Privacy Policy

Effective September 27, 2026. IframeTester.net is maintained by Shay from the United States. For privacy questions or requests, email hello@iframetester.net.

Information involved in a URL test

When you run a server-side check, your browser sends the URL you enter and any optional embedding-site origin to IframeTester.net. The server requests the public destination, follows a limited number of redirects and reads its response status and framing-related headers. It does not return the destination page body as a proxy. Results may include the final URL and relevant response headers.

Diagnostic results may be cached in memory or Cloudflare edge caches for up to two minutes to reduce repeat requests. Robots.txt rules may be cached for up to five minutes for a selected User-Agent. Cache keys are hashed and cached diagnostics are not publicly exposed. The URL and optional origin are also part of the check request and may appear in browser history, network tools, hosting or security logs. A copied result link includes the tested URL; only share it if that URL is safe to disclose. Do not test private links, passwords, access tokens or sensitive query strings.

The crawler tester also sends the public URL you enter to our server. It checks robots.txt for the selected profile before requesting the page. When permitted, it compares a browser User-Agent request with a selected crawler User-Agent request, reading a bounded portion of HTML and returning only limited response metadata. The destination receives requests from our server, not from the named crawler. Its logs and privacy practices apply.

Browser previews and other tools

When you choose to load a live iframe preview, your browser connects directly to the destination website. That website can receive the usual request information, such as your IP address, browser details and, depending on the preview mode and browser policy, referrer or cookie information. Its own privacy practices apply. Restricted preview adds a sandbox and removes the referrer, but may change how the page works.

The embed-code tester parses pasted HTML in your browser and does not submit that code to our server. The generator, sandbox tester and CSP builder also create or analyze their output in your browser. Loading a preview from one of these tools still connects your browser to the destination you choose. Copying output places it on your device clipboard.

Hosting, security and analytics

Our hosting and security providers, including Cloudflare when the site is deployed there, may process technical request data such as IP address, request time, browser information, path, query string and security signals to deliver pages, prevent abuse and diagnose failures. We use rate limits to protect the diagnostic tools and contact form. The tools set a first-party anonymous browser identifier cookie named it_visitor, lasting up to 30 days, and use hashed IP identifiers for network safeguards. Local storage holds the last displayed allowance and reset time. These are used to operate abuse protection and display remaining checks; we do not collect a device fingerprint. Clearing these identifiers can reset the displayed browser identity but does not remove network safeguards. We do not use tested URLs for advertising or sell them.

Google Analytics 4 loads automatically on regular pages to measure visits and tool interactions. Google may receive technical information about your browser and use analytics cookies. We do not put the tested URL in analytics events, and we do not load the tag on pages opened with a shared test URL. You can limit analytics through your browser's cookie and tracking settings. A separate Google Tag Manager integration is inactive unless configured.

Contact messages

You can email hello@iframetester.net or submit the contact form. The form sends the name, email address and message you provide to Cloudflare Email Service, which delivers it to our verified Gmail inbox so we can respond. The email address you enter is used as the reply address. Our email providers process correspondence under their own policies. Do not include passwords, private URLs or other sensitive information in your message.

Why we process information and how long it remains

We use technical request information to provide the tools, protect the service, troubleshoot errors and respond to requests. The diagnostic cache expires after two minutes; diagnostic rate-limit records are removed after an hour of inactivity. Other security-record retention depends on the endpoint and hosting configuration. Hosting and security logs are kept according to the deployment settings and are reviewed for the shortest practical period needed for reliability and abuse prevention. Contact correspondence is kept while needed to handle the request and for any necessary recordkeeping, then removed when no longer needed.

Cloudflare and other service providers may process information outside your country. We apply reasonable access controls and use providers needed to operate the site, but no internet transmission can be guaranteed completely secure.

Your choices and requests

You may choose not to run a URL test or load a third-party preview. You can clear a shared test URL from your browser history and avoid including sensitive information in a contact message. To ask about access, correction or deletion of personal information we hold, email hello@iframetester.net. We will handle requests under applicable law; some records may need to be retained for security or legal reasons. You may also contact the privacy regulator that applies where you live.

Changes to this policy

We will update this page and its effective date when our practices materially change, including if new analytics, advertising or contact providers are enabled.