Privacy policy

LockFib has no accounts, trackers or ads, and it sets no cookies. Your data still passes through in a few places, so here is where it goes and how long it lasts.

Who we are

LockFib is made by Mac, in Columbus, Ohio. Questions about this policy go to privacy@lockfib.com. If you write, we keep your message and address until we’ve finished with them, then delete them.

Cloudflare holds our lock

Yes, we see the joke. A site that asks who changed your lock had its own changed, on purpose, and you should hear that from us. Put a site behind Cloudflare and, as its own documentation describes, there are two connections: “one between your visitors and Cloudflare,” and another from Cloudflare to the site. Your secure connection to lockfib.com ends at Cloudflare, which presents the certificate and can read everything you send us: your address, the pages you ask for, the websites you type into the box and the fingerprints you paste.

We chose it because of floods. We run on one shared server, and a flood of traffic can take this site down. Cloudflare describes its flood protection as “unmetered and unlimited” on all plans, and we use the free one. A free tool has no budget for anything better, so we traded a stranger’s view of your visit for a site that stays up.

Your checks don’t run at Cloudflare. Our server fetches each certificate itself, from its own address. If you check lockfib.com, though, you’ll see the certificate Cloudflare presents for us, because that’s the lock we handed over.

Cloudflare’s privacy policy says it handles visitors’ “IP addresses, traffic routing data, system configuration information” for its customers. It gives no period for keeping that data, so we can’t promise you one. We leave its analytics and bot scripts off. It can still put a challenge in front of traffic it distrusts, and its cookie list includes one for those challenges, cf_clearance. Cloudflare would set that cookie; we set none.

What our host logs

Hawk Host runs our server, and the server logs each request: the address it arrived from, which can be your own or one at Cloudflare, the time, the page, and what your browser says it is. We don’t archive those logs, and we read them only to keep the site running and to stop abuse. Hawk Host’s privacy policy gives no period for keeping logs, so we can’t promise you one.

The website you type into our box stays out of those logs. It travels in the body of the request, and the log records only the page it was sent to.

What we read and drop

On every page load we look through your request for headers that proxies add, set aside the ones Cloudflare adds, then show you the result. We keep neither the headers nor any address they name. The fingerprint you paste is compared and forgotten. Your result travels inside the page as a signed form, so your browser holds the only copy.

What happens when you check a website

• The website. Our server connects to it, fetches its certificate and asks once for its headers. It sees our address and the name LockFib, not you.
• The name lookup. Our host’s name server looks up the website for us.
• hstspreload.org. The HSTS row asks this tool, part of how Chrome maintains its preload list, unless we can settle the answer ourselves. Our server sends it the domain name and nothing about you. Its page links to no privacy policy.
• Two counters. We allow 30 checks per address and 30 per website every 10 minutes. Each count is stored under a hash of the address or domain, salted with a value that changes daily, and the first check of each new UTC day wipes them all. A hash is no vault: anyone holding the server that day could test addresses against it.
• The preload answer. We store hstspreload.org’s answer under a keyed hash of the domain and use it for up to 7 days. An expired file can sit on the server until a later cleanup removes it. No visitor address goes in it.

Who else can see

Anything reading your connection can read this site too, including the websites you type into the box. We can’t fix that from here, and it’s why the site exists.

Hawk Host’s policy lists “A law enforcement or regulatory agency at their request” among those who can receive what it holds. Cloudflare’s says it discloses personal information “to respond to subpoenas, court orders, or legal process.” Hawk Host can also read our traffic, since our server runs on its machine. An order served on us reaches what this page describes, and that’s all we have.

Your rights

We don’t sell your data or share it for advertising. We use it to run the checks and to stop abuse, which is our legal basis where EU or UK law applies. To see or delete anything about you, or to object, write to us; you can also complain to your data protection authority. We have no way to look you up in the counters, and for host logs we’d need the address and time from you.

We ask nobody’s name or age, so we can’t tell a child from an adult.

Changes

When what we do changes, this page changes with it. Last changed November 1, 2026.