← Email Score

Privacy Policy

Last updated: 26 September 2026 · Applies to tcp123.com, emailscore.uk and tcp123.com/simple/

The short version

Email Score reads public DNS and domain-registration records only — the same information anyone can look up about a domain. We do not need or want your passwords, we never access mailboxes, and we change nothing on your domain. We do not keep a log of who scanned which domain. The full list of outside services involved is below, so you can see exactly who is contacted and what they receive.

What we store when you scan

Nothing that identifies you. The scan runs against the domain you type and the result is rendered in your browser. We keep aggregate counters (for example, how many scans ran) but not a browse or scan history tied to you or your IP address.

Who we contact when you scan

Your scan runs on our servers. They contact the services below and send only the domain name you typed (or, for blocklists, the IP address of that domain's mail server). Those services see requests coming from our servers — they do not receive your IP address, name or email address from us.

• Public DNS servers (through our hosting provider, Vercel) — to read the domain's SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT and mail-server records.
• Cloudflare public DNS over HTTPS (cloudflare-dns.com) — to check whether the domain's DNS is DNSSEC-signed. Receives the domain name.
• The domain's own registry (for example Verisign for .com, Nominet for .uk) — to read public registration data such as registrar and expiry date. We find the right registry from the public list published by IANA (data.iana.org) and ask it directly. For a sub-domain such as www.example.co.uk we ask about the registered parent (example.co.uk). The registry and IANA receive the domain name.
• The web addresses listed in the domain's own BIMI record (only if it has one) — BIMI lets a business publish its logo, and the record names where the logo file and its logo certificate (VMC or CMC) are kept. These addresses are chosen by whoever runs the scanned domain, so they differ for every domain (for example www.cloudflare.com or vmc.digicert.com). Our server downloads the logo and certificate from them to show you the logo and to check the certificate's dates, domain and purpose. Those hosts see a request from our server, not from you: your browser never contacts them, because we send the logo to your browser as part of the scan result. We only download small files (up to 64 KB) over https, and never from private or internal network addresses.
• Email blocklists — Spamhaus, Barracuda, SORBS and SpamCop — to check whether the domain's mail server is listed. They receive the mail server's IP address (a public address belonging to the domain, not yours).

We do not send test emails, and we do not connect to, ping or probe the domain's mail or web servers.

What we keep to prevent abuse

To stop automated abuse we keep short-lived rate-limit counters. They are keyed by a one-way hash of your IP address (and, depending on the counter, of the domain or email address involved), so they cannot be read back as an address. They expire automatically, between a few minutes and 24 hours after the request. They are not linked to scan results. We also keep aggregate, anonymous counters (for example how many scans ran and how scores are distributed).

What we store if you contact us

If you send a message through the step-4 form ("Message TCP123") or email yourself a summary, we store what you sent: your name, email address, phone number if provided, the message, your chosen discovery source, and the scan metadata for the domain you scanned. This is kept so we can reply and is shared with our email provider (Brevo) purely to deliver the message. Tell us to delete it and we will.

Monthly monitoring

If you subscribe to free score-drop monitoring, we store the domain(s) and email address you gave us, plus a baseline score, so we can alert you if the score drops. You can unsubscribe from any alert email at any time, which removes the subscription.

Analytics

Google Analytics counts page views and tool interactions. It loads only if you accept the cookie banner, uses first-party cookies, and is never used to track you across other sites or to sell data. If you decline, Google Analytics does not load.

Two Vercel tools load whether or not you accept cookies, and we describe them separately because the cookie banner does not switch them off: Vercel Speed Insights (page-speed measurements, on the main page and the step-by-step wizard) and Vercel Web Analytics (page-view counts, on the step-by-step wizard only). Vercel describes both as not using cookies or tracking you across sites. Like any web host, Vercel also receives your IP address and browser details when you load a page, in its normal server logs.

Other services that see your browser

• Google Fonts — the main page loads its fonts from Google, so your browser contacts Google (fonts.googleapis.com and fonts.gstatic.com) when the page loads, which includes your IP address. This happens before you choose on the cookie banner.
• Cloudflare Turnstile — the contact and monitoring forms use Turnstile (challenges.cloudflare.com) as a bot check, so your browser contacts Cloudflare when a form loads. It is used to tell people from bots, not to advertise.

Where data lives

Operational data (leads, monitoring subscriptions, runtime settings) is stored in Vercel-managed infrastructure (Vercel Blob storage, plus a Redis service for the rate-limit counters above where configured) and, for email delivery, processed by Brevo. Access is restricted to TCP123 UK staff.

Your rights

You can ask us what we hold about you, ask for corrections, or ask for deletion — email support-team@tcp123.uk and we will act on it. If you are unhappy with our response you can complain to the ICO (the UK data-protection regulator).

Company details

See our About page for full company details.