Privacy Policy

1. Who we are

MyDefense ("we") operates the digital privacy service at mydefense.io. We are the controller of the personal data described below. We are established in Istanbul, Türkiye and serve users worldwide, so more than one data protection regime can apply to a given account — see section 6.

2. Data we collect

• Identity and contact data: first name, last name, email address, and the language you choose for the app and our emails
• Account data: password (hashed), plan tier, wallet balance, and the record of top-ups and charges against that balance
• The country or region you declare at sign-up, which decides the law we cite when we file an erasure request on your behalf
• Access and refresh tokens for the platforms you connect (Instagram, X/Twitter, Facebook, LinkedIn, TikTok, YouTube, Gmail) — stored encrypted. Platform connections are paused at the moment, so we are not collecting new ones
• Scan results: content detected on connected platforms, risk scores, and deletion status
• Whether your email address appears in breach databases, for breach monitoring
• What you submit to a check (a link, message, website address, domain, email or document) is processed to produce the answer. For links, websites and trackers our servers fetch the address you gave us. Messages, emails and documents are also analysed by AI models (see section 9)
• Saved reports: when you are signed in and run a link, message, website, tracker or lookalike-domain check, the result (the address or domain checked, the verdict and what was found) is kept in your account so you can reopen it. We do not keep the text of a message you paste, and you can delete any report yourself
• Analysis history: for email analysis, the sender's domain and the risk signals found, not the email itself; for document analysis, the file name, the risk score, a summary and short excerpts, not the file
• Academy results: if you are signed in, your answers, score and level for each test you take (a test taken without an account is scored but not stored), how far you have got in each lesson, and the score of each game you finish in the Academy games, such as Daily Phish (games need an account; the answers you give are used to score the game and are kept with the score). If you issue a certificate: the name printed on it, your choice whether that name is shown publicly, its public verification code, the level reached and its issue and expiry dates (valid for 12 months). Anyone with the code can see what the certificate attests, and your name only if you chose to show it; on the verification page they can also type a name to learn only whether it matches yours, and we do not log that name. A certificate is certified by MyDefense on the basis of your exam result. Issued by MyDefense; not issued by a public authority
• Canary tokens: the label you give a token and, each time its trap link or image is opened, the time, the visitor's approximate country, the browser's user-agent text and whether the visit looks automated. That record does not include the visitor's IP address. We email you when a trap is triggered
• Requests to companies: the erasure requests we send on your behalf, who they went to, their status and follow-up dates
• Telegram bot: messages, links and domains you send to our Telegram bot are checked and not stored by us; we keep only a per-day usage counter tied to your Telegram user ID. Telegram handles the conversation itself under its own terms
• Tools used without an account: a per-day usage counter tied to a salted hash of your IP address, not the IP address itself
• Payment and subscription data (handled by our payment provider; we never store your card details)
• Your consent to this policy, and the date and time you gave it
• Technical data: IP address, browser information and session logs, for security and error diagnosis

3. Google API Services

3a. Limited Use

MyDefense's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: we do not use Google user data for advertising; we do not sell it; we do not transfer it to others except as needed to provide the feature you asked for, for security purposes, or to comply with applicable law; and we do not let humans read it, except with your explicit consent on a support request you raise, where security or the law requires it, or on data that has been aggregated and anonymised.

3b. What each scope is used for

Connecting Google accounts is paused at the moment; this section applies whenever it is switched back on. Google data is read only while a scan you started is running, and written only for a deletion you selected. Message bodies are not stored: a finding records the platform, the kind of content, and the identifier needed to act on it. Signing in with Google uses only your basic profile and email address and grants none of the scopes above. You can disconnect any platform from Settings at any time, which deletes the stored tokens, and you can revoke our access directly at myaccount.google.com/permissions.

4. Other connected platforms

The same principle applies to every platform you connect: we request the narrowest permissions that let us show you what is exposed and remove it when you ask. Connections to these platforms are paused at the moment: while they are paused we do not collect new platform tokens or scan results, and this section describes what applies if and when they return.

5. Legal basis for processing

We process your data to perform the contract you entered into when you created an account (GDPR Art. 6(1)(b); KVKK Art. 5/2-c), to comply with our legal obligations (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç), and, where we ask for it explicitly — such as connecting a platform account — on the basis of your consent (GDPR Art. 6(1)(a); KVKK Art. 5/1). You may withdraw consent at any time; withdrawing it does not affect processing carried out before the withdrawal.

6. Your rights

Which law gives you these rights depends on where you live. You tell us that at sign-up, and you can change it in Settings.

6a. European Union, EEA and United Kingdom

Under the GDPR and UK GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing (Art. 21), including the right not to be subject to a decision based solely on automated processing (Art. 22). You may also lodge a complaint with your national supervisory authority.

6b. Türkiye

6698 sayılı Kişisel Verilerin Korunması Kanunu'nun 11. maddesi uyarınca; kişisel verinizin işlenip işlenmediğini öğrenme, işlenmişse buna ilişkin bilgi talep etme, işlenme amacını ve amacına uygun kullanılıp kullanılmadığını öğrenme, yurt içinde veya yurt dışında aktarıldığı üçüncü kişileri bilme, eksik veya yanlış işlenmişse düzeltilmesini isteme, Kanun'da öngörülen şartlar çerçevesinde silinmesini veya yok edilmesini isteme, yapılan düzeltme ve silme işlemlerinin aktarıldığı üçüncü kişilere bildirilmesini isteme, münhasıran otomatik sistemler vasıtasıyla analiz edilmesi suretiyle aleyhinize bir sonucun ortaya çıkmasına itiraz etme ve kanuna aykırı işlenmesi sebebiyle zarara uğramanız hâlinde zararın giderilmesini talep etme haklarına sahipsiniz.

6c. California

Under the CCPA (Cal. Civ. Code §1798.100 et seq.) you have the right to know what personal information we collect and why, the right to request deletion (§1798.105), the right to correct inaccurate information (§1798.106), and the right not to be discriminated against for exercising any of them. We do not sell or share personal information as those terms are defined in the CCPA, so there is nothing to opt out of.

6d. Everywhere else

If none of the above applies to you, we will still honour a request to access, correct or delete your data. We would rather answer the request than argue about which law compels it.

To exercise any of these rights, write to privacy@mydefense.io. Self-service data export and account deletion in Settings are not available yet: to receive a copy of your data or to have your account and data deleted, write to the same address and we will handle the request under the law that applies to you.

7. Retention

We keep the personal data listed below for one year (365 days) and then delete it automatically: a job runs every day and removes whatever has passed that age. The period is a setting we control per category; if it changes, this policy is updated.

Deleted automatically after one year

• Saved reports and analyses: saved tool reports, email and document analysis history, website configuration audits, risk assessments and the list of sites found in your mailbox, counted from the day they were created (for the sites list, from the day a site was last seen)
• Academy results: your test attempts, lesson progress and game plays, counted from the day you took the test, last opened the lesson or played the game, and certificates, counted from the day they expired or were revoked. A certificate that is still valid is kept and stays verifiable
• Monitoring events: recorded canary token visits and Telegram leak-monitoring matches, counted from the day they were recorded, and breach alerts you have marked as seen, counted from the day you did
• Usage counters: the per-day counters tied to your account, to a hashed IP address or to a Telegram user ID, and the monthly deletion counters
• Scan history: completed or failed platform scans together with their findings. A scan whose deletion on a platform is still in progress is kept until that finishes

Not deleted by that job

• Your account (identity and contact data, consent record, plan): kept while the account is active and removed when your account is deleted, at your request (section 6) or because it has been inactive (see below)
• Payment, wallet and ledger records: kept for as long as accounting and tax law require us to keep them, including after your account is deleted, in which case they no longer carry any link to you
• The erasure requests we sent to companies on your behalf, with their status and follow-up dates: kept as the record that the request was made, until your account is deleted
• Things you set up and still use: connected-platform tokens, canary tokens and verified domains stay until you delete or disconnect them, or your account is deleted. You can delete a saved report, a canary token (with its recorded visits) or a platform connection yourself at any time, and revoke a certificate so that its code no longer verifies
• Breach alerts you have not marked as seen: kept until you do, and then for one year
• Server and security logs held by our hosting providers, which follow those providers' own retention periods

Deletion of inactive accounts

• An account with no activity for 24 months is deleted together with the data tied to it. Activity means signing in or using the service while signed in: running a scan, saving a report, using a tool or spending from your wallet. The period is a setting we control; if it changes, this policy is updated
• We email you at the address on the account, in the language you chose in the app, 30 days before the deletion. The account is deleted only if that warning was sent at least 30 days earlier and you have not been active since; signing in at any point cancels the deletion
• An account is not deleted for inactivity while it has an active paid plan, a wallet balance above zero, an automatic top-up set up, or a membership of an organisation
• Payment, wallet and ledger records are not deleted with the account. They are kept without your user ID, so that nothing in them points to you, for as long as the law requires

When your account is deleted, the data tied to it is removed with it, except records we are legally required to keep, such as the financial records above.

8. Security

Connected-platform access tokens are encrypted with AES-GCM before they are stored. Database access is constrained by row-level security policies. Your password is never stored in plain text, and data is encrypted in transit.

9. International transfers and processors

To provide the service, your data is handled by: Supabase (database and authentication), Cloudflare (hosting, edge network, sending our emails, and the Workers AI models that analyse messages, emails and documents you submit), our payment provider (wallet top-ups and payments), Have I Been Pwned (breach monitoring for your email address, and password checks, for which your browser sends only the first five characters of a hash; if that direct lookup fails it goes through our server instead, which does not store the password), Telegram (if you use our bot), and the platforms you choose to connect — Google, Meta, X, LinkedIn and TikTok — only to the extent you authorise. These providers operate in several countries, so your data may be processed outside the country you live in, under the safeguards those providers offer. We do not sell or rent your data to anyone, and we do not share it for marketing purposes.

10. Contact

For anything about your personal data, write to privacy@mydefense.io.

11. Changes

We may update this policy to reflect changes to the service or to the law. We will tell you about material changes before they take effect.