Privacy Policy

Last updated: October 23, 2026

The free tools (no account needed)

When you check a domain with the SPF, DKIM, DMARC or MX tools, we send that domain to our API to run the DNS lookups. The result is cached in server memory for a few minutes so repeated checks of the same domain do not trigger new DNS lookups; it is not written to a database and is not tied to you personally. Your IP address is used to enforce a rate limit (currently 20 checks per minute, 60 per minute for the record generators) so the tools cannot be abused, and is not stored beyond what is needed to apply that limit.

Requests to the API — including the domain you checked and your IP address — can appear in ordinary server logs and in Sentry, our error monitoring tool, when something goes wrong. We do not use this for tracking or marketing, only for keeping the service running and debugging failures.

Your account

If you register for an account, we store your name, your email address, and a bcrypt hash of your password — never the password itself. We use your email to send account emails: verifying your address and resetting your password. Server logs may contain a masked form of your email address (its first letter and domain, for example a***@example.com) when we send you one of these emails; the full address is never sent to our error monitoring tool. Signing in sets a session token, stored as a browser cookie and in localStorage under the name patchkit_token, so the site can recognize you as signed in. This token is not used for advertising or analytics.

"Download my data" in account settings gives you a JSON file with your profile, workspace, domains, senders, daily statistics and the reports your dashboard shows, in case you want a copy before you change or delete anything.

You can delete your account at any time from account settings. This permanently removes your user record, and any workspace where you are the sole owner, from our database — it is not a soft delete or a grace period.

Cookies and analytics

We use Google Analytics 4 to understand which tools are useful, but it only runs after you accept the cookie banner — nothing is requested from Google until then. Once accepted, it sets the _ga and _ga_<container-id> cookies and reports aggregate usage statistics; it does not identify you personally, and we run no advertising. Google acts as a data processor for this data, and because Google Analytics is a US-based service, your data may be transferred and processed outside Turkey and the EU. You can withdraw your consent at any time from the "Cookie settings" button in the footer, which also removes these cookies. The consent choice itself (accepted or rejected) is stored in your browser's localStorage, not in a cookie.

Paid plans

Paid plans are billed through Lemon Squeezy, who acts as the merchant of record for these purchases. Lemon Squeezy handles your payment details and sends your payment receipts directly; we store your Lemon Squeezy customer ID and subscription ID so we can keep your plan in sync, not your card number.

DMARC report monitoring

When you add a domain in the dashboard, we give you a report address on patchkit.email. If you add it to your domain's DMARC rua tag, mailbox providers send their aggregate reports there and we process them to build the charts and sender list in your dashboard. Aggregate reports describe mail sent using your domain — sending IP addresses, message counts, and SPF, DKIM and DMARC results — and do not contain message content or recipient addresses.

• The raw report emails are stored in Cloudflare R2 and deleted within 30 days of arrival. A report that could not be processed is kept until we fix and reprocess it, then deleted the same way.
• Mail sent to a report address that does not belong to any domain is deleted within 7 days.
• The processed report data is kept for up to 365 days; your plan decides how much of that history the dashboard shows.
• Removing a domain, or deleting your account, deletes that domain's processed report data right away.

Pressing "Check again" on a domain's health card asks that domain's own DNS name servers directly for its current DMARC record, instead of a cached answer, so you are not shown a stale result from before you published a fix. The daily background check that updates your dashboard each day uses a cached resolver instead, the same as the free tools.

Alerts and the weekly digest

The dashboard raises an alert when a domain's DNS record is removed or changed, when SPF goes over its lookup limit, when a new unknown sender appears, when a sender's alignment drops or when reports stop arriving. Alerts appear in the dashboard on every plan; Starter and higher plans also get them by email, subject to the severity threshold you set, and as push notifications in the Patchkit iOS app if you turn them on. A weekly digest email summarizing your domains is available on every plan, including Free. Resolved alerts are deleted once they are older than your plan's report history window (the same length as the processed report data above); open alerts are kept until they are resolved.

You can turn alert emails, push alerts and the weekly digest on or off, and set the alert severity threshold, from Settings → Notifications in the dashboard or in the app. Every alert and digest email also carries a one-click unsubscribe link (RFC 8058's List-Unsubscribe), so a mail client or inbox provider can turn that email type off for you without you having to sign in.

Client report emails

On the Agency plan, an agency can add its clients' email addresses to a domain. We use those addresses only to send the monthly report for that domain, under the agency's name. Each of these emails has a one-click unsubscribe link, and a client who unsubscribes, or whose address bounces or is marked as spam, stops receiving them. The agency is responsible for confirming that its client agreed to receive these reports. Removing the domain deletes its recipients. After a bounce or spam complaint we keep only a one-way hash of the address, so we do not send to it again.

The Patchkit iOS app

The app is a companion to your Patchkit account. It signs in with the same email and password and shows the same domains, senders, reports and alerts; it does not read your contacts, location, photos or the email on your phone. Your sign-in token is kept in the iOS Keychain, and the last data you viewed is cached on the device so the app works offline. Signing out clears both.

If you allow notifications, the app registers a push token for your device with our API so we can send alerts to it. The token is used only for push notifications. It is deleted when you sign out on that device, sign out your other devices, change or reset your password, or delete your account, and it stops working if you uninstall the app. Notifications carry the alert title and the domain name, never an IP address or report contents.

Crash reports from the app go to Sentry without your name, email or IP address. The app has no in-app purchases, no advertising and no tracking. You can delete your account from Settings → Delete account in the app, which removes the same data as deleting it on the website.

Other services we use

• Resend — delivers our transactional emails (verification and password reset) and, for account holders, alert emails, the weekly digest and monthly client reports.
• Lemon Squeezy — bills paid plans, acts as merchant of record, and sends your payment receipts.
• Google Analytics — aggregate usage statistics for this website, only after you accept the cookie banner; see "Cookies and analytics" above.
• Sentry — error monitoring on the website, the API and the iOS app; the API and the app are configured to not send personal data with error reports.
• Firebase Cloud Messaging (Google) and the Apple Push Notification service — deliver push alerts to the iOS app using your device's push token.
• Railway — hosts our API and database.
• Cloudflare — receives mail sent to report addresses and stores the raw report emails (R2) until they are deleted.
• Vercel — hosts this website.

Each of these providers has its own privacy policy governing how it handles data on our behalf.

Your rights

Wherever GDPR, KVKK or a similar law applies to you, you have the right to access the personal data we hold about you, correct it, ask us to delete it, and object to or restrict how we process it. You can exercise most of this yourself from account settings, or by emailing support@patchkit.app. You also have the right to lodge a complaint with your local data protection authority.

Changes to this policy

If we change how we handle your data in a meaningful way, we will update the date at the top of this page and, for account holders, notify you by email.

Contact

For privacy questions, contact us at support@patchkit.app.