Privacy Policy

MailBaseline is operated by Eastbase Studio, the controller of the personal data described here. For any privacy request, email support@eastbase.studio.

• Account data — your email address and a securely hashed password (bcrypt; we never store the plain password). If you use Google sign-in, we receive basic profile data (name, email, account id) from Google instead of a password.
• Domains and scan results — the domains you choose to monitor and the readiness data we read from their public DNS: SPF/DKIM/DMARC records, MX, hardening records, the issues found, and a history of changes over time.
• DMARC aggregate reports you upload — we parse them for aggregate counts (which sources passed or failed authentication) and store only those summaries. We do not store the bodies, subjects, or recipients of your messages.
• Public scans— when anyone runs a scan without signing in, we resolve live DNS for that request and use the requester's IP address only to enforce rate limits. Anonymous scans are not saved to a user account.
• Alert destinations — any Slack or Discord webhook URL you add so we can send drift alerts.
• Product analytics and diagnostics — see the cookies and analytics section below.

• To run readiness scans, monitor your domains, and send the alerts you ask for.
• To authenticate you, keep you signed in, and provide account support.
• To process subscriptions and send service emails (verification, password reset, alerts, the optional digest).
• To understand which features are used and to find and fix errors, in aggregate.
• To protect the service from abuse and enforce rate limits.

We do not sell your personal data, and we do not use the content of your DMARC reports for anything beyond showing you their analysis.

We keep tracking light and purpose-built:

• Session cookie (essential)— set when you log in so we know who you are. Without it the app can't keep you signed in. It is not used for advertising.
• Product analytics — PostHog — when configured, PostHog records which features are used so we can improve them. Events are identified by your account id only, never by your email address or DMARC data. PostHog is hosted on US Cloud and may set analytics cookies/identifiers.
• Performance — Vercel Analytics & Speed Insights — aggregate, privacy-friendly traffic and page-speed measurement.
• Error reporting — Sentry — captures technical error and a small sample of performance traces to help us fix bugs.

Every analytics integration is optional and disabled unless its keys are configured; the essential session cookie is the only one required to use your account.

We share data only with the vendors that run the service, each for a specific purpose:

• Hosting & database — application hosting and a managed Postgres database that stores your account, domains, and scan history.
• Lemon Squeezy — payments and subscriptions, as merchant of record. Card details go directly to them; we never see or store your card number.
• Resend — sends verification, password-reset, alert, and digest emails.
• Google— only if you choose “Continue with Google” for sign-in.
• PostHog (product analytics), Sentry (error reporting), and Vercel Analytics (performance) — as described above.
• Upstash — Redis used for rate limiting and caching public scan results.

• Account data is kept while your account is open and removed when you delete it.
• Scan history for monitored domains is retained for the window your plan provides (paid plans keep 90 days of history).
• DMARC aggregate summaries are kept while the domain is monitored and removed when you delete the domain or your account.
• Anonymous public scans are stateless — results are cached briefly and then expire; they are not tied to an identity.

You can update notification details in Settings. To request an export, correction, or account deletion (which removes your domains and stored scan history), email support@eastbase.studio from your account address. Depending on where you live, you may also have rights to restrict processing of your personal data or lodge a complaint with a supervisory authority.

Traffic is served over HTTPS, passwords are hashed with bcrypt, card data never touches our servers, and uploaded DMARC reports are parsed with strict size caps and external entities disabled. No system is perfectly secure, but we aim to collect little and protect what we hold.

Some processors (for example, PostHog US Cloud) operate in the United States, so your data may be processed outside your country. MailBaseline is a business tool not directed to children, and we do not knowingly collect data from anyone under 16.

We'll update this policy as the product changes; the “last updated” date above always reflects the current version, and we'll flag material changes in-product or by email.