Privacy Policy
vrfy.lol is a free, open-source email validation API. Here's exactly what happens with your data.
POST-only by design
Email validation uses POST / exclusively. Email addresses never appear in URLs, server logs, CDN analytics, or browser history.
What we store
- Domain-level cache: DNS results (MX, provider, etc.) cached for 7 days under a pseudonymized key (
HMAC-SHA256with a server secret — requested domains never appear as cache keys). No email addresses stored. - Extended validation cache: Results cached by pseudonymized key (
HMAC-SHA256) for 30 days. Raw email addresses are never stored. - No analytics, no cookies, no accounts.
Third-party lookups
Extended validation checks whether an email address has a public presence across identity, cryptographic key, and reputation services. When extended validation is requested, the email address (or a one-way hash of it) may be sent to third-party APIs for lookup.
- Hash-only services — some lookups use only a cryptographic hash (MD5 or SHA-256) of the email, never the raw address (e.g., avatar services, DNS-based key discovery).
- Full-address services — other lookups require the full email address (e.g., key servers, reputation APIs, code hosting platforms, identity directories).
The specific services queried are part of the closed-source extended validation module. All lookups happen server-side and responses are cached. No data is shared with advertising or analytics services.
Legal basis
Third-party lookups for extended validation are performed under legitimate interest (GDPR Article 6(1)(f)) for email fraud prevention. Only the minimum data required by each service is transmitted — a cryptographic hash where supported, the full address only where the service requires it. No data is retained beyond the active cache window.
For business use, a Data Processing Agreement (DPA) is available on request — contact hello@yoke.lol.
Server logs
Cloudflare processes requests as our CDN and compute provider. Their standard edge logs (IP, URL, timestamp) are subject to Cloudflare's privacy policy. We do not access, store, or process these logs.
IP addresses
For rate limiting and proof-of-work, we store an IP-derived hashed key in a Cloudflare Durable Object. These counters expire automatically and contain no personally identifiable information beyond the hashed key. No raw IP address logs are retained on our side beyond the active rate limiting window.
Self-hosting
For full control, fork the repo and run your own instance: wrangler deploy.