Privacy policy.

What we store

• Your account: email address, username, a one-way hash of your password (Argon2id, never the password itself), your role and plan, and your two-factor settings. If you turn on SMS codes, that includes your phone number.
• Sign-in sessions: the IP address and browser user agent of each signed-in session, so you and we can see where an account is in use. A session lasts 12 hours.
• Search allowance: how many searches your account has made in the current period, to apply your plan's limit. What you search for is not stored — with one exception, the Spider, below.
• Spider scans: the Spider is a correlation tool, so it is the one tool that keeps what you asked it — that is what lets a later scan tell you an identifier already turned up in an earlier search of yours. Each scan's seed and the identifiers it found are saved to your account and kept until you delete them (you can delete any scan from the tool, and deleting your account removes them all). No other account can see them.
• Visit statistics: for each page view, the IP address, the approximate location looked up from it on our own server (no third-party location service), browser and device details (type, screen size, language, time zone), the page, and the referring page. Visitors are counted with a hash that changes every day, not with a cookie.
• Payments: your plan, its renewal date, and a history of payments (amount, date, processor reference). Card numbers go straight to Stripe, and Google Play handles payment for subscriptions bought in the Android app; neither reaches us.
• Support tickets: the messages you send us and our replies.
• Security log: sign-ins, failed attempts, password and email changes and account deletions, with the email address and IP address involved.

Who else sees it

• The sources your searches go to. A leak search sends your query to XposedOrNot, ProxyNova, LeakCheck and the Have I Been Pwned breach catalogue. A dark-web search sends it to onion search engines, over Tor or through their public gateways. An IP lookup sends the address to the regional internet registry that holds it, through rdap.org, and to AbuseIPDB for its abuse reports; its location and network are looked up on our own server. A domain lookup sends the domain to the public DNS resolvers of Google and Cloudflare, to its registry through rdap.org, to the certificate-transparency services crt.sh and Cert Spotter, and to the Internet Archive's Wayback Machine, and our server visits the website itself. A phone lookup sends the number to VeriRoute Intel; its answer is held in our server's memory for up to a day, so a repeat lookup is not paid for twice, and never written to disk. A Spider scan sends, as it pivots, a username to the sites it is checked on, an email's hash to Gravatar, and a domain to public DNS, certificate-transparency and registration lookups; a person's name is never sent to any of them. They receive the query, not your account details.
• Payment processors: Stripe for cards and NOWPayments for cryptocurrency on the website, and Google Play for subscriptions in the Android app, each under its own privacy policy. For Play purchases we receive the subscription's status and order number, not your payment details.
• Bot protection: Google reCAPTCHA or hCaptcha on sign-up and sign-in.
• Email and SMS delivery: our mail provider sends account emails (activation, sign-in codes, password resets, receipts). Twilio sends SMS codes, if you choose them.
• Advertising, on the website only: decint.tools shows Google AdSense ads, and Google may set cookies to serve them. The Android app blocks these ads.

We do not sell your data, and nobody else gets it unless the law requires us to hand it over.

Cookies

We set one cookie, decint_session, which keeps you signed in. The captcha and, on the website, Google AdSense may set their own.

How long we keep it

• Account, payment history and support tickets: until you delete your account.
• Sign-in sessions: 12 hours, or until you sign out.
• Visit statistics: 90 days. After that, only daily totals remain, which describe no one.
• Security log: kept to investigate abuse of accounts, including deleted ones.

Your choices

You can change your email and password on your account page, and delete your account from the same page, in the app or on the website. See deleting your account for what is removed. For a copy of your data, or to correct it, email us at admin@decint.tools from the address on the account.

Security

Every connection is HTTPS. Passwords are stored only as Argon2id hashes, and sign-in links and tokens only as keyed hashes. Two-factor sign-in is available on every account.

Children

DECINT is for adults. It is not meant for anyone under 18, and we do not knowingly hold their data.

Changes

When this policy changes, the date at the top changes with it.