Privacy Policy
DechoNet collects minimal user data and processes it transparently.
Effective: October 15, 2026 (previous version: October 6, 2026)
1. Overview
DechoNet ("the service") processes only the personal data it needs. This policy was rewritten on October 6, 2026 — for the launch of security monitoring (beta) and to match what the service actually does.
Most diagnostic tools work without an account. We ask for an email address only when you sign up for security monitoring, sign in to the investigator program with an institutional address, or ask for a paid-plan launch notice.
2. What we process, why, and for how long
| Category | Data | Purpose | Retention |
|---|---|---|---|
| Verified ASM Nuclei checks (explicit start) | Account/job id, exact selected host/scheme/port, fixed template/version, time/state, bounded counters and sanitized evidence/actions. No raw response, sensitive values, cookies or tokens | Limited active checks and private results/cancellation; never promoted to public observations/search or uploaded to Nuclei cloud | 90 days or immediately on domain removal/account deletion. Afterwards, only an opaque cleanup fence/hash without account/domain/job references remains in one shared capacity row until actual cleanup is confirmed; capacity is not reused if confirmation fails |
| Security monitoring account (on sign-up) | Email address, domains you add, alert setting, sign-up and login times, the policy version you agreed to | Login links, change alerts and monthly summaries; domain ownership checks | Deleted immediately when you delete the account. A sign-up whose login link was never used is deleted after 24 hours |
| Security monitoring extras (when used) | Addresses the account owner enters for extra recipients and staff seats (with role), webhook URL, company name and logo (white label), client group names, brand watch words, DMARC aggregate reports (sending server IPs, counts and pass/fail — no message content), the domain lists put into bulk checks and their results, attack surface (ASM) check results (hosts, exposed screens, TLS and ports observed for domains you verified), API keys (stored only as a hash) and per-key daily request counts | Alert copies (only after the person confirms), staff access, webhook alerts, client reports, impersonation and spoofing alerts, showing bulk check results, applying API rate limits | Deleted when the owner removes them or deletes the account. Addresses never confirmed or accepted are deleted after 30 days; bulk checks, ASM results and API key counts after 90 days |
| Investigator account (on sign-in with an institutional email) | Institutional email address, sign-up and login times, the policy version you agreed to, case names and the targets put in cases (domains, IP addresses, AS numbers) | Sending sign-in codes and signing in, your own case workspace, access log (audit) | Deleted immediately when you delete the account (case names and target lists too). When a target leaves a case or the case is closed, what DechoNet observed only because of that case is deleted with it. A request whose code was never entered is deleted after 24 hours. What happens after the free period (December 31, 2026) is announced by email 30 days ahead |
| Login links | A hash of the one-time token (the token itself is not stored) | Logging you in | Expires after 30 minutes; purged daily |
| Sign-in codes | A keyed hash of the 6-digit code (the code itself is not stored) | Signing you in | Expires after 15 minutes; purged daily |
| Email send log | Account id, kind of mail, time, success (no address, no content) | Finding delivery problems | 90 days |
| Paid-plan launch notice (/pro) | Email address, product of interest, language | Telling you when the product launches | Deleted after the launch notice, or on request |
| Tool usage records | What was looked up (domain, IP address, URL) and the result, time, country, a client identifier (a one-way hash of IP address and browser data with a secret — it cannot be turned back into the IP address) | Showing results, detecting changes, usage statistics, preventing abuse | Lookup records 13 months (daily totals only afterwards). Stored results 13 months — the latest two per tool and target, and results for monitored domains and targets in open cases, are kept while they are monitored or in the case. Observation receipts for public tool results looked up over MCP (target, result, observation time and the DechoNet signature; no client identifier) can be viewed by anyone with the link and are kept 13 months |
| Rate limiting | IP address | Blocking excessive requests | Deleted automatically within 2 days |
| Shared result links | Lookup results with sensitive values masked | Sharing a result | Deleted after 7 days |
| Phishing link verdicts | Host of each judged link and a hash of its path (never the path, query or message text), the verdict, its reasons and time | Warning again about the same phishing; faster re-checks | 'Danger' kept without a time limit (a link that was phishing stays phishing — a wrong verdict is lifted on appeal); 'suspicious' 30 days; other verdicts 1 hour |
| Institutional pilots and investigator cases | Access log (action, path, time, hashed client identifier; the account id when signed in with an institutional email) | The institution's own audit | Two years (kept for two years even after the account is deleted, then removed) |
Messages pasted into the phishing link check are never stored; usage statistics keep only the registrable domain of the first link.
Children under 14 may not sign up for security monitoring.
3. Processors and transfers abroad
| Recipient (contact) | Country | Data | Purpose | Retention |
|---|---|---|---|---|
| Cloudflare, Inc. (cloudflare.com/privacypolicy) | USA and other countries with Cloudflare data centers | Everything in section 2 | Website hosting, database | Until the contract ends or the section 2 period expires |
| Resend, Inc. (resend.com/legal/privacy-policy) | USA | Email address, mail content (domains, changes, sign-in codes) | Sending login links, sign-in codes and alerts | Per Resend's send-log retention |
| Amazon Web Services, Inc. (aws.amazon.com/privacy) | Republic of Korea (Seoul region), Japan (Tokyo region) | What was looked up (domain, URL); URLs sent for rendering | Real certificate and header checks, page rendering (Korean and Japanese vantage points) | Not stored |
| Google LLC — Web Risk (policies.google.com/privacy) | USA | The address (URL) of a link entered in the phishing link check | Comparison with Google's public threat lists (a supporting signal) | Per the Google Cloud terms |
| Anthropic, PBC (anthropic.com/legal/privacy) | USA | The front page (screenshot and text) of a suspicious domain found by brand monitoring, and the monitored brand name | An AI second opinion on whether that page poses as the brand | Per Anthropic's commercial terms (not used for model training) |
| Google LLC — Google Analytics (policies.google.com/privacy) | USA | Cookie identifier, device and browser data, pages visited | Usage statistics | Per the Google Analytics retention setting |
| Functional Software, Inc. — Sentry (sentry.io/privacy) | USA | On an error: request path, browser data, IP address | Error tracking | Per Sentry's retention policy |
These companies process data on our behalf; some do so outside Korea. Data travels over encrypted connections when you use the service.
- If you do not want data transferred abroad, do not sign up for security monitoring, or delete your account; you will then not receive alert mail.
- Usage statistics (Google Analytics) can be refused by blocking cookies in your browser; the tools keep working.
- Website hosting (Cloudflare) is required to provide the service and cannot be refused.
Render fingerprint search
Requested URLs and public pages are processed temporarily at AWS observation points in Seoul, South Korea and Tokyo, Japan; account email addresses and case identifiers are not sent in render requests. We retain brightness samples, structural DOM and resource/favicon hashes, hostname, time and profile for 13 months. This store does not retain raw HTML, screenshots, form values, tokens or raw URL paths. Case fingerprints and related alerts remain within that case and are erased on member removal, case closure or account deletion. Independently collected public discovery fingerprints retain their own retention period.
4. Sharing with third parties
We do not give personal data to third parties unless the law requires it.
5. Deletion
Data whose retention period has passed or whose purpose is fulfilled is deleted without delay; electronic records are removed from the database in a way that cannot be recovered.
6. Your rights
- You may ask at any time to see, correct, delete or stop the processing of your personal data.
- Security monitoring users can turn alerts off, remove domains or delete the account themselves on the account page. Deleting the account removes the email address, domains and send log right away.
- Every alert email carries an unsubscribe link.
- For anything else, write to support@dechonet.com; we answer within 10 days.
7. Cookies and browser storage
You can delete or block cookies in your browser settings. Without the login cookie you cannot log in to security monitoring.
- lang — language preference
- dn_acct — keeps you logged in to security monitoring (30 days, signed)
- dn_exp_<domain> — keeps the ownership proof of the exposed admin page check (30 days)
- dn_pilot_* — institutional pilot access code (30 days)
- dn_admin — operator only
- Google Analytics cookies (_ga etc.) — usage statistics
- Browser storage dechoTour — whether you have seen the first-visit tips
8. Security measures
- All traffic is encrypted with HTTPS.
- No passwords. Login links are stored only as a hash and work once, for 30 minutes.
- Login cookies are signed and not readable by JavaScript (HttpOnly).
- Account pages, where login and unsubscribe links open, are excluded from usage statistics (Google Analytics) and error tracking (Sentry), and error reports never carry cookies.
- Domain ownership is re-checked monthly; alerts stop for a domain whose ownership record is gone (in case it changed hands).
- Access to personal data is limited to the operator, and excessive requests are rate-limited.
9. Advertising
We do not show ads at present. Before we do, this policy will be updated and announced.
10. Privacy officer and remedies
- Privacy officer: the DechoNet operator (support@dechonet.com)
- Korea Personal Information Infringement Report Center: privacy.kisa.or.kr / 118 (in Korea)
- Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
- Korean National Police Agency cybercrime reporting: ecrm.police.go.kr / 182 (in Korea)
11. Changes to this policy
Changes are announced on this page 7 days before they take effect (30 days for changes against your interest), and by email to security monitoring users.
October 16, 2026 clarification: the tool usage records item now states that public tool results looked up over MCP get an observation receipt signed by DechoNet, viewable by anyone with the link and kept 13 months. Outside verification (expectations): the domain, the expectations and the check results are kept 30 days after the last check when anonymous, or until the account is deleted when made with an API key, with a 90-day check history; a set owned by an account that stops holding is listed in that account’s alert mail. Check before an action (MCP check_before_action) accepts the page structure as host names only (form targets, frame origins, where the card fields sit), uses it for the verdict and does not store it — no field values, page text, or URL paths and queries; the result is kept as an observation record with the host and verdict only, for 13 months, and a suspicious answer puts the host and the signal names in the DechoNet check queue for 90 days. Page reports (MCP report_page) keep the host, the kind of report and an anonymous identifier (a hash) used to count independent reports, for 90 days (for a malicious MCP server also the endpoint path, for a network anomaly also the certificate serial, issuer and addresses the reporter saw and the country of the connection, never the reporter address); a report alone changes no verdict. These are records within the lookup targets and results already described; no new personal data is collected and no client identifier is included.
October 15, 2026 changes: Google Web Risk (phishing link check) and Anthropic (AI check in brand monitoring) added to the processor table, and the AWS Tokyo vantage point reflected; fonts are now served from our own domain, so opening a page no longer contacts Google Fonts; sign-in with an institutional email (sign-in codes) and case workspace data for the investigator program added; data handled by the security monitoring extras (recipients, staff seats, webhook, white label, client groups, brand watch, DMARC reports, bulk checks, ASM checks, API keys) and when it is deleted added; retention periods set for tool usage records and stored results (13 months) and the case access log (two years), and what was observed only for a case is deleted when the case closes; phishing link verdicts (host and path hash) and their retention added.
October 6, 2026 changes: security monitoring account data added; the usage records we actually keep and their retention stated; processors and transfers abroad named; the fact that no ads are shown reflected.