Static delivery
The website is built ahead of time into ready-made files: HTML pages, styles, scripts, fonts, images, a search index and downloadable reference files. No server code runs when you view a page. You don’t need a TestLookup account or API key to read the documentation.
Every page loads all of its files from testlookup.app itself. The site’s security header tells your browser to load scripts, styles, fonts and images, and to make network requests, only from testlookup.app. Before each release, automated checks load the site in a browser and fail if any request goes anywhere else.
Details: the security header is Content-Security-Policy.
Host request logs
Cloudflare serves the public site. It hosts the files and runs the network in front of them. Like any web host, Cloudflare processes request data to deliver pages and protect the site from attacks. That request data is:
- your IP address
- the time of the request
- the page you asked for
- your browser’s user agent, which says which browser and system you use
- the page that linked you here
Cloudflare handles that data as the project’s processor, under its privacy policy and data processing addendum. Those documents also set how long Cloudflare keeps it.
The project hasn’t turned on log export, script-based analytics or logging of each request. In Cloudflare’s dashboard, the maintainers see combined traffic figures, such as request counts and countries.
When Cloudflare’s firewall blocks or challenges a request, the maintainers can also see that event. It includes the IP address, the page and the user agent, and it stays visible for the limited time Cloudflare keeps it.
So this page doesn’t promise that no data is collected. Request data reaches Cloudflare every time you load a page.
Local theme preference
The theme control saves your choice in your browser’s local storage. Choosing Light or Dark saves that value. Choosing System removes it, and the site follows your operating system’s setting.
Nothing about the theme is sent to the host. If your browser blocks storage, the control still works on the page you’re on.
Details: browser localStorage, key testlookup-theme.
Search and walkthrough state
Search runs in your browser, using an index downloaded from the site. Your search words, and the step you reach in a walkthrough, are kept in the part of the web address after the # sign. Browsers never send that part to a server, so it doesn’t appear in the host’s request data.
The walkthroughs use made-up sample data.
Don’t type secrets or personal data into the search box or the walkthroughs. Anything in the address bar can end up in your browser history or in a link you share.
External links
Links to GitHub, the Contributor Covenant and other sites take you to a site run by someone else, and that site’s own privacy terms apply. This site’s referrer policy tells your browser to send those sites only https://testlookup.app as the page you came from, without the exact page.
Details: the referrer policy is strict-origin-when-cross-origin.
A link on this site points to evidence or a project resource. It isn’t a statement about how the other site handles data.
No accounts, forms, analytics or cookies
The website has no accounts, contact forms, comments, advertising or analytics, and it sets no cookies of its own. The search box is the only form, and it runs in your browser.
Cloudflare can set a cookie of its own in one case. If it challenges a visit it judges to be automated or abusive, passing the challenge stores a clearance cookie, as Cloudflare’s cookie list describes.
The project leaves Cloudflare’s bot-scoring, analytics and page-rewriting features off. The checks run before each release fail if an ordinary page response sets a cookie.
Details: the clearance cookie is named cf_clearance.
Operator contact
Anand Topu, the maintainer of TestLookup, runs this website. For privacy questions or requests about the website, email anand.topu@testlookup.app. Messages to that address pass through Cloudflare’s email routing to the maintainer’s own mailbox.
Please don’t post personal information in public issues.
The product security policy covers security problems in TestLookup itself. It sends them through GitHub’s private vulnerability reporting, not email. That route is for security reports about the product, not privacy questions about this website.
For questions about TestLookup itself rather than this website, see the Community page.