Privacy Policy
vrfy.lol is a free, open-source email validation API. Here's exactly what happens with your data.
POST-only by design
Email validation uses POST / exclusively. Email addresses never appear in URLs, server logs, CDN analytics, or browser history.
What we store
- Domain-level cache: DNS results (MX, provider, etc.) cached by domain name for 7 days. No email addresses stored.
- Extended validation cache: Results cached by pseudonymized key (
HMAC-SHA256) for 30 days. Raw email addresses are never stored. - No analytics, no cookies, no accounts.
Third-party lookups
Extended validation checks whether an email address has a public presence across identity, cryptographic key, and reputation services. When extended validation is requested, the email address (or a one-way hash of it) may be sent to third-party APIs for lookup.
- Hash-only services — some lookups use only a cryptographic hash (MD5 or SHA-256) of the email, never the raw address (e.g., avatar services, DNS-based key discovery).
- Full-address services — other lookups require the full email address (e.g., key servers, reputation APIs, code hosting platforms, identity directories).
The specific services queried are part of the closed-source extended validation module. All lookups happen server-side and responses are cached. No data is shared with advertising or analytics services.
Legal basis
Third-party lookups for extended validation are performed under legitimate interest (GDPR Article 6(1)(f)) for email fraud prevention. Only the minimum data required by each service is transmitted — a cryptographic hash where supported, the full address only where the service requires it. No data is retained beyond the active cache window.
For business use, a Data Processing Agreement (DPA) is available on request — contact hello@yoke.lol.
IP addresses
IP addresses are used solely for rate limiting and proof-of-work challenge generation. No IP address logs are retained beyond the active rate limiting window.
Self-hosting
For full control, fork the repo and run your own instance: wrangler deploy.