Last updated September 17, 2026.
Who is responsible
Serhii Tanichev runs email-spam-tester.com and is the data controller for everything described here. Questions and requests go to hi@email-spam-tester.com.
There are no accounts
The site has no signup and no login. It sets no cookie of its own, and the analytics cookies described below only with your permission where the law asks for it. Nothing you do here is tied to a name unless you write to me.
When you reserve a test address
The service records the IP address the request came from and keeps it for 30 days, to limit abuse. After that the address is erased from the record while the record itself stays, because the report link hangs on it. It also records the language you chose, so the report can be written in it.
When you send a message to that address
The message is stored in full, source, headers and attachments included, because the checks need it and because the report offers a "message as received" view. The stored message is deleted two days after it arrives.
The report itself is kept indefinitely at its permanent link. A report contains the results of every check, the subject line, the sender address, the bounce address, the links found in the message and short quoted excerpts where a finding needs one. Anyone who has the link can open it. There is no other access control on a report, so treat the link the way you would treat the message.
Producing the report involves other parties, the same ones any receiving mail server talks to:
- DNS resolvers and the public DNS blocklists. Your sending IP address and the domains in your message are looked up there.
- The servers behind the links in your message. The tester fetches them from its own server to check where they lead and how they answer.
- A language model, reached through a third-party API, which writes the fix plan. It receives a fact sheet: measurements and finding texts with sender addresses redacted. It never receives the body, the raw headers or the subject.
Server logs
The web server and the API each write one line per request: IP address, user agent, referrer, browser language, the path requested, the response status and timing, and, when they are present, the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content, utm_id) and the click identifiers advertising platforms add to their links (gclid, gbraid, wbraid, dclid, msclkid, fbclid, li_fat_id, rdt_cid, twclid, ttclid). No other query parameters are logged. API lines can include the report identifier. Log files are rotated daily and deleted after 30 days.
Cookies and analytics
The site uses Google Tag Manager and Google Analytics 4 to count page views and a handful of events, such as an address being reserved or a report being opened. Report identifiers are stripped from the page address before anything is handed to Google, so an analytics record can never open a report.
If you are in the European Economic Area, the UK or Switzerland, the site asks first. Until you answer, neither Google script is loaded, and after a "Decline" it stays that way. The page works out where you are from your browser's time zone, and that guess never leaves the browser. When it is wrong, Google makes its own check by IP address and, for those countries, measures without setting cookies. Visitors from everywhere else get analytics by default and have the same button to turn it off.
Allowing it lets Google set its cookies, _ga and _ga_ followed by an identifier, which last up to two years. Google processes that data under its own terms. Your answer is kept in your browser's local storage, not in a cookie, and is never sent to me. To change it, use "Cookie settings" at the bottom of any page. Declining after you had allowed deletes those cookies and reloads the page.
If your browser blocks scripts, nothing is sent and the site works exactly the same.
Fonts are served from this server. The interactive API sandbox at /api-docs/try/ is the one page that pulls code from another host: its interface comes from the jsDelivr CDN, which sees your IP address when you open it.
Backups
The database, including reports and any message that has not yet expired, is backed up three times a day. Backups are kept for five days on the same server and then deleted.
Removing a report
Write to me with the report link, or from an address at the domain that sent the message. I will delete the report and whatever is left of the message. If you want to know what the service holds about you, the same address works, and the answer is almost always "one report and nothing else".
Changes
When the retention periods or the third parties above change, this page changes with them and the changelog notes it.