Last updated: October 18, 2026
Max Intel ("the Site") is committed to transparency regarding data practices. This Privacy Policy explains what information, if any, is collected when you use the Site and how it is handled.
Max Intel does not:
Two things we do want to be explicit about, because a privacy tool should not be vague about its own behaviour: some tools pass the value you enter through a proxy we operate (section 5), and analytics and advertising partners do set cookies that can recognise a returning browser (section 4). Neither is anonymous by our doing alone, so we describe both plainly rather than claiming a blanket “we never track anything”.
The Site uses your browser's local storage (localStorage) to save investigation notes, the work you save in the tools listed in section 5, and preferences: your usage-notice acceptance, your cookie-banner choice, your theme, the last six tools you opened and Wayback Machine rate-limit pauses. A few tools use sessionStorage, which is cleared when you close the tab: the GitHub Repo Auditor keeps your access token there if you enter one, and the forensics tools keep case and examiner fields. This data is stored on your device and Max Intel's code never sends it to any server. You can clear it at any time through your browser settings.
Max Intel’s own code sets no cookies. The Google scripts we load do, as described here:
G-7JKM563Q5J). Google Analytics sets first-party cookies on maxintel.org (_ga and _ga_7JKM563Q5J, kept for up to two years) that give your browser a random identifier, and sends Google each page view with the page address, browser details and your IP address, which Google uses for approximate location. We see the results only in aggregate. Since 17 October 2026 the page address we send to Analytics leaves out anything after a ? or #, so values you typed into a tool are not included. To opt out, install the Google Analytics Opt-out Browser Add-on or use any browser-level tracking-protection feature.?), your IP address and browser details. Some ad units may use device fingerprinting at the network level (IP address, user-agent, screen size). You can block ads using any standard browser ad-blocker; the site remains fully functional without them.Most Max Intel tools process what you enter inside your browser. Many still contact other public services to do their job, and twelve send some requests through a proxy we run. This section says which and why. Separately, nearly every page loads Google Analytics, Google AdSense and Google Fonts (section 4).
Proxied API requests. A browser cannot call some public APIs directly because of
cross-origin restrictions, so twelve tools send some requests through a Cloudflare Worker we operate (the current list is published in
workers.json; today it is maxintel-proxy.synalo.workers.dev). The worker currently forwards a request to whatever public HTTPS address a tool gives it; it does not yet restrict requests to a fixed list of sources.
The twelve tools are Exposed (breach scanner), Tech Stack Detector, IP Lookup & Triage, Cloud IP Identifier, MAC Address Lookup, CT Monitor,
Wayback & CommonCrawl Recon (CommonCrawl index only), Sitemap Historian (live checks of vanished URLs, full scans only), Threat Intel, Threat Dashboard,
Is This Website Legit? (only when crt.sh refuses the direct request) and the ads.txt / sellers.json Inspector (only after you click Fetch, and only for the domain’s
/ads.txt, /app-ads.txt or an ad system’s /sellers.json; its paste mode sends nothing). Domain Recon does not use the worker.
Some of these requests try the public source directly first and use the worker only if that is blocked or fails (Exposed’s HIBP check, Tech Stack’s Robtex lookup,
Threat Intel’s indicator lookups, Sitemap Historian’s live checks, Website Legit’s crt.sh query). Others always go through the worker because the source blocks browsers:
CT Monitor’s crt.sh search, the CommonCrawl index, the ads.txt Inspector, MAC Address Lookup’s online vendor lookup, the GreyNoise check in IP Lookup and Cloud IP Identifier,
Exposed’s InQuest check, and the public blocklists and cloud range lists several tools download (those carry none of your input).
When the worker is used, what you entered is transmitted to it: a domain or host name, an IP address, a file hash, a certificate search, the URLs being checked,
or a MAC address — MAC Address Lookup sends the full address (all 12 hex digits) to maclookup.app, and the first six to macvendors.com, when its built-in table has no answer.
The worker forwards the request to the upstream public API and returns the response. We do not use it to build a profile of you and we do not link requests to individual
visitors, but the request does pass through infrastructure we control, and Cloudflare’s standard edge logs (which include your IP address) may exist.
If that is not acceptable for your threat model, do not use those specific tools.
Wayback Machine requests (since 9 October 2026). No tool sends Wayback Machine requests
through the proxy. Ghost Finder, Career Intel, WHOIS & Contact History, Wayback Recon, Sitemap Historian, Exposed,
Domain Recon and Is This Website Legit? run quick checks by calling the Internet Archive’s availability API (archive.org/wayback/available)
directly from your browser. If you install the optional Max Intel Archive Helper
userscript, full scans are fetched by that script, also from your browser. In both cases the usernames, domains or URLs being
checked go from your IP address straight to the Internet Archive, whose own terms and privacy policy apply, and Max Intel
receives none of them. The helper only runs on maxintel.org, only contacts archive.org and web.archive.org, sends no
cookies, and has no analytics.
Direct third-party requests. Many tools send what you enter straight from your browser to public services, with no Max Intel server in between. Those services see your IP address and the value you entered; their own privacy policies apply, and Max Intel receives none of this data. They are: IP Lookup & Triage, Cloud IP Identifier, Domain Recon, Tech Stack Detector, Exposed and Threat Intel (the IP, domain or hash goes to sources such as ipwho.is, ipapi.co, Shodan InternetDB, AlienVault OTX, RIPEstat, Robtex, ARIN, SANS ISC, crt.sh, CertSpotter, HackerTarget, rdap.org, Google and Cloudflare DNS, Have I Been Pwned, InQuest, CIRCL and the Tor Project, as named in each tool’s results); RDAP Lookup (rdap.org and the registries); Is This Website Legit? (the host name to rdap.org, crt.sh, Google Public DNS, RIPEstat and the Internet Archive); Tor Relay Lookup (Onionoo); VIN Decoder (NHTSA vPIC); Wikidata Bridge and the optional public-figure lookup in Face Finder and Video Person Tracker (the name to Wikidata); GitHub Repo Auditor (GitHub’s API); the Email Header Analyzer (sender domains to Cloudflare DNS, only when you click); Pwned Passwords and the Password Generator’s breach check (only the first 5 characters of the password’s SHA-1 hash, to Have I Been Pwned); Connection Fingerprint (about 20 echo services, then your approximate coordinates to Open-Meteo and sunrise-sunset.org, after you click Scan); the Image Verification Workbench and Weather Chronolocation (coordinates and dates to Open-Meteo, when you request a weather check); the C2PA Inspector (only if you choose to fetch a remote manifest URL); the Dork Generator’s optional “Suggest as I type” (what you type, to a third-party Google Suggest relay at rt53.literallysafe.com; off by default); and maps: the Coordinate Converter and the EXIF Viewer (only if you click Show on map) and IP Lookup (an OpenStreetMap embed of the approximate location), which load tiles from tile.openstreetmap.org, so OpenStreetMap learns the area shown. Tools that run parsers or machine-learning models download code and model files from public CDNs (jsDelivr, cdnjs, Hugging Face, Google Cloud Storage); those downloads carry none of your input.
Reverse-image uploads. Our main Reverse Image Search (image.php) uploads the image you choose
to this server so that third-party reverse-image engines can fetch it by URL; pasting an image URL there instead stores nothing.
The no-upload version does not upload your image: hashes, metadata removal and the engine launcher all run in your browser. That uploaded file is given a random
filename, is publicly reachable by anyone who has the URL while it exists, and is deleted by a clean-up that runs
the next time the helper page is used after 24 hours have passed, so it can stay online somewhat longer. The file is kept exactly as you upload it: any EXIF metadata inside it, including GPS location, stays in the public copy, so strip it first with the no-upload version’s metadata-removal button. We keep no account or other record alongside the file, but the server’s standard access logs (section 6) may record the IP address of the upload. To have a file removed sooner, email us (section 12). Do not upload an image you would not
be willing to host publicly for a day or more.
Data kept in your browser. Some tools save your work in your own browser’s local storage so it survives a reload: Investigation Notes, Evidence Logger, Records Request Tracker, OSINT Report Builder, Image Verification Workbench (including image thumbnails), the AI-dork prompt pages, and small settings in Ghost Finder, the Dork Generator and Codice Fiscale. The site also remembers the last six tools you opened. That data never leaves your device unless you export it, and clearing your browser’s site data deletes it.
Like most websites, the server hosting Max Intel may automatically log standard technical information including IP addresses, browser type, referring pages, and timestamps. These logs are used solely for security monitoring and technical troubleshooting and are not used to identify individual users.
The Site links to numerous third-party tools and services, each with their own privacy practices. We strongly encourage you to review the privacy policies of any third-party service before using it. Max Intel is not responsible for the privacy practices of external sites.
Max Intel holds no user accounts, no password database, and no store of personal records, so there is very little on this server for an attacker to take. The exceptions are described in section 5: proxied API requests (not Wayback Machine requests) transit infrastructure we operate, and images uploaded through the optional temporary-URL helper sit on this server in a publicly-reachable location for at least 24 hours (see section 5). However, you should take appropriate precautions when using any OSINT tools, including using a VPN if desired and being mindful of the information you enter into third-party services.
The Site is not intended for use by individuals under the age of 18. We do not knowingly collect any information from minors.
Depending on your jurisdiction, you may have certain rights regarding personal data, including rights under the GDPR (EU), CCPA (California), or similar legislation. Max Intel holds very little personal data, but some does pass through or sit on infrastructure we control: server logs with IP addresses (section 6), proxied requests (section 5) and images uploaded to the temporary-URL helper. To exercise your rights over that data, email us (section 12). For data collected by Google Analytics, Google AdSense, Google Fonts and the third-party services the tools contact, you can also contact those services directly.
Max Intel reserves the right to update this Privacy Policy at any time. Changes will be reflected on this page with an updated revision date.
Questions about this Privacy Policy, requests to remove an uploaded image before its 24-hour expiry, or any other privacy matter can be sent to [email protected]. We aim to reply within five working days.