Privacy
What we collect and why
Last updated 9 September 2026. Plain language on purpose.
Scans
When you scan a domain we read public DNS records, certificate transparency logs, and licensed third-party datasets about that domain. We store the results so we can show history and detect change. We never send traffic to the domain itself.
Your account
We keep your email address to sign you in and to send alerts you asked for. Billing is handled by Stripe; we store a customer reference and your plan, never card details.
Free scans without an account
Free scan results are stored briefly to serve repeat requests for the same domain and to keep the service honest against abuse. They are not linked to you unless you create an account. If you leave an email address to watch a domain, we keep it for that purpose only.
What we never do
We do not sell, share, or publish findings about any domain. We do not build lists of exposed companies for anyone. Aggregate, anonymised statistics may be published; individual findings never are.
Processors
Hosting and scheduling: Vercel. Database and sign-in: Supabase. Email: Resend. Payments: Stripe. Bot protection: Cloudflare Turnstile. Deep-tier data providers: Shodan and Have I Been Pwned, queried about your domain, never given your account details.
Deleting your data
Remove a domain and its scans and alerts are deleted with it. To delete your account entirely, email privacy@phantomstrike.io from the address on the account and we will remove it within 30 days.
Contact
Questions about this policy: privacy@phantomstrike.io. PhantomStrike is operated by [LEGAL ENTITY NAME AND ADDRESS].