root@osintfirm-workstation: ~/public/privacy
$cat privacy_policy.txt

Privacy Policy

Last updated: 7 October 2026

1. Who is responsible

OSINT Firm (“we”, “us”) operates osintfirm.com. For any privacy question or request, contact contact@osintfirm.com.

2. What we collect

  • Account data: your email address, a one-way hash of your password (we cannot read your password), whether your email is verified, and sign-up time.
  • Billing data: your plan, subscription status and renewal date. Card details are entered on Stripe's own pages and never reach our servers; we keep Stripe customer and subscription IDs. For crypto, we keep the order ID, chosen coin, amount and payment status; payment itself is handled by NOWPayments.
  • Contact form: the name, email, organization and message you send us. The form is delivered through Formspree.
  • Technical data: standard server logs (IP address, browser type, pages requested, timestamps), short-lived records of sign-in, sign-up and lookup attempts used to prevent abuse, and a monthly count of lookups for plans that have a limit.
  • Cookies: one essential session cookie that keeps you signed in. We do not use advertising or tracking cookies.

3. What happens to what you type into the Tools

  • Metadata Inspector: images are processed in your browser. They are not uploaded to us.
  • Search-Dork Launcher and Reverse-Image Launcher: these run in your browser and open third-party sites (such as Google, Bing, Yandex or TinEye) in new tabs with the term or image link you entered. We do not receive or store those terms. The third-party sites' own privacy policies apply to what they receive.
  • Domain & DNS Intelligence: DNS lookups are made from your browser to Google Public DNS. The domain you enter is also sent to our server, which queries a public registration-data service (rdap.org) and requests the domain's public website to identify its technology. We count the lookup for plan limits but do not keep a history of the domains you look up.
  • Email Header Analyzer and IOC Extractor: these run in your browser. The text you paste is not uploaded to us.
  • Lookalike Domain Monitor, Email Spoofing-Risk Check, and the DNS part of IP & Network Ownership Lookup: DNS lookups go from your browser to Google Public DNS (for IP ownership this includes Team Cymru's public routing-data DNS names), so Google sees the domains or IP addresses you check. We do not receive them.
  • Subdomain & Certificate Explorer and the registry part of IP & Network Ownership Lookup: the domain or IP you enter is sent to our server, which queries public sources on your behalf (the crt.sh certificate-transparency search, rdap.org and the regional internet registries). We count each lookup to prevent abuse but do not keep a history of what you looked up.
  • Breach Exposure Lookup: the domain or company name you enter is sent to our server, which searches a copy of the public Have I Been Pwned breach catalogue. We count each lookup to prevent abuse but do not keep a history of what you searched for.

Teams and the shared workspace

On the Agency plan, the account owner can invite colleagues. We store the email addresses of team members and of people who have been invited, and the notes and saved tool results that team members add to shared cases. Everyone on the team can see everything in the team's cases. We do not look at it except where needed to run or secure the service or where the law requires. Items stay until a team member deletes them or the account is deleted. If the owner's plan ends, team members lose access, and the content stays in the workspace but is not accessible until an Agency plan is active again.

4. How we use information

  • to create and secure your account and send verification codes, receipts and renewal invoices;
  • to provide the Tools and enforce plan limits;
  • to respond to your enquiries and provide consulting services;
  • to prevent fraud and abuse and keep the Site secure;
  • to meet legal, tax and accounting obligations.

5. Who we share it with

We do not sell your personal information. We share it only with service providers that help us run the Site, who may process it only for that purpose: our web host and email provider (Hostinger), Stripe (card payments), NOWPayments (crypto payments), Formspree (contact form), and Google (fonts and public DNS). Lookups made on your behalf also reach public data sources such as crt.sh, rdap.org and the regional internet registries. We may also disclose information when the law requires it or to protect our rights and users.

6. How long we keep it

We keep account and billing records while your account is active and for as long afterwards as needed for tax, accounting and legal purposes. Verification codes expire after 15 minutes. Abuse-prevention attempt records are deleted after about a day. Contact-form messages are kept as long as needed to respond and keep business records.

7. Security

We use HTTPS, store passwords only as one-way hashes, and limit repeated sign-in attempts. No system is perfectly secure, so please use a strong, unique password.

8. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal information, to withdraw consent, or to object to certain uses. Email contact@osintfirm.com and we will respond within 30 days. You may also complain to your local privacy regulator.

9. International processing

Our providers may process data in countries other than your own. We rely on them to protect it appropriately.

10. Children

The Site and Tools are not intended for anyone under 18, and we do not knowingly collect their information.

11. Consulting engagements

Information shared with us for a consulting engagement is handled under the confidentiality terms of that engagement's written agreement, in addition to this policy.

12. Changes and contact

We may update this policy and will post the new date at the top. Questions: contact@osintfirm.com.