Privacy policy

IMEIs and other identifiers you enter

• Validation runs on your device. Format checks, check digits, IMEISV decoding and MEID/ESN conversion are all calculated by JavaScript in your browser.
• Model lookups send four digits. To identify a model, your browser downloads a static file containing every TAC that starts with the same four digits (for example /tacdb/…/3551.json). Our hosting provider sees that request, but never your IMEI, your serial number or even your full TAC.
• Not in URLs or history. The tools never put an IMEI in the address bar or browser history. The TAC lookup accepts an 8-digit TAC after a “#” so that links to device types work. That part of a URL is never sent to a server.
• Not stored. We don’t write identifiers to cookies, localStorage or any other storage. Results disappear when you leave or reload the page.
• Redacted by default. Results and copied reports hide the serial digits unless you choose “Show full number”.

Online status checks (only when you ask)

Where this site has a status-check provider connected, the verification report offers a “Run online check” button. Only when you press it, your full IMEI goes in an encrypted request to our server, which forwards it to that provider (named on the button) to check Find My, lock, blacklist or warranty status. Our server does not log the IMEI. Results are cached for up to 24 hours under a one-way keyed hash of the IMEI, not the IMEI itself, so a repeat check doesn’t cost another lookup. The provider handles the IMEI under its own privacy policy. A CAPTCHA (Cloudflare Turnstile) protects this feature from automated abuse. Answers you record from your own on-device checks stay in your browser and are never sent.

Independent evidence database

“Check stored evidence” sends your full IMEI to this website in a POST body. Lookup requests are not retained as device reports. Evidence is matched using a keyed hash. Private reports require the report token supplied to their owner; public lookup results include only reports explicitly authorized for publication.

Authorized collectors may submit reports with separate inspection and storage consent. Raw evidence is encrypted at rest and retained for up to 30 days from its observation time. Operational deletion runs at least hourly while the backend receives requests, or through its maintenance command. Status freshness windows are shorter, from 15 minutes to 24 hours; expired evidence never becomes a current status. To delete a report, use the report token through the deletion endpoint or contact the operator. Backups must follow the same retention period. Tokens and reports are not saved in browser storage.

Analytics

We use Google Analytics 4 (IP anonymisation on, Google signals and ad personalisation off) only after you select “Allow analytics”. We send a page view with the page path, without query strings, fragments or referrers. Enhanced measurement and tool-input tracking are disabled. You can withdraw consent using “Analytics preferences” at the bottom of any page; this stops collection and clears this site’s Google Analytics cookies. Google processes network information when analytics is allowed. Your choice is saved in localStorage.

Advertising

No ads are shown at the moment. If ads are added, this section will name the provider and explain its cookies before they go live.

Other data

• Theme preference: if you switch between light and dark mode, that choice is stored in your browser’s localStorage.
• Server logs: our hosting provider (Cloudflare Pages) may keep standard request logs (IP address, requested path, time, browser) for security and operations. Paths never contain identifiers you entered.
• External links: official services we link to (carriers, regulators, manufacturers) have their own privacy policies. We send them nothing; you visit them directly.

Contact

Data controller: [Owner to provide], [Owner to provide]. Email: [Owner to provide].