Privacy policy
Controller
Kevin Feiler Einzelunternehmen, trading as Trayyce, represented by Kevin Feiler, Königstraße 5, 70173 Stuttgart, Germany. Email: info@ddevelopment.de, phone: +49 711 25267505.
Visiting the website
Trayyce runs on a server we rent from a data centre operator in Germany. Requests to trayyce.io first reach Cloudflare (Cloudflare, Inc., USA). Cloudflare answers the DNS queries, accepts the encrypted connection and passes the request through a tunnel to our server. In doing so, Cloudflare processes your IP address and the content of the request. Cloudflare also asks your browser to report failed connections (Network Error Logging).
Cloudflare bases transfers to the USA on its certification under the EU-U.S. Data Privacy Framework; its data processing addendum also incorporates the EU Standard Contractual Clauses.
Our web server logs the time, the requested address, status code, amount of data transferred, the previous page (referrer) and the browser identifier, but no IP address. The application logs errors and operating messages without IP addresses. We delete logs after 14 days.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is operating the website securely and reliably.
Checking an address
When you check an address, we store the address you entered, the language, the time and the result. Our checker fetches the address from our server: a few GET requests, one request to /.well-known/security.txt, individual TLS connections and DNS lookups via Cloudflare's public resolvers. The operator of the checked website sees our server's IP address and the identifier “Trayyce/1 (+https://trayyce.io)”, not your data.
The report contains what the checked website's server sends publicly: redirects, headers (cookie values shortened), certificate, the server's IP address, detected software and DNS records. We store it for 30 days. Exception: if a home page is graded below B, we keep the first report of that run until a check results in grade B or better, and for 30 days after that, at most one year from the check. This lets the ranking show since when the website has been below B. Anyone with the link can read it. If someone checks the same address again within ten minutes, they get the same report. If the check produces a grade, we add the website to the provider directory (section “Provider directory and automatic checks”). Only a report on the website's home page is linked there, never one on a subpage that was entered.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is carrying out the requested check and informing about publicly visible security settings.
Technical key data per address
For every checked host we store the grade, hosting provider, CDN, DNS and mail provider, server and server language, CMS and libraries with versions, certificate issuer, notes on flaws found, and the time and number of checks. Only we as the operator see this list. We use it to offer operators of websites with flaws help with fixing them, and for the hosting overview, which only shows aggregated values per network operator.
We delete this data twelve months after the last check. If a website is checked automatically on a regular basis (see provider directory), the period restarts with every check.
The legal basis is Art. 6(1)(f) GDPR. The data is publicly available; our legitimate interest is making security flaws visible and offering help. You can object via the “Delete data” page.
Provider directory and automatic checks
The provider directory lists companies and other websites with their website's grade. We find new entries automatically in public sources: the company directories DBpedia and Wikidata, OpenStreetMap (shops, restaurants, trades and offices that list a website there), news articles and results of our own research. We also add websites that someone checks with the public website check on trayyce.io; checks from the customer area are not added. This includes the search in the ranking: if it does not find a domain, the domain can be checked there. A website is added as soon as its check produces a grade; subdomains, checks without following redirects and websites that redirect to another domain are not added. If the address checked was a subpage, we also check the home page; only the report on the home page is linked. These entries appear under “Other websites”, their name is the domain, and the entry does not record who checked or searched. For each entry we store the name, website, source, category and the time it was added, but no postal address, phone number, email address or contact person.
We check each entry's website automatically as described above and then again at regular intervals, currently every 14 days; if it was temporarily unreachable, after 24 hours. If it redirects to its variant with or without www, we check that variant too. The directory publicly shows the name, website, category, source, grade with audit date and a link to the report, plus the number of known data breaches for the domain from the public Have I Been Pwned list.
Directory entries have no fixed deletion period. They disappear as soon as the domain objects via “Delete data” or we hide the entry. After an objection we no longer check the website automatically.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a market overview that makes providers comparable by the security of their website. The data comes from public sources or from checks someone requested on trayyce.io. If a company name or a domain is also your own name, you can object at any time.
Deleting data about a domain
On the “Delete data” page you prove with a DNS record or a file on your website that you manage the domain. We look up the DNS record via Cloudflare's DNS service. We then immediately delete the reports, the technical key data and the usage statistics entries for the domain, remove it from the provider directory and stop checking it automatically. We keep the objection itself (domain and time) without a time limit so that it stays effective.
Without proof, you can send the request by email to info@ddevelopment.de; we handle it manually. The request form on the page needs email delivery, which is not set up yet. Once it is: we store the domain, email address and message and send a confirmation link. Unconfirmed requests are deleted after 7 days, confirmed ones are kept until the decision, and handled ones are deleted 30 days after the decision. We keep the decision itself (domain, time, kind) for three years, without the email address.
The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 17 and 21 GDPR.
Privacy check with a code (trayyce.io/d)
Our partner Closing-Empire (Closing-Empire GbR, Franz-Wieman-Straße 42, 24537 Neumünster, Germany) may give you a QR code or a code to type in at your front door. With it you open a check on trayyce.io/d where you search for your own data and prepare removal requests. The controller for this check is the operator of Trayyce named above. When creating the code, Closing-Empire sends us only the desired language, no details about you, your house or your address.
When you start, you get your own link; the code from the door no longer opens anything. A code that is never started expires after 24 hours. You then enter what you choose: at most three email addresses, three phone numbers and two postal addresses, plus your name if you like, which serves as the signature under the requests and as a search term in the search links. We store these details, which providers you tick off as “sent”, the language, the state and timestamps. Details and ticks are stored encrypted. We derive the key from your link and the device cookie (next paragraph) and do not store it; without both the stored details cannot be read, not even by us. While you use the page, our server processes them in memory. We store the link, the code and the device cookie only as checksums.
When you first open trayyce.io/d or a code, the page sets a single cookie, “ty_tuer_geraet”. It contains a random value with no relation to you. When you start, it ties the case to the browser in which it was started; in any other browser the case does not open, not even with the link. If someone else started the code and gave you the link, it therefore does not open for you, and you see a warning. So start the check yourself on your own device. The cookie only applies to trayyce.io/d and cannot be read by scripts on the page (HttpOnly). It is only sent encrypted (Secure), and from other sites only when you open a link, not with forms or background requests (SameSite=Lax). Without a start it expires after one day, after the start 90 days after its last use. If you delete your last case in this browser, we delete it immediately. It is strictly necessary for the check (§ 25(2) no. 2 TDDDG); no consent is required for it.
The part of your link after the # sign stays in your browser and does not reach our server as an address; it is therefore not in our web server's log. The code from the door is in that log like every requested address, for up to 14 days.
Trayyce does not search for you itself and does not query any data breach databases. The page shows you search links to Google (including Google Maps), Bing, DuckDuckGo, Yandex, Startpage, GitHub and tellows. If you open one, that service receives your search term and processes it under its own privacy policy; your browser does not tell it that you came from Trayyce. You send the removal requests yourself: by email, your own mail app opens; with a form, the provider's page opens. Trayyce sends nothing and does not learn whether you actually sent anything; the tick is your own statement.
Closing-Empire asks us for the status and receives only the state (not yet opened, started, details saved, finished, expired or deleted) and two numbers: how many requests are prepared and how many are ticked off as sent. Closing-Empire does not receive your details or the names of the providers.
In the browser in which you started the case, you can delete it at any time with “Delete case”. If the cookie is missing there, for example after a private window or cleared site data, or if you no longer have the link, the case no longer opens; it is then deleted after 90 days as described below. When you delete it, we remove your details, the ticks, your link and the tie to your browser immediately; for 90 days after that we only keep, without any details about you, that the handover existed and that it was deleted. Without activity (start, saving, ticking off, finishing) we delete the case completely 90 days after the last activity: from then on the link opens nothing, and the daily deletion run removes the data. The section “Backups” applies to backup copies.
The legal basis for the check itself is Art. 6(1)(b) GDPR, because you start and use it at your own request. For reporting the status to Closing-Empire it is Art. 6(1)(f) GDPR; the legitimate interest is that Closing-Empire can see whether the handover at the door worked. The page points this out before your first entry.
You can object to this report at any time without giving reasons (Art. 21 GDPR), in your case with “Stop reporting to Closing-Empire”. After that Trayyce only answers Closing-Empire's requests about your case that it is unknown, even after you have deleted it.
Limiting requests
To keep the service from being overloaded, checks per visitor are limited. For this we derive a key from your IP address using a secret that changes on every restart, and store only that key, for 25 hours at most. Sign-ins and access links work the same way with a 15-minute window. In the privacy check with a code we count opening a code or case, code entries and changes to a case the same way. We do not store the IP address itself for this.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protection against abuse.
Usage statistics
To see how Trayyce is used, we count page views and features without cookies and without storing or reading anything in your browser. On every page change, the page only reports to our server which kind of page was opened (for example “report”, without the report ID) and, on the first page, the host name of the external website you came from, taken from your browser's referrer information. From this the server derives the device type (phone, tablet, computer), plus the country that Cloudflare sends along with the request.
To count visitors per day, the server derives a check value from the IP address and browser identifier using a daily secret. The secret and the check values are kept only in memory and expire every day at midnight (UTC) and on every restart; they are never stored. The database only holds daily figures: views per kind of page, number of visitors, devices, countries, referring sites, features used (such as started checks or sign-ins) and the number of active customer accounts. We do not store any IP address, full address or identifier of individual visitors. We delete the daily figures after 13 months.
If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we do not count your visits.
For website checks, B2B preview, workspace search and the privacy tools we also record the time, result status and duration, for website checks the checked host and for the B2B preview the search term unless it contains an email address, a long number or credentials. We delete these entries after 90 days.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is improving the service based on how it is actually used.
Customer account and sign-in
For an account we store the email address, name, role, time of the last sign-in and your password only as a salted hash. After sign-in, a session key is kept in your browser's storage (localStorage); we keep it only as a hash. The session ends after 14 days, when you sign out or when you change your password. One-time access links are valid for 60 minutes, set-up links created by the operator for up to 24 hours. We log changes to accounts for 90 days.
Accounts can be deactivated in the customer area. If you want your account deleted completely, write to info@ddevelopment.de.
The legal basis is Art. 6(1)(b) GDPR.
Tools in the customer area
The research tool searches public posts on Hacker News, Reddit, GitHub, dev.to, Stack Exchange, Mastodon and Lemmy as well as Google News and Bing News for the customer's search terms. We store matching posts with title, text (up to 4,000 characters), link, source and the publicly shown author or user name. Credentials in the text are redacted. Only the customer's signed-in users see the results; we delete them 90 days after collection. If a customer turns a result into a B2B lead, an excerpt of up to 280 characters is kept until the lead is deleted. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is finding publicly expressed demand.
With the privacy tool, a customer searches third parties for data about a data subject who has given consent and prepares deletion requests. For this we store the details the customer enters about the person (name, email addresses, phone numbers, postal addresses), the findings and the draft requests until the customer deletes the case. For the search we query Gravatar (checksum of the email address), GitHub (user name), crt.sh (own domain) and Pwned Passwords (only the first five characters of a checksum). The customer is the controller here; we process the data on their behalf.
Customers can embed a Trayyce contact form on their website. Whoever fills it in sends the website, email address and optionally a company name to the customer with explicit consent. We store the request together with the consent text for 90 days for the customer.
Customers can connect their own Telegram bots. If someone writes to such a bot, we store for the customer the person's first name, @username and Telegram ID, their messages (for photos, voice messages and files only a note such as “[Foto]”, not the file), the replies of the bot and of the customer, suggested replies, and the status and notes the customer records for the contact. Suggested replies are written by a language model on our own server; we do not pass the messages to any AI provider. If the person sends /stop, the bot sends them nothing more until they send /start themselves. We delete the contact and the conversation 180 days after the person's last message; the customer can delete them earlier at any time. The messages pass through Telegram (Telegram FZ-LLC, Dubai), where the person wrote to the bot themselves and which processes them under its own terms. The customer is the controller; we process the data on the customer's behalf.
Customers can have up to ten of their own addresses monitored. We check them roughly every seven days and store the grade history and reports as described above. If a customer sets up notifications, messages go to the chosen channel (email, Telegram, Discord or their own web address).
Contacting us by email
If you write to info@ddevelopment.de, for example to request an account or an activation, to ask for an access link, to have a domain removed without proof, or with any other question, we process your email address, your name if you give it, and the content of your message in order to reply. The buttons on trayyce.io only open your own email program with a pre-filled subject; Trayyce itself neither sends nor stores anything in the process.
The message is received by our own mail server (mail.ddevelopment.de), which is also rented from a data centre operator in Germany. We delete it once your request has been dealt with, unless a statutory retention obligation applies, for example for business correspondence. For requests to remove a domain, the periods in the section “Deleting data about a domain” apply.
The legal basis is Art. 6(1)(b) GDPR if you request an account or an activation, Art. 6(1)(c) GDPR in conjunction with Art. 17 and 21 GDPR for deletion requests, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering enquiries.
Sending emails
Trayyce currently sends no emails; no mail server is set up. Features that need an email, such as confirmation links, access links or monitoring alerts, are therefore switched off. Until then, we send replies to enquiries and operator-generated access links manually from info@ddevelopment.de.
Cookies and browser storage
The public pages set no cookies and store nothing in your browser. The exception is the cookie “ty_tuer_geraet” of the privacy check with a code, which only comes into being under trayyce.io/d (section “Privacy check with a code”). In the customer area, the session key and the chosen appearance (light or dark) are kept in your browser's localStorage, plus the cookie “sidebar_state”, which remembers for seven days whether the sidebar is expanded or collapsed. These are required for the customer area (§ 25(2) no. 2 TDDDG); no consent is needed for them.
Services Trayyce queries itself
For its features Trayyce queries public services: the DNS resolvers of Cloudflare and Google, DBpedia, Wikidata, the OpenStreetMap Overpass servers (overpass-api.de, with overpass.private.coffee as a fallback), Bing, Google News, Hacker News (via Algolia), Reddit, GitHub, dev.to, Stack Exchange, Mastodon, Lemmy and the public Have I Been Pwned list. These services receive domain names, search terms or map areas, but no information about you as a visitor.
Transfers to countries outside the EU
Cloudflare, Inc. (USA) is certified under the EU-US Data Privacy Framework; its data processing agreement also contains the standard contractual clauses (section “Visiting the website”).
For the privacy tool in the customer area, Trayyce queries these services outside the EU on behalf of the customer: GitHub, Inc. (USA, certified under the EU-US Data Privacy Framework), Automattic Inc. for Gravatar (USA, standard contractual clauses), Sectigo Limited for crt.sh (United Kingdom, adequacy decision of the European Commission) and Superlative Enterprises Pty Ltd for Pwned Passwords (Australia; only the first five characters of a checksum go there, which do not allow conclusions about a person). Since 26 October 2026 we no longer query XposedOrNot (operator in India, no adequacy decision).
Booking and payment
Sales are currently closed: we activate packages on request, and nothing is paid. Once sales open, the following applies:
If a company books a package in the customer area, we forward it to the checkout of our payment provider, Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin, Ireland. Stripe receives from us the email address of the booking account, the company ID and the package. You enter the billing address, VAT ID and payment details directly at Stripe; we do not see card or account details. We store the Stripe customer number, package, status, term, a cancellation at the end of the term and, for one-off purchases, the payment ID.
Stripe processes the data partly on our behalf and partly as an independent controller, for example for fraud prevention and anti-money-laundering checks, and may transfer it to Stripe, LLC in the USA. Stripe, LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.
The legal basis is Art. 6(1)(b) GDPR. We keep booking details as long as the account exists and beyond that as far as tax and commercial retention periods require, up to ten years (Art. 6(1)(c) GDPR with § 147 AO and § 257 HGB).
Backups
Before every update we store a copy of the database on the same server. The five most recent copies are kept; older ones are deleted after 14 days. Deletions in the running application only reach these copies once the copies themselves are deleted.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). You can withdraw consent at any time with effect for the future. To do so, write to info@ddevelopment.de.
You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.
Last updated
26 October 2026