Privacy Policy

Who we are

Final Dynamics LLC, a Pennsylvania limited liability company doing business as SignupBouncer, runs signupbouncer.com ("we", "us"). Postal address: c/o Northwest Registered Agent, LLC, 502 W 7th St, Ste 100, Erie, PA 16502-1333, USA. Email: support@signupbouncer.com.

We handle two kinds of personal data, and our role differs for each.

• Our customers' data: your account, your team, your billing, and what we learn when you visit our site. We decide how it is used, so we are its controller.
• Signups you send us to check: the email addresses and IP addresses of the people who sign up to your app. You decide why they are checked, and we process them for you as your processor, under our Terms of Service.

If you signed up to an app that uses signupbouncer, that app's privacy notice applies to your signup. Send requests about your data to that app. If you contact us, we pass your request on and help the app answer.

We do not sell personal data, use it for advertising, or put third-party analytics or tracking scripts on our site.

Your account

• Account and sign-in: your email address and its domain, your plan, when you created the account, when you last changed your password, and whether your email is confirmed. Passwords are stored only as salted, slow hashes (PBKDF2).
• Team (Scale plan): the email address of each team member you invite. A pending invite is deleted when it is accepted or cancelled, and 30 days after it expires unused. A member you remove is deleted at once.
• Apps, keys and settings: your apps' names and settings, their hook secrets, and your API keys. API keys are stored only as hashes, with their first 12 characters so you can tell them apart, and when each was created and last used.
• Reset and confirmation links: each link is random, and our database keeps only a hash of it. A link works once and expires after 1 hour (reset) or 7 days (confirmation). We delete its hash a week later.
• Usage: the number of checks per month, your plan history and your cap on extra checks, to apply your plan and bill extra checks.
• Billing: Stripe's ids for you and your subscription, and the amount, date, refunds and disputes of each payment. Stripe holds your card details. We never see them.
• Where you came from: the name of the site that linked you to us, if any (see the sb_src cookie below), stored with your account to know which channels bring signups.
• Emails: we use your account's email address to reach you about your account and your plan: confirmation and reset links, team invites, notices about your cap on extra checks, and changes to these terms. We send no newsletters. Stripe sends payment receipts itself.
• Support: the emails you send to support@signupbouncer.com and our replies.

Signups you send us to check

We never store raw email addresses or full IP addresses from the signups we check. They exist only in our server's memory while a check runs.

What we receive

• From /v1/check: the email address, the IP address, the user agent, the sign-in provider (such as Google) and which of your apps the signup is for. We do not use or store the user agent.
• From the Supabase hook: the new user's record as Supabase sends it. We read only the email address, the IP address, the user id and the sign-in provider. The rest is ignored, and the request body is never stored or logged.

What we keep

Several items below are keyed hashes. A keyed hash is a fingerprint of a value, made with a secret key unique to your account. With the key and an address, we can tell whether the two match. Without the key, nobody can turn the hash back into the address. Keyed hashes and the other items below can still relate to a person, so we treat all of them as personal data.

• The check log: for each check, the time, the app, whether it came from the hook or the API, the sign-in provider, the email domain, a keyed hash of the part before the @, the IP's /24 subnet (/48 for IPv6), the network owner (ASN), the result (allow, challenge or block), the score, the reasons and the response time. A job that runs every 6 hours deletes entries once they are 30 days old, so an entry can last a few hours past 30 days, and longer if the job fails. Entries from our 42-day launch test are kept until the test's result is recorded.
• Repeat signups: to spot the same inbox signing up again, we keep keyed hashes of the normalised inbox and each app-scoped signup attempt. Retries keep the first timestamp. Each entry expires after 7 days, with at most 30 seconds of cleanup delay even if the cleanup job stops.
• Velocity counters: per app and per account. Per /24 subnet (/48 for IPv6), and per hosting or VPN network (ASN): keyed hashes of the signup attempts (or check ids, when there is nothing to identify the attempt) of the last hour. Per keyed hash of an address's name-and-number pattern: the inbox hashes of the last hour. Per inbox hash, on each app: keyed hashes of the spellings used in the last 24 hours. A cleanup job running every 15 seconds deletes each entry when its hour or 24 hours are up. Absolute expiry bounds any cleanup delay to 30 seconds, even if the job stops.
• Hook retries: a keyed hash of each signup attempt, with our answer, for 10 minutes. Decisions with counted burst or repeat-inbox points are recomputed so expired evidence cannot cause a refusal.
• Mail-server lookups: each email domain's mail servers, cached for 1 hour, or 10 minutes when the domain cannot receive mail.
• Overrides you add: email and IP overrides are stored as keyed hashes, with a masked label for your dashboard (the first letter and the domain of an email, the /24 or /48 of an IP). Domain and IP-range overrides are stored as you typed them.

The email domain in the check log can identify a person when they use their own domain. We use the check log only to show it to you, to apply your plan, and to count checks, results and response times across all accounts so we can run and improve the service. Those counts identify no signup.

Visitors to our site

The free checker on the home page, and the MCP server

• We do not store the email or IP you type, and keep no history of your checks.
• The email's domain goes into the same mail-server cache: 1 hour, or 10 minutes when the domain cannot receive mail.
• Rate limits keep a keyed hash of your own IP address (the one you visit from, not the one you type) for up to 24 hours.
• We add one to a daily count of results (allow, challenge or block).
• The MCP server's tools follow the same rules and share the same limits.

The signup audit

• Your browser reads the query result or the list you paste. Nothing is sent until you press the button, and the page shows you everything it will send first.
• We receive email domains with a count for each, the number of accounts, and the number of Gmail repeats. We never receive an address.
• The domain list lives in memory while we check it. We do not store it, log it, or cache the mail-server lookups we make for it. To check a domain we do not know, we ask a DNS resolver for its mail servers.
• For each audit we store the date, the size of the user base as a range (1-19, 20-99, 100-999 or 1,000+), the share on burner domains rounded to 1%, which tab was used, a visitor id, and whether it was run by one of our own test accounts. These rows are deleted after 30 days, or once our launch test's result is recorded if that is later.
• The visitor id is a keyed hash of your IP address, so two audits from one network on one day count once. The key is random, one per UTC day, kept in our database and deleted when that day ends (if our server is down at midnight UTC, as soon as it is back). Backups leave it out. Once the key is deleted, the id can no longer be matched to an IP address.
• If you are signed in when you send an audit, we look up your account only to tell whether it is one of our own test accounts. The audit row stores that yes or no, not the account.
• Rate limits keep a keyed hash of your network (IPv4 /24 or IPv6 /64) for up to 24 hours: the number of audits, and the number of domains checked that day.
• "Email me this report" is optional. You must sign in and confirm your login email address first. We send the report once, only to that address, and keep no extra copy of the address for the audit. Postmark delivers the message and keeps it for 45 days. To send each report only once, we keep a random id of the report for up to an hour. We count email attempts under keyed hashes of your network and login id for up to 24 hours.

Sign-in and server logs

• Rate limits on sign-up, login and password reset keep keyed hashes of your IP address, and of the email address you sign in with, for up to 1 hour.
• Our web server keeps no access log. Our application logs record errors and events. They hold no email addresses and no full IP addresses of checked signups.

Visit counts

We count visits to our public pages with HitKeep, open source analytics software that we run ourselves on a DigitalOcean server at in.signupbouncer.com. No analytics company receives the data. The counter is a script on the public pages that search engines may index. It does not load in the dashboard, on the login and password reset pages, on the email confirmation and team invite pages, on the page that shows your new API key, in our admin pages, on the checker's answer, or on a signup form shown again with what you typed.

For each page view the counter records the path of the page without its query string, the address of the page that linked to it as your browser reports it, your browser's user agent, language, screen size and window size, any utm_ campaign tags on the link you followed, and a country, region, city and network name looked up from your IP address. The IP address is used for that lookup and for spam filtering, and it is not stored with the visit. The counter also records a click on a link to another site, a file download and a form submission, by the address the link or the form points to. It never reads what you type into a form or the checker.

Our pages send only https://signupbouncer.com/ as the referrer, so the address of the page you came from on our site is not passed to the counter.

The counter sets no cookie. It keeps a random visit identifier in your browser's session storage, which the browser deletes when you close the tab. It does not run when your browser sends a Do Not Track signal.

Cookies

• sb_session keeps you signed in. We set it when you sign up or log in. It lasts up to 30 days and stops working when you log out.
• sb_src holds the name of the site that linked you to us (the referring site's host name, or the utm_source or ref value of the link). We set it only when you arrive from another site or a tagged link, and it lasts 30 days. If you create an account in that time, we store that name with the account. Otherwise we never use it.
• We count page views per day, by page and by that same source. The counts hold nothing about the visitor.
• The visit counter described under Visit counts sets no cookie. It keeps a random visit identifier in session storage until you close the tab.
• If you switch between the light and dark theme, your browser remembers the choice in its local storage. It is never sent to us.

Why we use data, and our legal bases

For visitors and customers in the EEA, the UK and similar places, the law asks us to name a legal basis for each use.

• To run your account and provide the service (sign-in, apps, keys, team, usage, service emails, support): to perform our contract with you.
• To bill you and keep payment records: to perform our contract, and to meet our tax and accounting duties.
• To keep the service secure and stop abuse (rate limits, logs, the checker and audit limits): our legitimate interest in a working, safe service.
• To learn which channels bring customers (sb_src, page counts, the visit counter) and to count checks, results and response times: our legitimate interest in running and improving the business.
• To check your end users' signups: on your instructions, as your processor. Your legal basis covers it.

Who handles data

These providers handle personal data for us. OVHcloud and Cloudflare also handle the signups you send us to check. We share personal data with no one else, unless the law requires it or we sell or transfer our business, in which case the buyer takes on this policy.

Our nightly database backups are encrypted on our server before they are copied off it to Cloudflare R2. Only we hold the key that opens them, and it is never on the server or with Cloudflare.

Where data is

We are a US company, and our server is in Virginia, US. The visit counter runs on a DigitalOcean server in the US. If you use the service from outside the US, your data is transferred to and processed in the United States, where data protection law may differ from yours.

How long we keep it

When you delete your account

• We delete the account at once, with its apps, API keys, settings, overrides, team members and invites, sign-ins, usage, plan history and check log. You cannot undo it.
• A paid plan is cancelled at the same moment. The rest of the period is not refunded, and extra checks already used are billed on a final invoice. To ask for a refund, email support@signupbouncer.com before you delete the account.
• Your API keys stop working at once, and the Supabase hook lets every signup through unchecked. Team members are signed out and their sign-ins are deleted. We email the owner a confirmation. Team members get no email.
• We keep the payment records Stripe sent us (amounts, dates, refunds, disputes and Stripe's ids, with no email address) and a record of the deletion with your Stripe customer id, because tax and accounting law requires us to keep payment records. Stripe keeps its own copy of your invoices.
• Repeat-signup hashes, velocity counters and hook retry answers expire on their own within 7 days and 30 seconds. They hold only keyed hashes, and the key behind them is deleted with your account, so they can no longer be matched to an address.
• A deleted account stays in our encrypted backups for up to 30 days. Postmark keeps the confirmation email, like every email it sends, for 45 days.

Security

• Every connection to our site and API is encrypted, and our server accepts web traffic only from Cloudflare.
• Passwords are stored as salted, slow hashes. API keys and reset, confirmation and invite links are stored only as hashes.
• The signups you send us are stored only in the reduced and hashed forms listed above.
• Backups are encrypted with a key that is kept off the server.
• Only the people who run the service can reach the server and the database.
• If a breach puts your personal data at risk, we tell you without undue delay, and tell the authorities where the law requires.

Your rights

• You can ask us for a copy of your personal data, to correct it, to delete it, to send it to you in a machine-readable form, or to stop or limit a use of it. Where we rely on legitimate interests, you can object.
• You can change most of your account's data yourself on the dashboard: apps, keys, settings, overrides and team.
• The account owner can download everything we keep about the account as one JSON file, from the Account tab of the dashboard ("Download my data"). Password, API key and link hashes are left out of it. Card details and invoices are with Stripe, and you open them from the Billing tab.
• The account owner can delete the account on the same tab, with their password and the account's email address typed out. When you delete your account says what happens. Team members cannot download the data or delete the account. The Account tab shows them the owner's address.
• For anything else, or to get your data or delete your account without the dashboard, email support@signupbouncer.com from your account's address. We answer within one month.
• If you are in the EEA or the UK, you can also complain to your local data protection authority. We would like the chance to fix the problem first.
• If you are an end user of an app that uses signupbouncer, ask that app first. It controls your data, and we help it answer.

Children

signupbouncer is for businesses and developers, and our customers must be 18 or older. We do not knowingly collect data about children for our own purposes. If you think a child has given us their data, email support@signupbouncer.com and we will delete it.

Changes to this policy

We update this policy when what we collect or how we use it changes, and change the date at the top. If a change matters to you, such as a new use of your data or a new provider for the signups you send us, we email account owners before it takes effect.

Contact

Final Dynamics LLC, doing business as SignupBouncer
c/o Northwest Registered Agent, LLC, 502 W 7th St, Ste 100, Erie, PA 16502-1333, USA
support@signupbouncer.com

See also our Terms of Service.