Privacy policy
Last updated: 12 October 2026
This policy explains what OmgSecure (“we”, “us”) collects when you use omgsecure.com and the OmgSecure app at app.omgsecure.com, why, who else handles it, how long we keep it, and what you can ask us to do with it. If anything here is unclear, write to [email protected].
What we collect
Your account. Your email address, which is how you sign in (with a one-time code or a passkey), and an optional display name. If you use a passkey, its public credential is stored with our sign-in provider; your device keeps the private part.
Your organization. Its name and industry, the people in it (their email addresses and roles), and the domains you add, with the settings you choose for them.
What we find about your domains. The results of every scan, built from public information about your domains and mail servers, and the scores, alerts and recommendations we derive from them.
Reports you route to us. If you point your DMARC or TLS reporting address at us, mailbox providers send us reports about mail sent using your domain. Aggregate reports list sending IP addresses and the domains in each message’s From and envelope-from. Failure reports can include the headers, and sometimes the content, of an individual message that failed authentication. We store these reports, including their raw text, to show you who is sending as your domain. If you upload a report yourself (for example a Microsoft SNDS export), we store the file’s contents.
Test messages you send us. When you run a real email test, we keep the sender address, sending IP address, authentication results and the message headers, so we can show you how your mail was authenticated.
Alert email. The addresses each domain’s alerts go to, which can include addresses outside your organization that you add, and each address’s choices: whether it gets alert email, how severe an alert must be to be sent straight away, how often its digest comes, and which domains it hears about. For an address outside your organization, we record when it confirmed it wants alerts. When mail to an address bounces, or its owner reports our mail as spam, we record that so we stop sending to it. We keep a record of each message we send, without its content, so no alert is sent twice.
Billing. Payments are handled by Stripe. We receive and keep your Stripe customer and subscription identifiers, your plan, the number of extra domain packs, and your renewal date. We do not see or store your card number. Stripe collects your billing name, address and, if you give one, your tax ID.
Referrals. If you join through a referral link, we record which organization referred you and whether the referral earned its credit.
What we do not collect. We do not sign in to your mailboxes. We run no analytics, advertising or tracking scripts on the site or in the app, and we set no cookies.
Why we use it
To provide the service you signed up for: to sign you in, scan your domains, store and explain reports, raise alerts and email them to the addresses you choose, bill you, and answer you when you write to us. We also use it to keep the service secure and working, for example to stop one account from overloading it. We do not sell your data or use it for advertising.
Who else handles it
These providers receive personal data to run OmgSecure. Each receives only what it needs for its part:
- Amazon Web Services runs the app, stores your data and sends our email.
- Stripe processes payments and taxes, and holds your card details.
To check your domains, we also look up public information about them and the servers that send their mail. Those lookups carry no personal data.
We may also disclose data when the law requires it, or to protect the service and its users from abuse.
How long we keep it
- Your account, organization, domains, scans, reports, alerts and test results are kept while your account is open, so you can see your history.
- Raw copies of mail we receive (reports and test messages) are deleted from our mail archive after 90 days. The parsed report, including its text, stays with your domain’s history.
- Alert email choices are kept while your organization exists. A record that mail to an address bounced is kept for 30 days; a spam report is kept until that address asks for alert email again. The record that a message was sent is kept for 30 days.
- Operational logs are kept for up to 30 days, except a few sign-up and membership logs, which we keep longer to investigate problems.
- Billing records are kept as long as tax law requires.
When you remove a domain, it stops being scanned. Its history stays with your organization unless you ask us to delete it.
Your choices and rights
You can change your display name in the app, and remove domains and members. Anyone who gets alert email can change what they get, or stop it, from the link at the bottom of every message, without signing in. To get a copy of your data, correct it, or have your account and organization deleted, write to [email protected] from the address on your account. We will confirm it is you and act within 30 days. Depending on where you live, you may have further rights, including to object to how we use your data and to complain to your data protection authority.
Browser storage
The app keeps a few settings in your browser’s local storage, such as your theme, the organization you last opened, and your sign-in session, and clears the personal ones when you sign out. This website keeps only your theme choice. Neither uses cookies.
Security
Data is encrypted in transit and stored with Amazon Web Services. Sign-in uses one-time codes or passkeys; there are no passwords to steal. Each organization’s data is kept separate, and only its members can see it.
Children
OmgSecure is a service for organizations and is not meant for anyone under 16.
Changes
If we change this policy, we will update the date at the top and say what changed. If a change reduces your rights, we will email account owners before it takes effect.