Privacy Policy

SteelGaze is operated by Muhammad Hanif Khan, an individual trading as SteelGaze. The public business location is Beijing, China. Privacy and account-deletion requests can be sent to [email protected].

• Account data, including your email address, user identifier, authentication records, plan, and preferences.
• Emails, headers, links, attachments, sender and recipient details, and related content you submit or authorize a connected inbox to submit for analysis.
• Scan results, feedback, quota usage, connected-inbox configuration, and operational records.
• Security and usage data such as timestamps, browser information, truncated or hashed network identifiers where implemented, and service logs.
• Messages you send to support, security, sales, or the operator.

• Provide accounts, phishing analysis, saved history, connected-inbox monitoring, support, and security operations.
• Authenticate users, enforce quotas, diagnose failures, prevent abuse, and maintain service reliability.
• Communicate about your account, authentication, service changes, support requests, and security incidents.
• Improve models only when you have explicitly enabled an applicable data-contribution setting. Model-improvement use is disabled by default.

We use Contabo for infrastructure, Supabase for database and authentication services, Resend for authentication email, Purelymail for [email protected] and support, security, sales, and operator correspondence, Cloudflare for network and security services, Google for Gmail integration, and Vercel Speed Insights for performance measurement.

These providers may process data in countries outside yours under their own service terms and safeguards. Paddle may become the merchant of record for future paid checkout and would then process billing, tax, fraud-prevention, and transaction information. Paddle is not currently presented as the active payment processor.

Saved scan history and mailbox content currently remain until operational deletion or a verified deletion request. SteelGaze does not currently promise automatic deletion after 90 days.

Disconnecting an inbox stops future monitoring but does not itself erase previously saved records. Account deletion is currently handled through a verified request to [email protected]. See the Data Retention Policy for details.

You may request access, correction, export, or deletion of personal information, subject to identity verification, applicable law, security needs, and records we must retain. Automated self-service export and deletion are not yet available.

Data-contribution controls are opt-in and off by default. You can withdraw consent in settings; contact support if you also want previously contributed samples reviewed for deletion.

We use access controls, encryption in transit, provider security features, and restricted administrative access, but no online service can guarantee absolute security. Do not submit emails you are not authorized to disclose.

The service is not directed to children under 18. We may update this policy as the service changes and will revise the date above; material changes may also be communicated through the service or email.