Privacy policy

We collect the account details you type: name, email, and a password hash. We do not store the password itself. Session tokens are random and only their hashes sit in the database.

Workspace data includes domains, DKIM selectors, mailbox addresses you choose to list, alert destinations, audit events, license redemptions, and billing identifiers from Stripe or AppSumo when you use those.

DNS checks query public resolvers for records you asked us to watch. We store the records and the plain-English result. DMARC aggregate reports sent to your rua address are parsed and stored, including source IPs and pass or fail counts. Placement tests store the subject and authentication results of mail that arrives at seed inboxes you configure. We do not read unrelated mail on purpose. The poller searches for the test id.

If you connect Google Postmaster or Microsoft SNDS later, those connectors stay off until their feature flags are enabled. The current build stores only a note you type. It does not call those services.

Email alerts go through Resend when that key is set. Otherwise they stay in the workspace message log. Stripe receives the email and workspace id needed to start a subscription. AppSumo sends license keys and tier changes to our webhook.

We keep check history, reports, and audit logs for as long as the workspace exists. Deleting a workspace removes that data. Server logs may keep IP addresses and error messages for a shorter operational window.

Cookies are limited to the session and the selected workspace. They are httpOnly. The secure flag is on when the app URL is https.

To ask for a copy or deletion of personal data, email lionheartmarketsp2025@gmail.com. We will respond to the address on the account. This policy is a description of this product, not a substitute for advice from your own counsel if you sell to the public.