Legal & privacy

This site sets no cookies, runs no analytics and loads nothing from other companies. Each service keeps as little as it needs. This page lists all of it.

Who

Service provider: Harry Seeger, trading as little jamjar, The Barn, Bexfields Farm, Galleywood Road, Chelmsford CM2 8BY
Data controller: little jamjar (sole trader), United Kingdom
Contact: hello@littlejamjar.com
ICO: ICO registration ZC276385
Governing law: Engagement terms are governed by the law of England and Wales.

This website

Delivery: Pages are served from our own server in the UK through Cloudflare, which handles every request on our behalf and so sees your connection address.
Server logs: Your connection address, the page, the time and your browser's name, kept for 14 days to run and protect the service, then deleted.
Not used: No cookies, no analytics, no scripts, no fonts or images from anyone else.

Website & email health check

What you give us: The domain you type in.
What we look at: From the outside only: that domain's public settings (its DNS records), its padlock certificate (TLS), the headers of its home page, five fixed paths and /.well-known/security.txt.
The result: Kept under an unguessable address that is not indexed, for 30 days, then deleted. No list of checked domains is published.
24-hour reuse: A domain's result is reused for 24 hours: anyone who checks the same domain within a day is sent to the same result page instead of a new check. The result holds only what the domain shows publicly, never who asked.
Rate limits: A one-way hash of your connection address, with the domain and the time, for one day. The service's own log lines (time, that hash, the domain) are kept for 14 days.
Why: To give you the check you asked for and to stop the tool being misused (our legitimate interests).

Asking us to fix something

What we keep: Your name, how to reply (email or phone), the domain, the finding, your message, the time, your country as Cloudflare reports it and the same one-way hash. A notification with the same text goes to our phone through our own notification server.
How long: Up to 183 days, then deleted.
Why: To answer you and quote for the work you asked about (steps you asked for before any contract).

DMARC monitoring

Waitlist: If you email us to join, your email (address, the domain you mention and what you write) stays in our mailbox to tell you when monitoring opens. Deleted when you ask, when you have started or said no, and in any case within 12 months of your email.
Reports, once you start: DMARC aggregate reports that mail providers send to the reporting address you add to your DNS: the reporting organisation, sending addresses, message counts, and pass and fail results. They contain no message content.
How long: Raw reports 90 days; the parsed figures 13 months; then deleted.
Who sees them: You, through your private link; us, to run the service. Reports are received through Cloudflare and processed on our own server in the UK.

Expiry watch

What you give us: Your email address and up to five domains, and your agreement to the sign-up wording (we keep the time and which version of the wording you saw).
What we look at: Once a day, from the outside: each domain's padlock certificate (the TLS certificate on port 443: its expiry date and issuer) and the registration expiry date its registry publishes (through RDAP). Where a registry publishes no expiry date we record that, and say so, rather than guess.
When we write: Only when something is due: 7, 3 and 1 days before a certificate expires, 30, 14, 7 and 1 days before a registration does, and once if either passes. At most one email a day, covering all your domains. These are service messages; they carry no marketing.
What we keep: Your email address, your domains, the latest check results for each, which reminders have been sent, the consent record, and a short log of what happened to your sign-up (signed up, confirmed, domains added or removed, reminders sent).
Rate limits: A one-way hash of your connection address, and a one-way hash of the email address, with the time, for 24 hours, so the form cannot be used to flood anyone's inbox.
Why: To send you the expiry reminders you asked for. The lawful basis is your consent, which you can withdraw at any time with the link in every email.
How long: Until you unsubscribe. A sign-up that is not confirmed within 7 days is deleted. The activity log is kept for 90 days. The service's own log lines (time, the connection-address hash, the domains checked) are kept for 14 days, like the server logs above.
Sending the emails: Emails are sent through our existing email provider, Proton, which already handles little jamjar's own email. It receives your email address and the content of each message in order to deliver it. No other company is involved in sending them.
Unsubscribing: Every email has a manage link and an unsubscribe link (and the one-click unsubscribe that mail apps show). Unsubscribing deletes your email address, your domains, their check results, your consent record and your activity log immediately; only an anonymous count that someone unsubscribed remains.

Your rights

Ask at any time what we hold about you or your domain, and have it corrected or deleted. Write to hello@littlejamjar.com. If you are not happy with our answer you can complain to the Information Commissioner's Office.