Privacy policy

Last updated: 19 October 2026

This policy explains what OMGSecure LLC (“OmgSecure”, “we”, “us”) collects when you use omgsecure.com and the OmgSecure app at app.omgsecure.com, why, who else handles it, how long we keep it, and what you can ask us to do with it. If anything here is unclear, write to hello@omgsecure.com.

What we collect

Your account. Your email address, which is how you sign in (with a one-time code or a passkey), and an optional display name. If you use a passkey, its public credential is stored with our sign-in provider; your device keeps the private part.

Your organization. Its name and industry, the people in it (their email addresses and roles), and the domains you add, with the settings you choose for them.

What we find about your domains. The results of every scan, built from public information about your domains and mail servers, and the scores, alerts and recommendations we derive from them.

Reports you route to us. If you point your DMARC or TLS reporting address at us, mailbox providers send us reports about mail sent using your domain. Aggregate reports list sending IP addresses and the domains in each message’s From and envelope-from. Failure reports can include the headers, and sometimes the content, of an individual message that failed authentication. We read each report and keep what we parse from it, such as sending IP addresses, domains and authentication results, to show you who is sending as your domain. We do not keep the report’s text. The same goes for a report you upload yourself (for example a Microsoft SNDS export).

Test messages you send us. When you run a real email test, we keep the sender address, sending IP address, authentication results and the message headers, so we can show you how your mail was authenticated.

Alert email. The addresses each domain’s alerts go to, which can include addresses outside your organization that you add, and each address’s choices: whether it gets alert email, how severe an alert must be to be sent straight away, how often its digest comes, and which domains it hears about. For an address outside your organization, we record when it confirmed it wants alerts. When mail to an address bounces, or its owner reports our mail as spam, we record that so we stop sending to it. We keep a record of each message we send, without its content, so no alert is sent twice.

Billing. Payments are handled by Stripe. We receive and keep your Stripe customer and subscription identifiers, your plan, the number of extra domain packs, and your renewal date. We do not see or store your card number. Stripe collects your billing name, address and, if you give one, your tax ID.

Referrals. If you join through a referral link, we record which organization referred you and whether the referral earned its credit.

What we do not collect. We do not sign in to your mailboxes. We run no analytics, advertising or tracking scripts on the site or in the app, and we set no cookies.

Why we use it

To provide the service you signed up for: to sign you in, scan your domains, store and explain reports, raise alerts and email them to the addresses you choose, bill you, and answer you when you write to us. We also use it to keep the service secure and working, for example to stop one account from overloading it. We do not sell your data or use it for advertising.

Who else handles it

These providers receive personal data to run OmgSecure. Each receives only what it needs for its part:

• Amazon Web Services runs the app, stores your data and sends our email.
• Stripe processes payments and taxes, and holds your card details.
• Cloudflare answers the DNS lookups the app makes from your browser when you scan or check a domain, through its public resolver (1.1.1.1). It sees your IP address and the names looked up.

To check your domains, we also look up public information about them and the servers that send their mail. The lookups our servers make carry no personal data.

We may also disclose data when the law requires it, or to protect the service and its users from abuse.

How long we keep it

• Your account, organization, domains, alerts and test results are kept while your account is open, so you can see your history.
• Scan results, parsed reports and the trend history built from them are kept for 12 months from when we recorded them, then deleted.
• We do not keep the text of a report, only what we parse from it.
• Copies of mail we receive (reports and test messages) are kept in our mail archive for 90 days, then deleted.
• Alert email choices are kept while your organization exists. A record that mail to an address bounced is kept for 30 days; a spam report is kept until that address asks for alert email again. The record that a message was sent is kept for 30 days.
• Operational logs are kept for up to 30 days, except a few sign-up and membership logs, which we keep longer to investigate problems.
• Billing records are kept as long as tax law requires.

When you remove a domain, it stops being scanned, and its scans, reports, trend history, alerts and test results are deleted.

Your choices and rights

You can change your display name in the app, and remove domains and members. Anyone who gets alert email can change what they get, or stop it, from the link at the bottom of every message, without signing in. To get a copy of your data, correct it, or have your account and organization deleted, write to hello@omgsecure.com from the address on your account. We will confirm it is you and act within 30 days. Depending on where you live, you may have further rights, including to object to how we use your data and to complain to your data protection authority.

Browser storage

The app keeps a few settings in your browser’s local storage, such as your theme, the organization you last opened, and your sign-in session, and clears the personal ones when you sign out. This website keeps only your theme choice. Neither uses cookies.

Security

Data is encrypted in transit and stored with Amazon Web Services. Sign-in uses one-time codes or passkeys; there are no passwords to steal. Each organization’s data is kept separate, and only its members can see it.

Children

OmgSecure is a service for organizations and is not meant for anyone under 16.

Changes

If we change this policy, we will update the date at the top and say what changed. If a change reduces your rights, we will email account owners before it takes effect.

Contact

OMGSecure LLC, 971 US Highway 202N, Ste N, Branchburg, NJ 08876, United States, is responsible for your data under this policy. hello@omgsecure.com