Privacy policy.

Blue Decoy is a small company based in California, United States. This policy covers this website, bluedecoy.com, the Blue Decoy service, and the messages you send us.

On this website. If you use a form, we ask for your email address, and you can add your name, your organization, and a message. The form records which page it was on. Our hosting provider keeps standard request logs (the network address, the time, the page requested, and the browser's description of itself), which we use only to operate and secure the site. This website sets no cookies and runs no analytics or advertising trackers.

When you use the service. We hold what you give us to set up your account: your name, your email address, the phone number or Signal account the service runs on, and the channel you want to be alerted on. Payments are handled by Stripe; we do not see or store your card number. The service uses only the cookies needed to keep you signed in.

Your messages. We do not have access to your messages. The only messages we can see are the ones we send you, and any reply you send to them.

When a canary is opened. We record technical information about that access, such as the network it came from and the device used, and show it to you.

To provide the service and alert you, to bill you, to respond to your enquiry, to operate and secure the site and the service, and to comply with the law. We do not sell personal information, and we do not use it for advertising. Where European or UK data protection law applies, we rely on our contract with you for the service, on our legitimate interest in responding to enquiries and running a secure service, and on your consent where you ask to hear from us.

Only with service providers that act on our instructions (Vercel hosts the site, Resend delivers our mail, and Stripe handles payments); when required by law or to protect our rights, your safety, or the safety of others; and, if Blue Decoy is acquired or merged, with the successor under this policy.

If you open a canary that belongs to one of our users, we record technical information about that access on the user's behalf and show it only to them. We do not use it for any other purpose.

Your account and its records are kept for as long as you keep your account, and deleted when you delete it, except for records we must keep for tax or legal reasons. Website enquiries are kept as long as we need them to respond. If you asked to hear from us, your address stays on that list until you unsubscribe. Request logs are kept for a short period.

The site is served over HTTPS with a strict content security policy and no third-party code. Ordinary email is not end-to-end encrypted, so for anything sensitive, encrypt your message with our public key and send it to security@bluedecoy.com. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

You can export your canary records and delete your account from within the service at any time. Every message we send to a list carries an unsubscribe link. For anything else, write to contact@bluedecoy.com from the address you used with us. Depending on where you live, you may have legal rights to access, correct, delete, or restrict the use of your information, and to complain to a data protection authority.

We are based in the United States and our service providers process information there. If you use the site or the service from elsewhere, your information is transferred to and handled in the United States.

You must be 18 or older to use the service. This website is not directed at children under 13, and we do not knowingly collect information from them.

We may update this policy as the service or the law changes. The effective date at the top tells you when it was last revised.

Questions about this policy or about your information: contact@bluedecoy.com. Security matters: security@bluedecoy.com.