Privacy policy

Who we are

Spoofhound is a DMARC, TLS-RPT and BIMI monitoring service operated by GoCloudConsulting. This policy covers both this website and the Spoofhound application.

What we collect and why

• Account data — your email address, password (stored only as a salted hash), and multi-factor authentication material (authenticator secrets are encrypted at rest). Used solely to operate your account.
• Email authentication reports — DMARC aggregate, DMARC forensic and SMTP TLS reports that mailbox providers send for domains you have verified you control. These describe mail flows (sending servers, volumes, authentication results); aggregate and TLS reports contain no message content. Forensic reports can include message headers and fragments — they are stored only for your own verified domains and are visible only to your account's members.
• Audit and security logs — sign-ins, configuration changes and administrative actions, kept so you can see exactly what happened in your account, including any access by our staff.
• Contact form submissions — name, email and message, used only to reply to you.

What we don't do

• No advertising, no sale of data, no sharing with third parties beyond the infrastructure below.
• No tracking cookies on this website. The application uses a single, strictly necessary session cookie.

Where data lives

Spoofhound runs on Cloudflare's global network (application, database and report storage) and sends email — sign-in codes, alerts, digests — via Amazon Web Services (SES) from the EU (London) region. IP addresses appearing in your reports may be looked up against the ipinfo.io service to show you network names and countries.

Retention and your rights

Report data is retained while your account is active so trends stay meaningful. Reports received for domains nobody has claimed are held briefly (at most 60 days) and then deleted. You can request an export or deletion of your account's data at any time via the contact page, and we will act on legitimate requests without undue delay.

Contact

Privacy questions: use the contact form. Security reports: see security.txt.