What this site and this tool do with data.

1. What this website collects

This website is a static publication served by GitHub Pages. It has no server-side application, no database and no login. Two things can involve your data:

• Enquiry forms. If you submit the contact, assessment-request or acquisition form, the fields you type (name, email, optional company, optional domain, enquiry type and message) are used to read and reply to your enquiry. They are not sold, not shared for marketing, and not added to a mailing list.
• Infrastructure logs. GitHub Pages, as the hosting provider, processes standard request logs (IP address, user agent, requested URL) under its own privacy terms. The project does not receive, aggregate or analyse those logs.

There are no cookies set by this site, no localStorage keys beyond a single short-lived timestamp used to throttle duplicate form submissions, and no third-party analytics.

2. How form submissions are delivered

The site has no backend, so the forms use one of two delivery routes, and the page tells you which happened when you submit:

• Configured form endpoint. If a form endpoint is configured, the enquiry is posted directly from your browser to that provider. The provider processes it on the project's behalf and its own privacy terms apply. No database copy is kept on this website.
• Your own mail client. If no endpoint is configured, the form prepares the enquiry and opens your mail application so you can review and send it yourself. In this case nothing leaves your browser until you press send in your own email client.

Enquiries are retained in correspondence for as long as needed to answer them and to keep a record of any agreed assessment. You can ask for an enquiry to be deleted at any time by writing to myself.atiff@gmail.com.

3. The demo and recorded assessment

The demonstration page loads a static JSON file containing a genuine recorded assessment of example.com performed on 28 October 2026. It does not contact the target, and it cannot be made to contact anything else. There is no input field for a domain: the five approved domains are buttons, and the allowlist is checked again in the browser before any stored data is displayed.

4. What the sandbox tool does

The published command-line sandbox is restricted to five approved public testing domains: example.com, example.org, example.net, scanme.nmap.org and badssl.com. Any other target — including a look-alike subdomain, an IP address or an alternate port — is rejected before any network request is made.

Before a run, the operator must accept this policy and supply an identity. A consent receipt is then written locally to the machine that runs the assessment, by default at ~/.smb_scanner_lite/consent_proofs.jsonl. Receipts are chained with SHA-256; each contains a consent ID, a UTC timestamp, the operator identity, the target, the policy version and its digest, the previous receipt hash and its own hash.

During an approved run the tool performs read-only DNS queries, TLS handshakes, HTTP header reads and, where relevant, a single protocol-level reachability check against the selected approved domain. It does not authenticate, enumerate or exploit anything. Reports are written to the path you specify and are not uploaded anywhere.

5. What is not collected

• No passwords, credentials or private keys are requested or stored
• No scan results are transmitted to this website or to any third party
• No advertising identifiers, cross-site tracking or behavioural profiling
• No data is sold, rented or shared with data brokers

6. Third-party requests made by your browser

None, on a normal page view. Every asset the site needs, including its three typefaces, is served from this domain: there is no Google Fonts request, no CDN script, no embedded video, no social widget and no tracking beacon. Loading the site therefore discloses your IP address to GitHub Pages as the host, and to nobody else. If you block the font files, the site falls back to your system fonts and remains fully usable and readable.

7. Authorisation requirements

You may only assess domains you own or have explicit written permission to assess. The MIT licence on the published code governs the software; it does not grant permission to test third-party infrastructure. Requests for a private assessment must include a confirmation of ownership or authority, which is verified before any work is agreed.

8. Assessment limitations

Results are external observations of a defined control set at a point in time. They do not establish that a system is secure, that a weakness is exploitable, or that a compromise has or has not occurred. The limitations page states the boundary in full, and the report wording reflects it.

9. Your choices

You can ask what enquiry data is held about you, request a correction, or request deletion by writing to myself.atiff@gmail.com. Because the site collects so little, most requests resolve to confirming that a single email thread exists.

10. Changes to this policy

When the implementation changes, this policy changes with it, and the policy version identifier is updated. Material changes are reflected on this page with a new effective date. Consent receipts record the policy version and digest that were accepted, so an older receipt always points to the exact policy it agreed to.

11. Contact

Privacy questions: myself.atiff@gmail.com, or use the contact form. The maintainer is Muhammad Atif, Rawalpindi, Pakistan.