This policy explains what personal information CrowID collects when you use crowid.com, why we collect it, how long we keep it and the choices you have. crowid.com is operated by Autogenous, Inc. ("CrowID", "we", "us"). You can reach us through our contact form.
What we collect
| Information | When | Purpose |
|---|---|---|
| Name, email address and, optionally, company | You create an account or update your profile | To provide your account and contact you about it |
| Password hash and salt | You create an account or change your password | To sign you in. We never store your password itself. |
| Session token hash | You sign in | To keep you signed in. The token in your browser is stored on our side only as a one-way hash. |
| Domains you scan and the scan results | You run a scan | To show and keep your results. Results consist of public information about the domain. |
| Monitored domains and alerts | You add a domain to monitoring | To re-scan it daily and tell you when something changes. |
| Name, email, company, role, company size, interest and message | You submit the contact or early-access form | To reply to you. |
| Network (IP) address | Any request | Used transiently to rate-limit scans, sign-ins and form submissions, and to protect the service from abuse. |
We do not use analytics, advertising or tracking cookies, and we do not load third-party tracking scripts. The secret scanner runs entirely in your browser: text you paste and files from repositories you scan are not sent to us.
Scans of public information
A domain scan reads information that is publicly available on the internet: DNS records, the HTTPS response from the domain's website, Certificate Transparency logs and DNS records of similar-looking domains. Scan results are saved with an unguessable identifier so they can be viewed again; anyone you share that link with can view the result.
How we use information
- To provide, maintain and secure the service, including your account, scans, monitoring and alerts.
- To respond to your enquiries and early-access requests.
- To detect and prevent abuse, fraud and security incidents.
- To comply with legal obligations.
We do not sell your personal information, and we do not use it for advertising.
Service providers
crowid.com runs on Cloudflare, Inc., which hosts the application and stores its data on our behalf as a processor. Pages load fonts from Google Fonts, which receives your IP address and browser information when fonts are requested. Domain scans query Cloudflare's public DNS resolver and public Certificate Transparency services (Cert Spotter by SSLMate, with crt.sh as a fallback) with the domain being scanned; they do not receive your personal information.
How long we keep information
- Account information, scan history, monitored domains and alerts: until you delete them or delete your account.
- Sessions: until you sign out, change your password or 30 days pass.
- Contact and early-access submissions: for as long as needed to respond and follow up, then deleted.
- Rate-limiting counters: short-lived and discarded automatically.
Your choices and rights
You can view and update your profile in account settings, delete individual scans and monitored domains, and delete your account at any time. Deleting your account permanently removes your profile, sessions, scan history, monitored domains and alerts. Depending on where you live, you may have additional rights to access, correct, port or restrict use of your information, or to object to its processing. To exercise any right, use the contact form; we will respond within the time required by applicable law.
Security
We protect information with encryption in transit, hashed passwords and session tokens, strict browser security policies and minimal data collection. Read more about security at CrowID.
International transfers
Cloudflare operates a global network, so your information may be processed in countries other than your own. Where required, transfers are protected by appropriate safeguards offered by our provider.
Children
crowid.com is a business service and is not directed at children under 16. We do not knowingly collect their personal information.
Changes
If we change this policy we will update the effective date above, and for material changes we will notify account holders by email or in the product.