Privacy Policy

Last updated: 2026-09-28

This policy describes what RUA Reports stores about you and why. The controller is Postal Systems OÜ, Estonia, info@postalsys.com.

What we store

  • Account data: your email address, a hash of your password (never the password), the public keys of your passkeys, your encrypted TOTP secret and hashed recovery codes, your language, time zone and theme preferences, the version of the terms you accepted and when, and the IP address used at signup and at each sign-in.
  • Domains: the domain names you add and the results of DNS, MX and certificate checks we run against them.
  • Reports: the DMARC and TLS-RPT reports sent to your report address by mail receivers. These contain the IP addresses of servers that sent mail as your domain, authentication results, message counts, and the reporting organisation's contact address. They do not contain message content.
  • Sending sources: for each server address named in your reports we look up public facts over DNS (the reverse DNS name, the network that announces the address and its country) and note which email service it belongs to. These facts are about the address, not about you, and are shared by every account that sees it.
  • Server logs: request logs with IP addresses and user agents, kept for up to 30 days for security and troubleshooting.

Why

To operate the service you signed up for, to keep your account secure, and to prevent abuse. We do not sell data and we do not use it for advertising.

Retention

Account data is kept until you delete your account. Report data is kept on a best-effort basis as described in the Terms of Service and is pruned automatically. Deleting a domain deletes all report data for it; deleting your account deletes everything.

Cookies

The service sets only cookies it needs to work: a session cookie, a time zone cookie, an optional "trusted browser" cookie for two-factor authentication, and your theme choice in local storage. There are no third-party trackers or analytics scripts.

Third parties

Transactional email (verification, password reset, alerts) is sent through Mailgun. Hosted MTA-STS certificates are obtained from Let's Encrypt. Both receive only the data needed for that purpose.

Network facts about sending addresses come from Team Cymru's public IP-to-ASN DNS service, which receives the address being looked up. When a source sending as your domain fails DMARC, the report data about that one source (the address and its network facts, your domain name, the message counts, and the DKIM and SPF domains the reports list for it) is sent to TypeSafe (typesafe.ai) to judge whether it is a service you use, a forwarder or someone spoofing you. No message content and no account data is sent.

Your rights

You can view and change your data in the settings, export your domain list, and delete your account yourself. For anything else, write to info@postalsys.com.