Privacy in the App
Which connections the iw Toolbox makes, what it sends and what it stores locally. No tracking, no telemetry, no detour through third-party servers.
The iw Toolbox talks directly to the servers you check. There’s no inwendo relay server your queries pass through, no tracking, no telemetry, no ads and no user account. This page lists in full who the app connects to and what it stores on your device.
Connections made by checks
A check only makes connections when you start it. The exception is watching, which repeats the checks you’ve added at fixed intervals while the app is open.
DNS queries
| Destination | When |
|---|---|
| the configured resolver | for every DNS query: your system’s resolver, one of the public resolvers, your own server, or via DNS over HTTPS the chosen provider (Cloudflare, Google, Quad9, AdGuard, dns0.eu or OpenDNS) |
| name servers of the checked domain | for checks that query the authoritative name servers directly, such as the name server check, DNSSEC, trace and zone transfer |
| root servers | for the trace, which resolves from the root down |
| about 20 public resolvers | for the propagation check, which compares a record worldwide |
You choose your resolver in the settings. The resolver sees which names you query. That’s true for any DNS tool, including dig in the terminal.
Blacklists
The blacklist check queries the lists via DNS through the configured resolver. The query contains the IP address or domain being checked, so list operators can see which address is checked. If you’ve entered a Spamhaus DQS key, it is part of the queries to Spamhaus.
Mail, web and other servers
| Tool | Connection |
|---|---|
| SMTP test | to the mail server on port 25, 587 or 465. The app greets with EHLO and its own IP address and ends the connection without sending mail. |
| TLS certificate | TLS connection to the given host and port |
| HTTP check | requests the URL and each redirect, with the user agent iw-dns-toolbox/1.0 (HTTP-Check) |
| MTA-STS | fetches the policy file from mta-sts.<domain> |
| BIMI | fetches the logo from the address in the BIMI record |
| Port check | TCP connection attempts to the given ports |
| Ping, traceroute | via the operating system’s ping and traceroute or tracert programs |
Registration data
- IANA (
data.iana.org): the directory of which RDAP server is responsible for a TLD, network or AS number. The app loads it once per session. - the responsible RDAP server, for example that of a registry or of a Regional Internet Registry such as RIPE.
- WHOIS over port 43 for TLDs without RDAP: first
whois.iana.org, then the server IANA refers to, for example DENIC’s. - Team Cymru via a DNS query through your resolver, for an IP’s AS number and prefix.
Connections to inwendo
| Destination | When | What is sent |
|---|---|---|
license.inwendo.cloud |
when activating the license, on Erneut prüfen (check again) and on launch if the last check was over 24 hours ago | your license key and the software’s identifier |
serverpanel.inwendo.de |
update check in the macOS app, see Updates | request for the version list, no system profile |
iw-ip-unban-service.inwendo.cloud |
only when you click IP entsperren in IP unban | the IP address from the field |
Without a license, the app never contacts the license server.
Connection to ipify
When you open the IP unban tool, the app determines your public IPv4 and IPv6 address through the ipify service (api.ipify.org and api64.ipify.org). This is the only third-party service the app contacts without you starting a check, and only in this tool.
The MCP server
The desktop app’s MCP server only listens on 127.0.0.1, so it can only be reached from your own computer, and it requires a token. What an AI assistant requests through it are the same checks as in the app, with the same connections. What the assistant does with the results is governed by its provider.
What is stored locally
Everything stays on your device. The app keeps it in its own preferences, on macOS in ~/Library/Preferences/de.inwendo.iwToolbox.plist.
| Data | Content |
|---|---|
| settings | appearance, resolver, DoH provider, timeout, Spamhaus DQS key, MCP switch |
| license | license key, customer number, license ID and time of the last successful check |
| history | the last 200 checks with input and full result |
| watching | the checks you’ve added, with their last result |
| usage | favorites, last opened tool, recent inputs |
On macOS, the MCP server’s token is stored in the Keychain; on other platforms it is also kept in the app’s preferences.
Clear the history in the Verlauf (history) tool with Leeren (clear). Remove the license key under Einstellungen › Lizenz with Lizenz entfernen. Exports (JSON, CSV, PDF) are only saved where you put them in the save dialog.
In the web version
In the browser, all DNS queries go via DNS over HTTPS to the chosen provider, because a browser can’t make direct DNS queries. Settings, license and history are stored locally by the browser for this site.