Privacy

CheckPQC provides reference material, a browser-connection check and free public-domain scans. These work differently:

Readiness worksheet and evidence downloads

Worksheet entries and imported files are processed in your browser and are not uploaded to CheckPQC. Entries remain in tab memory until you explicitly save them in browser storage or download a file. Saved copies persist until you choose Forget browser copy or clear this site’s browser data. They are not encrypted by this page and may be accessible to others using your browser profile. Downloads remain on your device until you remove them. Search and check-selector inputs stay on the page and are not stored or sent to a search service.

Evidence reports are generated in the browser from the result already displayed. Exporting makes no additional request to CheckPQC. Reports can contain target hostnames and timestamps; review them before sharing.

Local reference scripts

Scripts run on your machine. They do not send your targets or results to CheckPQC. They connect directly to the endpoint you select, which can observe your IP address and handshake. Your network or endpoint may log that activity. Downloading a script is a normal website request.

Browser connection check

On checkpqc.com, the banner automatically checks a connection from your browser to checkpqc.app. It sends no cookies or page referrer with that check. It describes that separate connection, not the connection to this site's hosting provider. Dismissing the banner does not store a preference; reloading restores it.

The check reports the TLS protocol, cipher and negotiated group observed by our TLS terminator for that request. The response does not contain your IP address. It does not inspect other tabs, apps, private keys or device contents.

Free domain scans

The website sends the hostname to our backend, which resolves it and attempts TLS handshakes from our server. Targets see the scanner's network address. Results are temporarily cached in process memory for up to ten minutes and can be returned to other visitors requesting the same hostname. Do not submit confidential hostnames. No account or persistent scan-history feature is provided.

Contact form

The contact form asks for a reply email address, a topic and a message; your name is optional. These details are sent only when you submit the form, then forwarded through our email provider to a private mailbox so we can handle your request and reply. We do not publish your address, accept attachments or send automatic replies. Do not include passwords, private keys or other secrets.

The contact handler does not add your message, name, reply address, IP address or browser user agent to application logs. It uses temporary request metadata for abuse prevention. Older contact records and backups may still exist. We have not established a fixed deletion period for the private mailbox and its backups; use the privacy request form to ask about or request deletion of a submission.

Website operation

Web-server and application logs can contain request metadata such as IP addresses, paths, timestamps, errors and submitted target information. They support operation and abuse prevention; this is not an anonymous service. For the .app server, the journal is configured for a maximum age of seven days, with size limits that can remove entries sooner. Its Nginx log policy rotates nonempty logs daily and retains fourteen rotated files; this is a rotation count, not a guaranteed fourteen-day deletion deadline. The .com hosting provider manages its own platform logs; we have not verified a fixed deletion period for those logs. These settings were inspected on 25 September 2026. The public pages do not add advertising trackers, analytics SDKs or account cookies.

Questions

Use the privacy contact form for questions about your information. Never send private keys, passwords or unredacted diagnostic dumps.