Privacy Policy

MailBaseline is operated by Eastbase Studio, the controller of the personal data described here. For any privacy request, email support@eastbase.studio.

• Account data — your email address and a securely hashed password (bcrypt; we never store the plain password). If you use Google sign-in, we receive basic profile data (name, email, account id) from Google instead of a password.
• Domains and scan results — the domains you choose to monitor and the readiness data we read from their public DNS: SPF/DKIM/DMARC records, MX, hardening records, the issues found, and a history of changes over time.
• DMARC aggregate reports you upload — parsed in memory; we keep normalized summaries only. Details in section 05.
• Message headers you paste into the analyzer — processed in memory; what is and isn't kept is spelled out in section 04.
• Public scans — when anyone runs a scan without signing in, we resolve live DNS for that request and use the requester's IP address only to enforce rate limits. The IP is never stored in our database and never attached to the scan; it is turned into a keyed one-way hash for the rate-limit counter. Anonymous scans are not saved to a user account.
• Alert destinations — any Slack or Discord webhook URL you add so we can send drift alerts. See section 06.
• Product analytics and diagnostics — see the cookies and analytics section below.

• To run readiness scans, monitor your domains, and send the alerts you ask for.
• To authenticate you, keep you signed in, and provide account support.
• To process subscriptions and send service emails (verification, password reset, alerts, the optional digest).
• To understand which features are used and to find and fix errors, in aggregate.
• To protect the service from abuse and enforce rate limits.

We do not sell your personal data, and we do not use the content of your DMARC reports or pasted headers for anything beyond showing you their analysis.

Raw message headers are technical metadata, but they are not anonymous. A typical paste contains email addresses (From, To, Return-Path, Reply-To), IP addresses of the relays that handled the message, message IDs, routing and relay data from the Received chain, authentication results (SPF, DKIM, DMARC verdicts), and unsubscribe metadata such as List-Unsubscribe headers.

Please paste headers only. Do not paste message bodies, attachments, secrets, credentials, API keys, tokens, or confidential content — the analyzer has no use for them, and you should not send them to us.

Precisely what happens to a paste:

• The raw paste is transient. It is sent to our server over HTTPS, parsed in memory, and discarded when the request ends. We do not write it to our database and we do not put it in application logs or error reports.
• Not signed in: nothing at all is retained. The analysis is returned to your browser and that is the end of it.
• Signed in: we save the parsed result — the check verdicts, the sending domain, and the identity fields the report shows you (such as the From and Return-Path addresses and the DKIM d= domain) — to your analyzer history, so you can compare messages over time. That record is kept until you delete your account, or ask us to remove it.

We deliberately do not claim to “never store the content of your mail”: the raw paste is never stored, but the parsed result of a signed-in analysis is, and it contains the header fields listed above. Transport in between is out of our hands — headers travel to us over HTTPS and are processed by our hosting provider.

DMARC aggregate reports arrive as .xml, .xml.gz, or .zip files from mailbox providers. Handling is the same idea as the analyzer: the file is transient, the summary is kept.

• The raw file is never stored. It is decompressed and parsed in memory during the upload request (with strict size caps and XML external entities disabled) and discarded when the request ends. We do not write the ZIP or XML to disk, object storage, or our database, and there is no deletion delay to wait out — nothing persists past the request.
• What we keep is a normalized summary: the reporting organization and report id, the reporting period, the published DMARC policy, total message counts, how many were DMARC-aligned, and a per-source breakdown.
• Source IP addresses are included in that per-source breakdown — that is the point of a DMARC report, since identifying which sending IPs pass or fail is how you find unauthorized senders. Alongside each source IP we keep its message counts, dispositions, authenticating domains, header-From domains, and our best guess at the sending platform. These are the IPs of mail servers that sent as your domain, not the IPs of your recipients, and recipient addresses are not in an aggregate report.

Summaries are kept while the domain is monitored and are deleted with the domain or the account (section 09).

If you add a Slack or Discord webhook URL, we store it so we can post drift alerts to it, and we send it only to Slack or Discord. A webhook URL is a confidential credential — anyone holding it can post into your channel — so we never display it in logs, error reports, or analytics events, and you should keep it out of shared documents and public repositories.

Be aware of what the alerts themselves carry: the domain being monitored and the DNS and authentication details that changed (record values, check verdicts, score movement). Point the webhook at a channel whose audience should see that. You can remove or replace it any time in Settings; if it leaks, rotate it in Slack or Discord.

Optional analytics are off until you accept them. Nothing loads, no cookie or analytics identifier is written, and no event is queued before that choice. You can change your mind whenever you like via Cookie preferences in the footer.

• Session cookie (strictly necessary) — set when you log in so we know who you are. Without it the app can't keep you signed in. It is not used for advertising and is not subject to consent.
• Product analytics — PostHog (consent required) — when configured and you have accepted, PostHog records which features are used so we can improve them. Events are identified by your account id only, never by your email address, pasted headers, DMARC data, or webhook URLs. Autocapture and session recording are switched off, and URLs are stripped of query strings and identifying path segments before they are sent — a pageview reads /scan/[domain], not the domain you scanned. PostHog is hosted on US Cloud and sets analytics cookies/identifiers once you accept. If you later reject, we opt out and reset the stored identifier.
• Performance — Vercel Analytics & Speed Insights — aggregate, cookieless traffic and page-speed measurement with no cross-site identifiers, so it runs without consent.
• Error reporting — Sentry — captures technical errors and a small sample of performance traces so we can keep the service working. It sets no advertising cookies, never attaches personal data automatically, and gets the same URL scrubbing as above.

Every analytics integration is also disabled entirely unless its keys are configured, so a self-hosted or preview deployment sends nothing at all.

We share data only with the vendors that run the service, each for a specific purpose:

• Hosting & database — application hosting and a managed Postgres database that stores your account, domains, and scan history.
• Lemon Squeezy — payments and subscriptions, as merchant of record. Card details go directly to them; we never see or store your card number.
• Resend — sends verification, password-reset, alert, and digest emails.
• Google — only if you choose “Continue with Google” for sign-in.
• PostHog (product analytics), Sentry (error reporting), and Vercel Analytics (performance) — as described above.
• Upstash — Redis used for rate limiting and caching public scan results.

• Account data (email address, password hash or Google account id, plan and subscription state) — kept while your account is open.
• Free-plan scan history — none. The Free plan has no monitored domains, so there is no per-domain scan history to store. Public scans you run while signed in on the Free plan are not written to your account.
• Paid-plan scan history — Starter and Growth show a rolling 90-day window of scans and score changes for each monitored domain. Scans older than 90 days drop out of the product view; they are removed with the domain or the account, and we do not use them for anything else.
• Anonymous scan cache — a public scan result is cached for 60 seconds, keyed by domain name only, so a shared link or a quick re-check doesn't hammer DNS. It expires automatically, holds no identity, and is not written to our database.
• Rate-limit records — we never store a raw IP address. The requester's IP is converted to a keyed one-way hash and used as a counter key that expires with its window: 60 seconds for scans and the analyzer, up to 60 minutes for the strictest auth limits. Nothing survives past the window, and the hash cannot be turned back into an IP address.
• Raw DMARC uploads — not retained at all (section 05). The normalized summaries, including source IPs, are kept while the domain is monitored and deleted with the domain or the account.
• Analyzer history — parsed results only, for signed-in users, kept until you delete your account or ask us to remove them. Raw pastes are never retained.
• Account deletion — email us from your account address and we remove your account and its associated data (domains, scan history, DMARC summaries, analyzer history, webhook URL) from our active systems within 30 days, usually much sooner.
• Backups and server logs — encrypted database backups roll off on our provider's schedule, and operational logs are retained for troubleshooting and abuse investigation; both are held for no more than 90 days after deletion, are not used to rebuild a deleted account, and expire on their own.
• Failed payments and downgraded accounts — if a renewal fails or you cancel, your account moves to the Free plan and your domains and history are kept for 90 days so you can resume without losing data. After that we may remove monitored-domain data from a downgraded account. Delete the account to have it removed sooner.
• Billing and legal exceptions — invoices, tax records, and payment history live with Lemon Squeezy as merchant of record and are kept for as long as tax and accounting law requires (commonly several years), regardless of account deletion. We may likewise retain the minimum needed to resolve a dispute, enforce our Terms, prevent abuse, or meet a legal obligation.

You can update notification details in Settings. To request an export, correction, or account deletion (which removes your domains and stored scan history), email support@eastbase.studio from your account address. Depending on where you live, you may also have rights to restrict processing of your personal data or lodge a complaint with a supervisory authority.

Traffic is served over HTTPS, passwords are hashed with bcrypt, card data never touches our servers, and uploaded DMARC reports are parsed with strict size caps and external entities disabled. Pasted headers, uploaded report files, webhook URLs, and secrets are kept out of our application logs, error reports, and analytics by design. No system is perfectly secure, but we aim to collect little and protect what we hold.

We operate from Vietnam and some processors (for example, PostHog US Cloud) operate in the United States, so your data may be processed outside your country. MailBaseline is a business tool not directed to children; accounts require you to be at least 18 or otherwise legally able to contract (see the Terms), and we do not knowingly collect data from minors.

We'll update this policy as the product changes; the “last updated” date above always reflects the current version, and we'll flag material changes in-product or by email.