Privacy policy

Who operates this service

Sander Heilbron operates httpstatus.codes and is the data controller for the processing described on this page. For privacy questions or to exercise your rights, email .

Website analytics

The website uses a self-hosted instance of Umami to understand aggregate usage and improve the service. The instance and its data are hosted on a server in Germany. Analytics data is not shared with an external analytics provider.

Umami records aggregated metrics such as page views, referrers, browser and device type, and approximate country. It does not use cookies, browser local storage, fingerprinting, or cross-site tracking, and it does not store your IP address. Aggregated analytics data is retained for up to 12 months and is then deleted or anonymized.

The website also records aggregated interactions with its features and downloads to understand how the service is used. These events do not include entered URLs, request or response content, or other free-form input.

API requests and IP addresses

The API at mock.httpstatus.codes processes your IP address temporarily where it is technically necessary:

• to apply rate limits and protect the free service from abuse;
• to determine a country for the GeoIP endpoint; and
• to return request information to you when you deliberately use a request-inspection endpoint.

To operate and protect the service, one structured access record is sent to New Relic when a request completes. It contains the HTTP method, the requested path without its query string, the matched route pattern, the user agent limited to 512 characters, the client IP address, the response status, the response time in milliseconds, and whether the request was rate limited.

Query parameter values, request and response bodies, cookies, authorization values, and other request headers are not included in these access records. The records are used to monitor reliability, recognize recurring traffic patterns, enforce rate limits, and investigate or prevent suspected misuse.

All access records are retained for no longer than 30 days. This same maximum applies when records associated with an IP address are selected for investigation because misuse is suspected.

The GeoIP lookup runs locally on the backend; your IP address is not sent to MaxMind.

Hosting and infrastructure

Cookies and browser storage

httpstatus.codes does not set cookies. The analytics script does not use cookies or local storage. The website stores only your selected light or dark theme in your browser's local storage. This preference stays on your device, is not sent to the operator, and can be removed through your browser settings.

Purpose and legal basis

The limited processing described above is used to deliver, secure, maintain, and improve the service. The legal basis is the operator's legitimate interest under Article 6(1)(f) GDPR in operating a reliable and abuse-resistant public service. This interest is balanced against the limited fields collected, exclusion of query values and request content, restricted access, and the maximum 30-day retention period. No data is sold or used for advertising or cross-site profiling.

Your rights

Where the GDPR applies, you may have rights to access, correct, erase, restrict, or object to processing of your personal data, and to lodge a complaint with your local data protection authority. In particular, you may object to processing based on legitimate interests for reasons relating to your specific situation.

To help locate a relevant access record, a request may need to include the IP address and approximate date and time concerned. The operator may request reasonable verification and will not disclose information when doing so could expose another person's data or undermine service security.

Contact with a privacy request or question.

Changes to this policy

This policy will be updated when the service or its data processing changes. The date at the top of this page shows the latest revision.