Privacy policy

IMEIs and other identifiers you enter

• Validation runs on your device. Format checks, check digits, IMEISV decoding and MEID/ESN conversion are all calculated by JavaScript in your browser.
• Model lookups send four digits. To identify a model, your browser downloads a static file containing every TAC that starts with the same four digits (for example /tacdb/…/3551.json). Our hosting provider sees that request, but never your IMEI, your serial number or even your full TAC.
• Not in URLs or history. The tools never put an IMEI in the address bar or browser history. The TAC lookup accepts an 8-digit TAC after a “#” so that links to device types work. That part of a URL is never sent to a server.
• Not stored. We don’t write identifiers to cookies, localStorage or any other storage. Results disappear when you leave or reload the page.
• Redacted by default. Results and copied reports hide the serial digits unless you choose “Show full number”.

Online status checks (only when you ask)

When online sources are connected, the checker shows their names beside an online-status checkbox. Submitting with that option enabled, or pressing “Run online check” in a report, sends your full IMEI to our server and the connected sources needed for Find My, locks, blacklist or warranty checks. If a source cannot answer a requested field, our server may try the next connected source. Turn the checkbox off for a local format and model lookup. Production connections use HTTPS.

Our application does not log request bodies or IMEIs. Successful source results are cached for up to 15 minutes under a keyed hash, with the original retrieval time preserved. The full IMEI is held in memory while a background lookup is queued or running; completed job records retain a masked identifier and are removed after ten minutes when the service next handles a job. Each provider handles the IMEI under its own privacy policy and may retain its check history. Cloudflare Turnstile protects public paid lookups. Answers you record from your own on-device checks stay in your browser and are never sent.

Independent evidence database

“Check stored evidence” sends your full IMEI to this website in a POST body. Lookup requests are not retained as device reports. Evidence is matched using a keyed hash. Private reports require the report token supplied to their owner; public lookup results include only reports explicitly authorized for publication.

Authorized collectors may submit reports with separate inspection and storage consent. Raw evidence is encrypted at rest and retained for up to 30 days from its observation time. Operational deletion runs at least hourly while the backend receives requests, or through its maintenance command. Status freshness windows are shorter, from 15 minutes to 24 hours; expired evidence never becomes a current status. To delete a report, use the report token through the deletion endpoint or contact the operator. Backups must follow the same retention period. Tokens and reports are not saved in browser storage.

Analytics

No analytics service is currently enabled. If one is added, it will only receive anonymous events filtered to exclude identifiers, and this section will name the provider.

Advertising

No ads are shown at the moment. If ads are added, this section will name the provider and explain its cookies before they go live.

Other data

• Theme preference: if you switch between light and dark mode, that choice is stored in your browser’s localStorage.
• Server logs: our hosting provider (Cloudflare Pages) may keep standard request logs (IP address, requested path, time, browser) for security and operations. Paths never contain identifiers you entered.
• External links: official services we link to (carriers, regulators, manufacturers) have their own privacy policies. We send them nothing; you visit them directly.

Contact

Data controller: [Owner to provide], [Owner to provide]. Email: [Owner to provide].