Privacy
pqdoctor
Section titled “pqdoctor”pqdoctor collects nothing and reports nothing back. It only contacts the hosts you give it. What it sends them is documented byte for byte in Probes and wire format. Results go to your screen or files you name.
Flarebox
Section titled “Flarebox”Flarebox has no telemetry, analytics or crash reporting. It contacts:
| Destination | When | What |
|---|---|---|
api.cloudflare.com |
When you use the Cloudflare views, for tray alerts every 15 minutes, and for the daily post-quantum re-check and registrar expiry check | API calls with your token, over post-quantum TLS |
| Your origins | When you click a check, and for the daily re-check | pqdoctor’s handshake-only probes |
| A URL on your zone | When you use “Why is this URL (not) cached?” | One plain GET, with no token |
| Cloudflare, through wrangler | Workers features you use | Whatever wrangler sends, with your wrangler login |
| Cloudflare, through cloudflared | Tunnels you run | The tunnel |
pqdoctor.com |
When Flarebox starts (a setting) and when you click Check for updates | One GET of /updates/flarebox.json; the installer only if you choose to install |
| Outside services your Worker calls, and your zones’ mail servers | When you click a check | pqdoctor’s handshake-only probes |
Settings, history, snapshots, checks and the last-seen state of your zones stay on your machine in %APPDATA%\Flarebox. Tokens stay in Windows Credential Manager. See Files and settings.
The tray alerts, daily re-check, expiry check and the update check at start can be turned off in Flarebox.
Note that wrangler itself may send telemetry if you’ve enabled it in wrangler. That’s wrangler’s setting, not Flarebox’s.
This website
Section titled “This website”No analytics, no cookies, no tracking, no third-party scripts. It’s static pages served by Cloudflare. The fonts come from Google Fonts, so your browser fetches them from Google. Cloudflare, as the host, sees standard request logs.
The origin study
Section titled “The origin study”The study’s scan contacted 5,139 servers handshake-only, with a contact address in its User-Agent and an opt-out list. It stored hostnames, addresses and what the handshakes said, nothing else. To opt a domain out of future scans, email hi@kalyangopalam.com.