name services: the server's resolvers and public resolvers;
  • IP address and network data: Team Cymru, RIPEstat;
  • spam lists: Spamhaus, Barracuda, DroneBL, PSBL, Mailspike;
  • dangerous link databases: VirusTotal, Google Web Risk, Yandex Safe Browsing, the VK link check;
  • information about Russian companies: DaData and data from the Russian tax service, in the website scam check;
  • spell checking: Yandex Speller;
  • certificate logs: crt.sh and Cert Spotter, for subdomain search;
  • availability checks: an additional check point in Dallas, USA, through a proxy.

The site you are checking also sees the request, but it comes from our server's address, not from yours.

Some tools work directly from your browser, without going through our server:

  • the screen size simulator opens the checked site in a frame, so that site sees your address;
  • the internet speed test embeds the OpenSpeedTest widget, and the measurement goes through their servers;
  • the cookie check opens a service frame from qr-scaner.ru; without it, third-party cookies cannot be tested. This domain belongs to the same administration;
  • the WebRTC leak test contacts the site's own STUN server; visitors' addresses are not written to its log.

The server is hosted by Fornex Hosting in Germany. Some of the services listed above run in other countries, including Russia and the United States. We pass data to government agencies only upon a lawful request. We do not transfer or sell your data to anyone else.

6. How long the site keeps data

  • check jobs with the addresses you entered: 24 hours;
  • page snapshots: 1 hour;
  • web server log: about two weeks;
  • application server log: about six days;
  • error log: up to three months;
  • form messages: until the administration deletes them;
  • permanent QR code links: no expiry;
  • check statistics: domains checked once — 90 days after the last check; domains checked more often, and sites with a dangerous verdict — no expiry;
  • tool settings in your browser: until you clear the site's data;
  • csrftoken: one year; mscookietest: 10 minutes;
  • Google Analytics cookies _ga and _ga_<ID>: 2 years; visitor data in Google Analytics: 2 months;
  • your choice in the consent banner: 12 months.

7. What you can do yourself

You can ask us to delete your message and the email address attached to it: write through the contact form. You can give or withdraw your consent to Google Analytics through the Cookie settings link in the footer of any page. You can manage cookies in your browser settings or with a browser extension. And if you do not want to send your data at all, use the tools that run in your browser.

8. Changes to this document

This document changes together with the site: new tools appear, and the list of services changes with them. The date of the current revision is shown at the top of the page, and we do not send separate notices about changes.