legal

Privacy Policy

This policy explains what Internet Posture collects, why, and what we do with it. It's written to be read — if anything is unclear, ask.

last updated July 15, 2026

The short version

You don't need an account for one-off scans. Accounts (email only) are required for saved scans and client monitoring. We store the domains you submit, the public DNS records returned for them, and — for domains you opt in to monitoring — the DMARC aggregate reports mail receivers send us, so results can be revisited. We don't sell data, and we don't share it with third parties for advertising.

What we collect

  • Domains you submit. The domain name entered for each scan is stored so the result has a label and can be looked up later.
  • Public DNS records. The MX, SPF, and DMARC records returned for a domain are public data published in the global DNS. We store the lookup results alongside each scan.
  • DMARC aggregate (RUA) reports. If you point a domain's DMARC reporting at our address, mail receivers like Google and Microsoft send us daily XML summaries for that domain: sending source IPs, message counts, and SPF/DKIM/DMARC pass or fail results. These reports describe mail flows, not message content — they never include message bodies, subjects, or recipient addresses. We store them to chart pass rates and sending sources for domains you monitor.
  • Account email addresses. If you create an account, we store your email address to sign you in (we use passwordless login codes) and to send monitoring alerts for domains you choose to watch.
  • Billing details. Paid plans are processed by Stripe. Stripe handles your card details; we never see or store full payment card numbers. We keep a record of your subscription plan and status.
  • Basic technical logs. Like most web services, our servers may record standard request metadata (such as timestamps and error details) to keep the service running and secure.

What we don't collect

We don't ask for names or any personal details beyond an email address, we never see full payment card numbers, and we don't use third-party advertising or cross-site tracking cookies.

How we use it

Submitted domains and lookup results are used to display scans, maintain a history of recent scans, and operate, maintain, and improve the service. Because scans are saved and shown on the site, treat any domain you submit as publicly visible.

Sharing and disclosure

We don't sell your data. We rely on service providers to run the service — hosting and databases, Resend for transactional email, and Stripe for payments — and we may disclose information if required by law or to protect the service from abuse.

Retention

Saved scans are retained so results remain available over time. If you'd like a scan removed, email privacy@internetposture.com and we'll take care of it.

Changes

We may update this policy as the service evolves. Material changes will be reflected by the “last updated” date above.