Privacy and data retention

DomainGuard reads public records and what your site already serves. The privacy policy at nhmohio.com/privacy-policy is the legal document; this article is the plain version of what the code does.

What is stored

Your account details; the domains you add and every scan result about them; change events; lookalike results; DMARC aggregate reports (counts and sending sources, never message content); compliance records and notes you write; conversations; API key hashes and usage; device tokens for push; the credit ledger; and an audit log of security-relevant actions.

What is hashed or encrypted

• Monitored email addresses are stored as a SHA-256 hash plus an encrypted copy; audit entries and push payloads carry the hash or a masked form.
• API keys are stored hashed; only the prefix is kept in the clear.
• Two-factor secrets are encrypted at rest.
• Passwords are PBKDF2 hashes.

What is pruned, and when

Scan history is kept for the life of the domain on the account and deleted with it.

What DomainGuard never does

• Read your mailboxes, filter inbound mail, or hold DNS or registrar credentials.
• Change DNS, renew domains, or edit websites.
• Run a deep scan (open ports, known vulnerabilities, exposed files) on a domain the account has not shown is its own: your verified email's domain, a domain you verified, or any domain once we approve the account. Basic scans only read what a site already shows everyone. See Which domains you can scan.
• Send your domain list to a third party for icons or enrichment; the favicon fetch that did so was removed from the app in 1.6.0.

Third parties in the path

Cloudflare (hosting, DNS for the DMARC report domain, browser rendering for audits, the 1.1.1.1 resolver, and Workers AI for the AI fix suggestions), the registries that run each top-level domain (RDAP registration data; they receive the domain name), crt.sh and the other public certificate and archive sources subdomain discovery reads (the domain name), OSV.dev (a software name and version), XposedOrNot (breach index; each watched address is sent to it to look it up, while DomainGuard stores only a hash and an encrypted copy), SMTP2GO (account email: verification, password resets, support replies and reports you ask for; alerts are never emailed), Telegram (internal operator alerts, which can include sanitised customer domain names; a request for scan approval or a review of our scan results sent through the API arrives there with your account email), our own server rented from RackNerd in Buffalo, New York (most vulnerability and port scans, the second-network uptime check, some website fetches and IndexNow notices to Bing; it receives the domains, addresses and URLs being checked, never your name or email), localseodata.com (ranking and listing data for Local SEO), WPVulnerability.net and WordPress.org (a WordPress plugin, theme or version is looked up, never your domain), CISA and NVD (vulnerability feeds), the search engines you choose for IndexNow (your changed URLs, only when you turn it on), Apple (purchases and push), and Google AdMob (banner ads on Free only; personalized with the IDFA only if you allow tracking).

Ads on Free

Free shows Google AdMob banners in the iOS app. After the ads start, the app asks once through Apple's App Tracking Transparency prompt; only if you choose Allow can ads be personalized with the advertising identifier (IDFA), and otherwise every ad is non-personalized. Where your region's ad consent rules require it, Google's consent form comes first, and Ad privacy options under Account, Settings changes the answer later. Paid plans have no ads and no prompt.

Your rights

Export what you need (PDF report, audit JSON, evidence pack) and delete the account at any time. Data requests can be sent through Ask for help.