How it works and what is stored

This is not legal advice

• Horkos assesses a website automatically, based on public sources. The result is a risk assessment — not an accusation, and not a conclusion of a court, the police or a regulator.
• An automated assessment can be wrong, in either direction. “Low risk” does not mean that a site is guaranteed to be safe.
• If the result is grey, the site could not be read. This is not a sign of safety.
• If someone asks you for money or personal data and you have doubts, do not pay until you have checked another way.

What is stored — and what is not

• Your IP address is not stored. To limit the number of requests, it is hashed with a key that is renewed every time the server restarts and is never written anywhere. After a restart, an old record cannot be linked to an address — not even by us.
• The only exception — an attempt to break into the site. If a request looks for a system file that has never existed on this site (for example /.env or /wp-admin) — only automated break-in tools do this — we keep that request's time, IP address and path for 30 days. If needed, it may be passed to law enforcement or to the network provider that owns the address. The address of an ordinary visitor, or of someone checking a link, is never stored.
• The form “My site was listed by mistake”. If you fill in this form, we keep your text and, if you gave them, your contact details — only to handle the complaint. We review the complaint within 7 days. The contact details delete themselves one year after the decision; the record of the complaint and of the decision stays, so that it can be checked later. Your IP address is not stored here either.
• What you checked is not written to our logs. The log keeps only the page path (e.g. /scan), the response status, the duration and the hash mentioned above. The link or domain you entered — no.
• We count how many people use Horkos — only numbers, by day: page views, visitors, checks, the colour of the result and the country (according to Cloudflare). Who came, their address or what they checked — is not stored.
• The text of a pasted message is not stored. It is used only for the check.
• A check's result stays in the server's memory for 10 minutes, so that the “full report” shows the same check. It contains no information about you.
• Technical records about sites are stored — for example, the domain's registrar, the favicon's hash, or a company name already found on the site or in the archive. These records are about sites, not about the people who checked them.
• A short record of a checked site is stored — the site's name, the page title, the server, the certificate, fingerprints and the assessment, with a date accurate only to the day. This shows whether a site changed or disappeared over time. The page itself, the link's full address (path and parameters) and who checked it are not stored.
• A high or critical assessment of a named company is written to a human review queue: the domain, the company name, the assessment and the reasons. Who checked it is not written.
• For a high- or critical-risk site, a “case file” is kept — what we found, when, and the files' hashes, so that a change is visible. This is needed if a bank or law enforcement needs evidence. The file is about the site: who checked it, their IP address or hash — is not written.
• Your language choice. When you click a flag, one cookie is kept in your browser (hk_lang) — only the chosen language, for one year, so the home page opens in that language. Nothing else.
• Hosting and network provider. The site is hosted by Railway, and the traffic goes over Cloudflare's network (this makes the site faster). Both keep technical logs at their own level, including IP addresses. This is outside our control — we do not keep them.

What we do not do during a check

• We do not sign in to accounts, do not fill in forms and do not touch the site's files.
• We do not get around bot protection. If a site refuses, the report says so directly.
• Every request carries our name and this page's address, so that the site's owner knows who is checking and how to object.

Is the assessment of your company wrong?

Open your site's page in the list of suspicious links and fill in the form “My site was listed by mistake”. Say why you consider the assessment wrong. High assessments of named companies go to a human review queue, and the result of the review — confirmation or rejection — is recorded so that the old record is not deleted.