1. What an assessment stores
When you assess a domain, SecLens stores the domain name, the resulting 0–100 score, and the individual check results (SPF, DMARC, DKIM, DNSSEC, MTA-STS, DANE, TLS-RPT) together with the raw DNS evidence behind them.
A domain name identifies an organisation, not a person. Assessing a domain says nothing about who typed it in.
2. No name, no email address, no account
SecLens asks for a domain and nothing else. There is no sign-up, no login, no name field, no email field and no newsletter. The site sets no cookies and runs no analytics or tracking scripts, so there is no cookie banner and nothing to consent to.
3. Network and server data
SecLens runs on the Cloudflare network. Cloudflare is the infrastructure provider and processes connection data — your IP address, the request time and the request path — for routing, abuse prevention and service reliability. An IP address can be identifiable depending on the context it is used in; on this site it is not used to build a profile of you or to serve advertising.
On top of that, SecLens keeps its own scan audit archive. For every assessment it records the client IP address, the submitted domain, the timestamp and the outcome, so abuse and capacity problems can be investigated after the fact.
4. Public assessments are listed by default
Unless you untick it, an assessment is added to the Last assessed domains area on the homepage, where the domain and its score are visible to anyone who visits the site. That is deliberate: the corpus behind the Global Pulse figures is made of these real assessments, not a sample.
Ticking “Keep this assessment private” keeps that assessment out of the public listing and out of the published corpus. A private result is shown only to you, in that browser session; it is not retrievable later.
5. How long things are kept
Published assessments and the corpus behind the aggregate figures are kept, because the figures have to stay reproducible. A private result is shown once, in the browser session that created it, and is not kept for later retrieval. The scan audit is archived in daily partitions, and no automatic deletion runs against it. No fixed expiry period is published for any of these.